ejabberd - Comments for "mod_shared_roster_ldap - LDAP Shared Roster Management"

roster based on ou

kiki — Tue, 06 Jun 2017 10:11:14 +0000

Hi,

Anybody can explain me how to populate a roster for every user with my user in my OU?

I really don't understand this mod.

Authent is ok, we've set mod_shared_roster_ldap: and mod_roster is already activated.

mod_shared_roster_ldap:
ldap_base: "ou=Internal,ou=Users,dc=xxxxxxx,dc=xxx"
ldap_rfilter: "(&(objectClass=inetOrgPerson)(ou)"
ldap_filter: ""
ldap_userdesc: "displayName"

what did i miss ?

I'm sorry, I'm bumping this.

3coma3 — Tue, 08 Sep 2015 15:01:34 +0000

I'm sorry, I'm bumping this. Has *anyone* got this to work with spaces in CN's and nested groups as containers?

shared_roster_ldap (Active DIrector) all users appear as offline

3coma3 — Fri, 21 Aug 2015 02:07:35 +0000

Hi, please forgive me is this isn't the right place to ask. I've been struggling two days straight to get dynamic shared rosters from Active Directory to work correctly. I msut mention that our DIT is years long and therefore I can't make many big changes, I have to use what is there.

We have two groupings: one for quick overview when managing the tree and for Policy propagation, disposed in coarse OUs. The other one, which is used for the more granular tasks of security mappings in storage, and for mail distribution lists is based on Security and Distribution Groups, of which many are nested. Users and groups that should have mail (and now XMPP) have their mail fields populated with their sAMAccountName@our.domain.com..I have to get the users and groups from the groups, not from the OUs.

My ejabberd authenticates with LDAP to the Active Directory, Vcard information is also pulled from there. These two things are working seamlessly from the start. The non-LDAP shared rosters also worked fine when testing (except for @all@).

The trouble with shared_roster_ldap was that it didn't handle CN's containing spaces, *every* CN here is "FirstName Lastname". Finally solved it by making the module to connect to a local OpenLDAP proxy that maps and rewrites every entry in the member attributes, making another request with the DN and replacing it with the values of sAMAccountNames. In the mapping the attribute itself is renamed to uid. All this is transparent to the module, which sees a member attribute that contains a list of uids with usernames.

Right when the mapping was up, the roster was populated from Active Directory with all users and groups, and the Vcards are correct for every entry.

But the problem is that now I see every user offline, even if they are connected

I don't get it. When I was testing mod_shared_roster, I added sAMAccountName@our.domain.com. and it worked correctly. Now the same is shown in the list but the status isn't updated. When I browse the address with Psi+ It shows it, along with other JIDS that have some kind of ID appended after the domain. I guess this is related to the real problem, but I don't see in what way (or how can I solve it).

Could you please help me to get it finally working?

mod_shared_roster_ldap doesn't work...i guess

ppk — Fri, 02 Jan 2015 13:15:46 +0000

Hello.

I've successfully installed ejabberd from Ubuntu 14.04 repo and configured authentication against Active Directory on Windows Server 2012. My problem is that mod_shared_roster_ldap seems not working properly. It is strange but it doesn't work when mod_shared_roster is down, when I uncommented line with mod_shared_roster users appered on contact list. Every changes that I make in mod_shared_rosted_ldap don't do anything even when I commented mod_shared_roster_ldap with everything that is included in it users (only usernames like for ex. user.name) still appear on roster - is it normal? My goal is to authenticate users against AD and have roster with them, not with usernames but with people names. Any suggestions ?

Re: ufilter is not applied for roster and groupmembers

mikekaganski — Fri, 31 Jan 2014 22:22:31 +0000

Stock mod_shared_roster_ldap still has a weird requirement that the result of ldap_memberattr be the user part of JID.

If the optional parameter ldap_auth_check is on (default), then each ldap_memberattr result is combined with current ejabberd domain to make full JID, and checked for existence (using auth) before processing any further. That's what is happening in your case.

