1

Topic: Roundcube global address book LDAP

==== Required information ====
- iRedMail version: 0.9.0
- Store mail accounts in which backend (MySQL):
- Linux/BSD distribution name and version: CentOS 7
====

Hi all,
I'm new iRedMail user. Soon i will migrate my actual postfix mailserver to the newly configured iRedMail, so thanks to the developers for the great work smile

At the beginning i chose to use mysql to manage everything so I setted up Roundcube mail to use plugin globaladdressbook that work fine and store data on mysql db.
Later i changed my mind, and i decided to use Roundcube with LDAP, with the hope not to lose the ability to have an admin account to manage the addressbook and do not let the other normal users to write on it.
I need some help to set up a Global Address Book on Roundcube+LDAP granting rights to write on the Adressbook to an admin account directly on the Roundcube UI.

What I did for the moment is disable globaladdressbook plugin and set up ldap addressbook on /var/www/roundcube/config/default.inc.php.
I followed this guide (http://trac.roundcube.net/wiki/Howto_Config/Ldap) to create the ldap directory customizing the informations i needed (eg my domain, my rcuser password, etc).
Now I have the ldap entry for the addressbook on Roundcube but when i try to write on it, it says it's read-only addressbook.

Below my roundcube mail default.inc.php section for ldap addressbook setup.

Thanks in advance for your help!


$config['ldap_public']['Local'] = array(
  'name'          => 'Local Addresbook',
  'hosts'         => array('ldaps://localhost'),
  'port'          => 636,
  'use_tls'       => true,
  'ldap_version'  => 3,       // using LDAPv3
  'network_timeout' => 10,    // The timeout (in seconds) for connect + bind arrempts. This is only supported in PHP >= 5.3.0 with OpenLDAP 2.x
  'user_specific' => false,   // If true the base_dn, bind_dn and bind_pass default to the user's IMAP login.
  'base_dn'       => 'ou=public,ou=rcabook,dc=mydomain',
  'bind_dn'       => 'cn=rcuser,ou=rcabook,dc=mydomain',
  'bind_pass'     => 'secret',
  'hidden'        => false,
  'searchonly'    => false,
  'writable'       => true,
  'LDAP_Object_Classes' => array('top', 'inetOrgPerson'),
  'LDAP_rdn'       => 'cn',
  'required_fields' => array('cn', 'sn', 'mail'),
  'search_fields'   => array('mail', 'cn'),  // fields to search in
    'fieldmap' => array(
       // Roundcube   => LDAP
    'name'         => 'cn',
    'surname'      => 'sn',
    'firstname'    => 'givenName',
    'jobtitle'     => 'title',
    'email'        => 'mail',
    'phone:home'   => 'homePhone',
    'phone:work'   => 'telephoneNumber',
    'phone:mobile' => 'mobile',
    'street'       => 'street',
    'zipcode'      => 'postalCode',
    'locality'     => 'l',
    'organization' => 'o',
    'notes'        => 'description',
    'photo'        => 'jpegPhoto',
    ),
   'sub_fields' => array(),
   'autovalues' => array(
  ),
  'sort'           => 'cn',         // The field to sort the listing by.
  'scope'          => 'sub',        // search mode: sub|base|list
  'filter'         => '(objectClass=inetOrgPerson)',      // used for basic listing (if not empty) and will be &'d with search queries. example: status=act
  'fuzzy_search'   => true,         // server allows wildcard search
  'vlv'            => false,        // Enable Virtual List View to more efficiently fetch paginated data (if server supports it)
  'vlv_search'     => false,        // Use Virtual List View functions for autocompletion searches (if server supports it)
  'numsub_filter'  => '(objectClass=organizationalUnit)',   // with VLV, we also use numSubOrdinates to query the total number of records. Set this filter to get all numSubOrdinates attributes for counting
  'config_root_dn' => 'cn=config',  // Root DN to search config entries (e.g. vlv indexes)
  'sizelimit'      => '0',          // Enables you to limit the count of entries fetched. Setting this to 0 means no limit.
  'timelimit'      => '0',          // Sets the number of seconds how long is spend on the search. Setting this to 0 means no limit.
  'referrals'      => false,        // Sets the LDAP_OPT_REFERRALS option. Mostly used in multi-domain Active Directory setups
  'dereference'    => 0,            // Sets the LDAP_OPT_DEREF option. One of: LDAP_DEREF_NEVER, LDAP_DEREF_SEARCHING, LDAP_DEREF_FINDING, LDAP_DEREF_ALWAYS
                                    // Used where addressbook contains aliases to objects elsewhere in the LDAP tree.

