1 (edited by i.zakaria 2014-12-30 02:33:42)

Topic: LDAP ISSUE Intergrating Microsoft Active directory to iredmail

======== Required information ====
- iRedMail version: 2.11.0 (postconf -n mail_version)
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): LDAP
- Linux/BSD distribution name and version: Ubuntu 14.04
- Related log if you're reporting an issue: please to find the log bellow
====

Hello Iredmail Team

     it is a pleasure to format my old server (ubuntu "postfix dovecot mysql rc ) and try to use your solution Iredmail server to be able to configure  my authentification through LDAP on Active directory (Microsoft windows server 2012r2) ( targeting to integrate  the SSO over the company) (tutorial that i ve  used is ==> http://www.iredmail.org/docs/active.directory.html)

      at first look at "ldapsearch" things seems to be fine (view attached)
   
     but when i try to test postfix by using postmap -q ....ldap://ad_virt....cf
i ve no results . or i get this erro (dict_ldap_connect...error 10 referral)

     i ve tried to copy  .cf file configurations  with the results of postmap -v - q for each one of theme in text files attached ... please to help me debuging and resolve my issue as soon as possible .


   sorry for my poor englsih

Best Regards
zak

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2

Re: LDAP ISSUE Intergrating Microsoft Active directory to iredmail

You're using ldap filter "(&(objectClass=person)(sAMAccontName=%s))" in ad_virtual_mailbox_maps.cf and ad_virtual_group_maps.cf, but you don't have any account which has 'sAMAccontName=vmail' in your ldapsearch result. so it returns nothing. this is expected.

Make sure you're searching an existing account with ldap attribute/value pairs specified in your LDAP filter.

3

Re: LDAP ISSUE Intergrating Microsoft Active directory to iredmail

By the way, please paste log in post as text directly, not as attachment. It's easier to read and check/compare.

4

Re: LDAP ISSUE Intergrating Microsoft Active directory to iredmail

Hello M Zhanghuangbin
thank you very mutch for your replay ..

i ll try to ger vmail and created account in ldapcash ... because they don't appear ! and then i ll let you know about .

Regards

5 (edited by i.zakaria 2014-12-30 20:12:21)

Re: LDAP ISSUE Intergrating Microsoft Active directory to iredmail

config :
server_host    = SERVEURAD.domaine.net
server_port    = 389
version        = 3
bind           = yes
start_tls      = no
bind_dn        = vmail
bind_pw        = *******
search_base    = cn=users,dc=domaine,dc=net
scope          = sub
query_filter   = (&(objectClass=person)(userPrincipalName=%s))
result_attribute= userPrincipalname
result_format  = %d/%u/Maildir/
debuglevel     = 0




================still get this error bellow ======================

root@smail:~# postmap -q vmail@um6ss.ma ldap:/etc/postfix/ad_virtual_mailbox_maps.cf
postmap: warning: dict_ldap_lookup: Search error 10: Referral
postmap: fatal: table ldap:/etc/postfix/ad_virtual_mailbox_maps.cf: query error: Success

