LDAP configuration for multiple contexts

[gryffus]

Hello,

I am fairly new to OX, so i hope i got all the concepts right. Context is a domain, right?

We have following LDAP setup:

User DN looks like this: mail=<UID>@<domain>,ou=Users,domainName=<domain>,o =domains,dc=<dc>,dc=<dc>,dc=<dc>
There are multiple domains in the tree, for example: domainName=<domain>,o=domains,dc=<dc>,dc=<dc>,dc=< dc>

Setup is different from the examples i have found, because we have multiple domains (contexts?) on one LDAP server and we would like to use them. The user entry does not have a domain attribute, the domain is just in his DN.

Is it possible to connect OX to this LDAP scheme to be able to:

1) Authenticate users via LDAP bind
2) Populate contexts (domains) from LDAP
3) Use users contact data fom LDAP

With all my tries (mainly following https://documentation.open-xchange.c...iguration.html) , OX still tries to do an anonymous bind, which is disabled on our LDAP servers. However i failed to identify for which part the anonymous binds are tried.

I am especially confused between "new" and "old" configuration style (usage of ldapauth.properties vs ldap-client-config.yml vs ldaphostname.properties - which one is used for which part of the system? ).

Can anyone please explain me basic working with OX LDAP integration and answer my questions?

Thank you very much!

[gryffus]

For list of domains, we can use following LDAP parameters and filter:

ldapsearch -b "dc=<dn>,dc=<dn>,dc=<dn>" -D "cn=<dn>,dc=<dn>,dc=<dn>,dc=<dn>" -W "(&(objectClass=mailDomain))"
ldapsearch -b "dc=<dn>,dc=<dn>,dc=<dn>" -D "cn=<dn>,dc=<dn>,dc=<dn>,dc=<dn>" -W "(&(objectClass=mailUser))"

[gryffus]

If you want to help me / need more details, just ask, or you can get in touch with me @ Libera IRC, #open-xchange channel. Thanks for any hint!

[gryffus]

BUMP please

[Marcus Klein]

I checked the code of the LDAP authentication plugin. This plugin does not take care about different contexts. The context part of the login information is just not used at all. Therefore it is not possible to authenticate multiple contexts with this plugin.

Furthermore, it will not be possible to automatically provision contexts and users with this plugin.

Nowadays, web based SSO solutions are preferred instead of LDAP authentication. We do not even use LDAP authentication internally anymore. Everything moves to web based SSO.

Using contact data from LDAP is possible. This is even well documented: https://documentation.open-xchange.c...ider_ldap.html