  'groups'  => array(
    'base_dn'           => '',
    'scope'             => 'sub',       // Search mode: sub|base|list
    'filter'            => '(objectClass=groupOfNames)',
    'object_classes'    => array('top', 'groupOfNames'),   // Object classes to be assigned to new groups
    'member_attr'       => 'member',   // Name of the default member attribute, e.g. uniqueMember
    'name_attr'         => 'cn',       // Attribute to be used as group name
    'email_attr'        => 'mail',     // Group email address attribute (e.g. for mailing lists)
    'member_filter'     => '(objectclass=*)',  // Optional filter to use when querying for group members
    'vlv'               => false,      // Use VLV controls to list groups
    'class_member_attr' => array(      // Mapping of group object class to member attribute used in these objects
      'groupofnames'       => 'member',
      'groupofuniquenames' => 'uniquemember'
    ),
  ),
);

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2

Re: Roundcube global address book LDAP

I found out this on the logs:
mail roundcube: PHP Warning:  ldap_start_tls(): Unable to start TLS: Operations error in /var/www/roundcubemail-1.0.4/program/lib/Roundcube/rcube_ldap_generic.php on line 179

It seems php in roundcube can not establish the tls connection to my openldap...

3

Re: Roundcube global address book LDAP

I solved this issue.
I had to change this section on the default.inc.php of roundcube

  'hosts'         => array('ldaps://localhost'),
  'port'          => 636,
  'use_tls'       => true,

to

  'hosts'         => array('ldaps://localhost'),
  'port'          => 636,
  'use_tls'       => false,

I think it depends on the ldap.conf file since if i tried to connect to hosts array('localhost) and use_tls true i got a tls negotiation issue on slapd log.
I found out that PHP command ldap_start_tls (enabled by 'use_tls' => 'true' ) cause a duplicate tls connection when passed with URI ldaps://localhost, that will break the tls php connection to ldap.

If any of you has a clue how was this possible please let me know thanks!

4

Re: Roundcube global address book LDAP

Let me go back to my primary need now that i can write on the LDAP addressbook.

Is it possible to have the Global LDAP Addressbook read-only for all users and writable for a specific user?

Thank you!

5

Re: Roundcube global address book LDAP

*) Port 389 supports insecure connection, or secure connection with TLS.
*) Port 636 must be SSL, not TLS.

6

Re: Roundcube global address book LDAP

GMF wrote:

Is it possible to have the Global LDAP Addressbook read-only for all users and writable for a specific user?

As far as i know, Roundcube doesn't support this (correct me if i'm wrong).

7

Re: Roundcube global address book LDAP

In this use case scenario, why don't you just use the MySQL globaladdressbook plugin like before? Why does it have to be stored in LDAP?

8

Re: Roundcube global address book LDAP

ZhangHuangbin wrote:

*) Port 389 supports insecure connection, or secure connection with TLS.
*) Port 636 must be SSL, not TLS.

Ok, must be my mistake configuring openldap, i will now take a look to this.
Thanks

9

Re: Roundcube global address book LDAP

7t3chguy wrote:

In this use case scenario, why don't you just use the MySQL globaladdressbook plugin like before? Why does it have to be stored in LDAP?

Because i wanted to use the LDAP to share the addressbook not only for roundcube. If this is not possible i think i will rollback to my previous setup with globaladdressbook.

10

Re: Roundcube global address book LDAP

Nothing I can think of, short than a custom Roundcube plugin

11

Re: Roundcube global address book LDAP

GMF wrote:
ZhangHuangbin wrote:

*) Port 389 supports insecure connection, or secure connection with TLS.
*) Port 636 must be SSL, not TLS.

Ok, must be my mistake configuring openldap, i will now take a look to this.
Thanks

I fixed this. in /etc/sysconfig/slapd i was starting only ldaps:/// instead of ldap:///
Now everything works with tls on port 389. Thank you!