===============debuglevel 1  result==========================

root@smail:~# postmap -q vmail@domaine.net ldap:/etc/postfix/ad_virtual_mailbox_maps.cf
postmap: dict_ldap_debug: ldap_create
postmap: dict_ldap_debug: ldap_url_parse_ext(ldap://SERVEURAD.domaine.net:xxx)
postmap: dict_ldap_debug: ldap_sasl_bind
postmap: dict_ldap_debug: ldap_send_initial_request
postmap: dict_ldap_debug: ldap_new_connection 1 1 0
postmap: dict_ldap_debug: ldap_int_open_connection
postmap: dict_ldap_debug: ldap_connect_to_host: TCP SERVEURAD.domaine.net:xxx
postmap: dict_ldap_debug: ldap_new_socket: 4
postmap: dict_ldap_debug: ldap_prepare_socket: 4
postmap: dict_ldap_debug: ldap_connect_to_host: Trying 172.25.50.3:xxx
postmap: dict_ldap_debug: ldap_pvt_connect: fd: 4 tm: 10 async: 0
postmap: dict_ldap_debug: ldap_ndelay_on: 4
postmap: dict_ldap_debug: ldap_int_poll: fd: 4 tm: 10
postmap: dict_ldap_debug: ldap_is_sock_ready: 4
postmap: dict_ldap_debug: ldap_ndelay_off: 4
postmap: dict_ldap_debug: ldap_pvt_connect: 0
postmap: dict_ldap_debug: ldap_open_defconn: successful
postmap: dict_ldap_debug: ldap_send_server_request
postmap: dict_ldap_debug: ber_scanf fmt ({it) ber:
postmap: dict_ldap_debug: ber_scanf fmt ({i) ber:
postmap: dict_ldap_debug: ber_flush2: 29 bytes to sd 4
postmap: dict_ldap_debug: ldap_result ld 0x7f2ff896d010 msgid 1
postmap: dict_ldap_debug: wait4msg ld 0x7f2ff896d010 msgid 1 (timeout 10000000 usec)
postmap: dict_ldap_debug: wait4msg continue ld 0x7f2ff896d010 msgid 1 all 1
postmap: dict_ldap_debug: ** ld 0x7f2ff896d010 Connections:
postmap: dict_ldap_debug: * host: SERVEURAD.domaine.net  port: xxx  (default)
postmap: dict_ldap_debug:   refcnt: 2  status: Connected
postmap: dict_ldap_debug:   last used: Tue Dec 30 11:48:44 2014
postmap: dict_ldap_debug:
postmap: dict_ldap_debug: ** ld 0x7f2ff896d010 Outstanding Requests:
postmap: dict_ldap_debug:  * msgid 1,  origid 1, status InProgress
postmap: dict_ldap_debug:    outstanding referrals 0, parent count 0
postmap: dict_ldap_debug:   ld 0x7f2ff896d010 request count 1 (abandoned 0)
postmap: dict_ldap_debug: ** ld 0x7f2ff896d010 Response Queue:
postmap: dict_ldap_debug:    Empty
postmap: dict_ldap_debug:   ld 0x7f2ff896d010 response count 0
postmap: dict_ldap_debug: ldap_chkResponseList ld 0x7f2ff896d010 msgid 1 all 1
postmap: dict_ldap_debug: ldap_chkResponseList returns ld 0x7f2ff896d010 NULL
postmap: dict_ldap_debug: ldap_int_select
postmap: dict_ldap_debug: read1msg: ld 0x7f2ff896d010 msgid 1 all 1
postmap: dict_ldap_debug: ber_get_next
postmap: dict_ldap_debug: ber_get_next: tag 0x30 len 16 contents:
postmap: dict_ldap_debug: read1msg: ld 0x7f2ff896d010 msgid 1 message type bind
postmap: dict_ldap_debug: ber_scanf fmt ({eAA) ber:
postmap: dict_ldap_debug: read1msg: ld 0x7f2ff896d010 0 new referrals
postmap: dict_ldap_debug: read1msg:  mark request completed, ld 0x7f2ff896d010 msgid 1
postmap: dict_ldap_debug: request done: ld 0x7f2ff896d010 msgid 1
postmap: dict_ldap_debug: res_errno: 0, res_error: <>, res_matched: <>
postmap: dict_ldap_debug: ldap_free_request (origid 1, msgid 1)
postmap: dict_ldap_debug: ldap_parse_result
postmap: dict_ldap_debug: ber_scanf fmt ({iAA) ber:
postmap: dict_ldap_debug: ber_scanf fmt (}) ber:
postmap: dict_ldap_debug: ldap_msgfree
postmap: dict_ldap_debug: ldap_search_ext
postmap: dict_ldap_debug: put_filter: "(&(objectClass=person)(userPrincipalName=vmail@domaine.net))"
