LDAP + Zimbra authentication

Question

I'm trying to configure external LDAP authentication from my LDAP box through Zimbra. Both servers are running on CentOS.

The Zimbra wiki has documentation but it's still leaving me puzzled.

http://wiki.zimbra.com/wiki/LDAP_Authentication#Configuring_external_LDAP_authentication

This is what my ldapsearch consist of:

ldapsearch -x -D cn=Manager,dc=domain,dc=com -y pass -H ldap://ldap.domain.com -b dc=domain,dc=com '(&(objectClass=JammMailAlias)(mail=marketing@domain.com))'

Any idea what the right filter would be? I'm pulling my hair trying to figure this out.

Here's the output of the ldapsearch above:

$ ldapsearch -x -D cn=Manager,dc=domain,dc=com -y pass -H ldap://ldap.domain.com -b dc=domain,dc=com '(&(objectClass=JammMailAlias)(mail=marketing@domain.com))'
# extended LDIF
#
# LDAPv3
# base <dc=domain,dc=com> with scope subtree
# filter: (&(objectClass=JammMailAlias)(mail=marketing@domain.com))
# requesting: ALL
#

# marketing@domain.com, domain.com, hosting, domain.com
dn: mail=marketing@domain.com,jvd=domain.com,o=hosting,dc=domain,dc=com
objectClass: JammMailAlias
objectClass: top
mail: marketing@domain.com
cn: Marketing Team
accountActive: TRUE
maildrop: bob
maildrop: john
maildrop: amy

lastChange: 1277317208

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1

Here's an ldapsearch for a user:

$ ldapsearch -x -D cn=Manager,dc=domain,dc=com -y pass -H ldap://ldap.domain.com -b dc=domain,dc=com '(&(objectClass=JammMailAccount)(mail=hfranco@domain.com))'
# extended LDIF
#
# LDAPv3
# base <dc=domain,dc=com> with scope subtree
# filter: (&(objectClass=JammMailAccount)(mail=hfranco@domain.com))
# requesting: ALL
#

# hfranco@domain.com, domain.com, hosting, domain.com
dn: mail=hfranco@domain.com,jvd=domain.com,o=hosting,dc=domain,dc=com
objectClass: JammMailAccount
objectClass: top
mail: hfranco@domain.com
cn: Hank Franco
homeDirectory: /home/domains/domain.com/hfranco
delete: FALSE
lastChange: 1218909596
mailbox: domain.com/hfranco/
userPassword:: e01ENX1zWlQzcEk4M2FNOFV3U3gzK0NqaUtRPT0=
accountActive: TRUE

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1

I'm a bit confused now. You're trying to authenticate a mail alias? Zimbra external LDAP authentication is generally on a per-user basis. Do you want to setup an external GAL instead? — James, Jun 25 '10 at 16:25
@James can you elaborate on GAL a little? I would like to have my users authenticate with LDAP from Zimbra. Right now we're using Squirrelmail with LDAP authentication that I'll like to replace with Zimbra. — hfranco, Jun 25 '10 at 18:58
GAL = global address list, it's Zimbra's address book. Can you post the output of an LDAP search against a user rather than a mail alias - that way it should be easy to see which attributes you need to search on for the Zimbra search filter. — James, Jun 27 '10 at 08:57
Thanks, I've edited my answer - let me know how you get on with that. — James, Jun 28 '10 at 19:39

James · Accepted Answer · 2010-06-28T19:38:33.637

Something like (uid=%u) should work, or given your ldapsearch example, perhaps (&(objectClass=JammMailAlias)(mail=%u@domain.com))

Zimbra replaces the %u with the username that is attempting to authenticate, and then does a search/bind as that user to authenticate.

Edit:

In your setup, you should be able to use (mail=%u@domain.com) as your search filter.

You can test this by running something like ldapsearch -x -D cn=Manager,dc=domain,dc=com -y pass -H ldap://ldap.domain.com -b dc=domain,dc=com '(mail=hfranco@domain.com)' - it should return just the one entry above.

LDAP + Zimbra authentication

1 Answers1