postmap: dict_ldap_debug: put_filter: AND
postmap: dict_ldap_debug: put_filter_list "(objectClass=person)(userPrincipalName=vmail@domaine.net )"
postmap: dict_ldap_debug: put_filter: "(objectClass=person)"
postmap: dict_ldap_debug: put_filter: simple
postmap: dict_ldap_debug: put_simple_filter: "objectClass=person"
postmap: dict_ldap_debug: put_filter: "(userPrincipalName=vmail@doamine.net)"
postmap: dict_ldap_debug: put_filter: simple
postmap: dict_ldap_debug: put_simple_filter: "userPrincipalName=vmail@domaine.net"
postmap: dict_ldap_debug: ldap_send_initial_request
postmap: dict_ldap_debug: ldap_send_server_request
postmap: dict_ldap_debug: ber_scanf fmt ({it) ber:
postmap: dict_ldap_debug: ber_scanf fmt ({) ber:
postmap: dict_ldap_debug: ber_flush2: 132 bytes to sd 4
postmap: dict_ldap_debug: ldap_result ld 0x7f2ff896d010 msgid 2
postmap: dict_ldap_debug: wait4msg ld 0x7f2ff896d010 msgid 2 (timeout 10000000 usec)
postmap: dict_ldap_debug: wait4msg continue ld 0x7f2ff896d010 msgid 2 all 1
postmap: dict_ldap_debug: ** ld 0x7f2ff896d010 Connections:
postmap: dict_ldap_debug: * host: SERVEURAD.domaine.net  port: xxx  (default)
postmap: dict_ldap_debug:   refcnt: 2  status: Connected
postmap: dict_ldap_debug:   last used: Tue Dec 30 11:48:44 2014
postmap: dict_ldap_debug:
postmap: dict_ldap_debug: ** ld 0x7f2ff896d010 Outstanding Requests:
postmap: dict_ldap_debug:  * msgid 2,  origid 2, status InProgress
postmap: dict_ldap_debug:    outstanding referrals 0, parent count 0
postmap: dict_ldap_debug:   ld 0x7f2ff896d010 request count 1 (abandoned 0)
postmap: dict_ldap_debug: ** ld 0x7f2ff896d010 Response Queue:
postmap: dict_ldap_debug:    Empty
postmap: dict_ldap_debug:   ld 0x7f2ff896d010 response count 0
postmap: dict_ldap_debug: ldap_chkResponseList ld 0x7f2ff896d010 msgid 2 all 1
postmap: dict_ldap_debug: ldap_chkResponseList returns ld 0x7f2ff896d010 NULL
postmap: dict_ldap_debug: ldap_int_select
postmap: dict_ldap_debug: read1msg: ld 0x7f2ff896d010 msgid 2 all 1
postmap: dict_ldap_debug: ber_get_next
postmap: dict_ldap_debug: ber_get_next: tag 0x30 len 143 contents:
postmap: dict_ldap_debug: read1msg: ld 0x7f2ff896d010 msgid 2 message type search-result
postmap: dict_ldap_debug: ber_scanf fmt ({eAA) ber:
postmap: dict_ldap_debug: read1msg: ld 0x7f2ff896d010 0 new referrals
postmap: dict_ldap_debug: read1msg:  mark request completed, ld 0x7f2ff896d010 msgid 2
postmap: dict_ldap_debug: request done: ld 0x7f2ff896d010 msgid 2
postmap: dict_ldap_debug: res_errno: 10, res_error: <0000202B: RefErr: DSID-0310082F, data 0, 1 access points??ref 1: 'domaine.net'?>, res_matched: <>
postmap: dict_ldap_debug: ldap_free_request (origid 2, msgid 2)
postmap: dict_ldap_debug: ldap_parse_result
postmap: dict_ldap_debug: ber_scanf fmt ({iAA) ber:
postmap: dict_ldap_debug: ber_scanf fmt (v) ber:
postmap: dict_ldap_debug: ber_scanf fmt (}) ber:
postmap: dict_ldap_debug: ldap_err2string
postmap: warning: dict_ldap_lookup: Search error 10: Referral
postmap: dict_ldap_debug: ldap_free_connection 1 1
postmap: dict_ldap_debug: ldap_send_unbind
postmap: dict_ldap_debug: ber_flush2: 7 bytes to sd 4
postmap: dict_ldap_debug: ldap_free_connection: actually freed
postmap: dict_ldap_debug: ldap_msgfree
postmap: fatal: table ldap:/etc/postfix/ad_virtual_mailbox_maps.cf: query error: Success

============the account  vmail exist in ldapsearch ===============

# vmail vmail, Users, domaine.net
dn: CN=vmail vmail,CN=Users,DC=domaine,DC=net
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
cn: vmail vmail
sn: vmail
givenName: vmail
distinguishedName: CN=vmail vmail,CN=Users,DC=domaine,DC=net
instanceType: 4
whenCreated: 20141225111508.0Z
whenChanged: 20141230095803.0Z
displayName: vmail
uSNCreated: 29673
memberOf: CN=Administrateurs,CN=Builtin,DC=domaine,DC=net
uSNChanged: 32933
name: vmail vmail
objectGUID:: TXgWCkMHpEqyamE9uFeFDQ==
userAccountControl: 66048
badPwdCount: 0
codePage: 0
countryCode: 0
badPasswordTime: 130644063807298743
lastLogoff: 0
lastLogon: 130644063977028034
pwdLastSet: 13063979454598091
primaryGroupID: 513
userParameters:: bTogICAgICAgICAgICAgICAgICAgIGQBICAgICAgICAgICAgICAgICAgICAgI
CAg
objectSid:: AQUAAAAAAAUVAAAA34k6kpUwbW6uzm2pXQQAAA==
adminCount: 1
accountExpires: 9223372036854775807
logonCount: 15
sAMAccountName: vmail
sAMAccountType: 805306368
userPrincipalName: vmail@domaine.net
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=domaine,DC=net
dSCorePropagationData: 20141230095803.0Z
dSCorePropagationData: 20141229131228.0Z
dSCorePropagationData: 20141229122740.0Z
dSCorePropagationData: 20141225112301.0Z
dSCorePropagationData: 16010101000000.0Z
lastLogonTimestamp: 130639812982395941
msDS-SupportedEncryptionTypes: 0
mail: vmail@domaine.net
======================================================
using  ad_sender_maps & ad_virtual_group_maps , i think every thing looks ok by getting the correct results
=======================================================
Regards

6

Re: LDAP ISSUE Intergrating Microsoft Active directory to iredmail

Does adding 'chase_referrals = 1' in ldap query files solve your issue?

i.zakaria wrote:

sAMAccountName: vmail
userPrincipalName: vmail@domaine.net
mail: vmail@domaine.net

You have 'userPrincipalName' and 'mail' attributes with full email address as value, i wonder why you don't use these two attributes instead?

Is it possible to follow our tutorial strictly and try again? Use the same ldap filter in our tutorial.

7 (edited by i.zakaria 2014-12-31 00:43:14)

Re: LDAP ISSUE Intergrating Microsoft Active directory to iredmail

HELLO 

now every thing seems to be ok ..with posfix !

Dovecot test is fine

login into roundcube is fine

but it doesn't run "https://server/mail" when i try to set LDAP address book setting by changing default :

default is  :

'bind_dn'   => 'mail=%u@%d,ou=Users,domainName=%d,o=domains,dc=domaine,dc=net',

tutorial conf: 

    'bind_dn'       => "vmail",                     
    'bind_pass'     => "password_of_vmail",


wish to be the first (iRedmail,Ubuntu14.04,Microsoft Windows2012 AD )... shared expérience 

Regards

8

Re: LDAP ISSUE Intergrating Microsoft Active directory to iredmail

Am i right that everything is working as expected for you now?

Thanks for sharing.

9

Re: LDAP ISSUE Intergrating Microsoft Active directory to iredmail

Still sturving with roundcube ! to bind and get auto complete adress book !

10

Re: LDAP ISSUE Intergrating Microsoft Active directory to iredmail

Make sure you have correct bind dn/password, base dn, and query filter. Do some tests with ldapsearch first.

11

Re: LDAP ISSUE Intergrating Microsoft Active directory to iredmail

Hello ZhangHuangbin   

first of all : i wish you happy new year with my best wishes of good been !

next :  i ve tried ldapseach every thing works fine even sending recieving mails using ldap authentification ,

what does not work is configuring the auto complete adress book ;  when i use the tutorial's bind instructions , roundcube is down !
and when i keep the default bind 'mail=%u@%d,ou=Users,domainName=%d,o=domains,dc=domaine,dc=net', it works fine but i can"t get the adressbook and it says that it can't find domain.net even if i can ping it  and make ldapseach over it .

wish 2015 comes with solutions big_smile

have a good day and thank you for your awsome support

12

Re: LDAP ISSUE Intergrating Microsoft Active directory to iredmail

i.zakaria wrote:

first of all : i wish you happy new year with my best wishes of good been !

The same to you. smile

i.zakaria wrote:

what does not work is configuring the auto complete adress book ;  when i use the tutorial's bind instructions , roundcube is down !

What do you mean "down"?
No one can help without related log, so please try to get related log, especially error log, paste here so that others can help troubleshoot.

13

Re: LDAP ISSUE Intergrating Microsoft Active directory to iredmail

roundcube: PHP Error: Addressbook source (example.com) not found! in /usr/share/apache2/roundcubemail-1.0.1/program/include/rcmail.php on line 248 (POST /mail/?_task=mail&_action=autocomplete?_task=&_action=)




/usr/share/apache2/roundcubemail-1.0.1/program/include/rcmail.php :

    /**
     * Return instance of the internal address book class
     *
     * @param string  Address book identifier (-1 for default addressbook)
     * @param boolean True if the address book needs to be writeable
     *
     * @return rcube_contacts Address book object
     */
    public function get_address_book($id, $writeable = false)
    {
        $contacts    = null;
        $ldap_config = (array)$this->config->get('ldap_public');

        // 'sql' is the alias for '0' used by autocomplete
        if ($id == 'sql')
            $id = '0';
        else if ($id == -1) {
            $id = $this->config->get('default_addressbook');
            $default = true;
        }

        // use existing instance
        if (isset($this->address_books[$id]) && ($this->address_books[$id] instanceof rcube_addressbook)) {
            $contacts = $this->address_books[$id];
        }
        else if ($id && $ldap_config[$id]) {
            $domain   = $this->config->mail_domain($_SESSION['storage_host']);
            $contacts = new rcube_ldap($ldap_config[$id], $this->config->get('ldap_debug'), $domain);
        }
        else if ($id === '0') {
            $contacts = new rcube_contacts($this->db, $this->get_user_id());
        }
        else {
            $plugin = $this->plugins->exec_hook('addressbook_get', array('id' => $id, 'writeable' => $writeable));

            // plugin returned instance of a rcube_addressbook
            if ($plugin['instance'] instanceof rcube_addressbook) {
                $contacts = $plugin['instance'];
            }
        }

        // when user requested default writeable addressbook
        // we need to check if default is writeable, if not we
        // will return first writeable book (if any exist)
        if ($contacts && $default && $contacts->readonly && $writeable) {
            $contacts = null;
        }

        // Get first addressbook from the list if configured default doesn't exist
        // This can happen when user deleted the addressbook (e.g. Kolab folder)
        if (!$contacts && (!$id || $default)) {
            $source = reset($this->get_address_sources($writeable, !$default));
            if (!empty($source)) {
                $contacts = $this->get_address_book($source['id']);
                if ($contacts) {
                    $id = $source['id'];
                }
            }
        }

        if (!$contacts) {
            // there's no default, just return
            if ($default) {
                return null;
            }

            self::raise_error(array(
                    'code'    => 700,
                    'file'    => __FILE__,
                    'line'    => __LINE__,
line 248==>                    'message' => "Addressbook source ($id) not found!"
                ),
                true, true);
        }

14

Re: LDAP ISSUE Intergrating Microsoft Active directory to iredmail

i.zakaria wrote:

roundcube: PHP Error: Addressbook source (example.com) not found!

It means there's something wrong in Roundcube config file, not its source code. So please double check your config file again. Do some tests on command line if necessary.

15

Re: LDAP ISSUE Intergrating Microsoft Active directory to iredmail

my conf file looks like yours , he can't get adressbook ... is there a solution to know my adressbook name on AD ?

16

Re: LDAP ISSUE Intergrating Microsoft Active directory to iredmail

You have to verify the ldap settings of address book in Roundcube. Does it return any result if you query AD with the same bind dn/password, account filter, base dn, and search scope?

17

Re: LDAP ISSUE Intergrating Microsoft Active directory to iredmail

ZhangHuangbin wrote:

You have to verify the ldap settings of address book in Roundcube. Does it return any result if you query AD with the same bind dn/password, account filter, base dn, and search scope?


it's okey now evry thing is working as expected .. but may be you must change some stuffs in the TUTORIAL .
if you use this ==>
$config['ldap_public']["global_ldap_abook"] = array(
    'name'          => 'Global LDAP Address Book',
    'hosts'         => array("ad.example.com"),      // <- Set AD hostname or IP address here.
    'port'          => 389,...
   .
   .
   .
then you must change example.com ===>


$config['autocomplete_addressbooks'] = array("sql", "global_ldap_abook");

and i don't know why you still use sql to autocomplete



THANKS FOR YOU ASSISTANCE ... see you soon , now i all sturv with sucurity and ssl , lDAPS ....

18

Re: LDAP ISSUE Intergrating Microsoft Active directory to iredmail

i.zakaria wrote:

and i don't know why you still use sql to autocomplete

sql is user's personal address book.