You may try to set ldap_auth_check to off. But this doesn't guarantee success. Some time ago, the code of ufilter did another weird check that ufilter gave the same thing that ldap_memberattr did. I have not looked into the original source code for quite a long time, so maybe there are some fixes that would allow you to succeed, or maybe not.

ufilter is not applied for roster and groupmembers

kriegerse — Mon, 27 Jan 2014 20:55:30 +0000

Hi,

we've setup ejabberd for our team delivered with Ubuntu 12.04 LTS (ejabberd v2.1.10).

Currently we try to created shared rosters based on LDAP for the Team and several projects, but have no success to get the ldap_ufilter applied to the members detected by the gfilter.

Did you have any hint for me what's going wrong there?

Here's a example of the LDAP Structure we use + the ldap and mod_shared_roster_ldap module:

LDAP Structure

### OU with all users ##########################################
dn: ou=users,dc=lnxcim,dc=example,dc=com
objectClass: organizationalUnit
ou: users
description: OU for all Company Users
################################################################
### User Entries example #######################################
dn: uid=x00008,ou=users,dc=lnxcim,dc=example,dc=com
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: posixAccount
objectClass: shadowAccount
objectClass: top
cn: Musterfrau, Petra
gidNumber: 1000
homeDirectory: /home/x00008
sn: Musterfrau
uid: x00008
uidNumber: 10012
givenName: Petra
loginShell: /bin/bash
mail: Petra.Mustermann@example.com
shadowMax: 16111
telephoneNumber: +49 XXXX XXXXXXXX
dn: uid=x00076,ou=users,dc=lnxcim,dc=example,dc=com
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: posixAccount
objectClass: shadowAccount
objectClass: top
cn: Mustermann, Max
gidNumber: 1000
homeDirectory: /home/x00076
sn: Mustermann
uid: x00076
uidNumber: 10065
givenName: Max
loginShell: /bin/bash
mail: Max.Mustermann@example.com
shadowMax: 16382
telephoneNumber: +49 XXXX XXXXXXXX
################################################################
### OU with Jabber Groups ######################################
dn: ou=jabber,ou=services,dc=lnxcim,dc=example,dc=com
objectClass: organizationalUnit
objectClass: top
ou: jabber
################################################################
### Jabber Groups ##############################################
dn: cn=CIM2,ou=jabber,ou=services,dc=lnxcim,dc=example,dc=com
objectClass: extensibleObject
objectClass: posixGroup
objectClass: top
cn: CIM2
gidNumber: 1012
description: Team: CIM2
info: jabbergroup
memberUid: x00008
memberUid: x00076
################################################################

ejabberd configuration

#### may relevant parameters for ldap auth #####################
{auth_method, ldap}.
{ldap_servers, ["localhost"]}.
{ldap_base, "dc=lnxcim,dc=example,dc=com"}.
{ldap_uids, [{"mail", "%u@%d"}]}.
{ldap_filter, "(objectClass=posixAccount)"}.
################################################################
### mod_shared_roster_ldap config ##############################
   {mod_shared_roster_ldap,[
        {ldap_base, "dc=lnxcim,dc=example,dc=com"},
        {ldap_filter, ""},
        {ldap_rfilter, "(&(objectClass=posixGroup)(objectClass=extensibleObject)(info=jabbergroup))"},
        {ldap_groupattr, "cn"},
        {ldap_gfilter, "(&(objectClass=posixGroup)(objectClass=extensibleObject)(info=jabbergroup)(cn=%g))"},
        {ldap_groupdesc, "description"},
        {ldap_memberattr, "memberUid"},
        {ldap_ufilter, "(&(objectClass=inetOrgPerson)(uid=%u))"},
        {ldap_useruid, "uid"},
        {ldap_userdesc, "cn"}
  ]},
################################################################

With this I've got the following output on loglevel 5.

ejabberd log

* find the query for roster filter

=INFO REPORT==== 2014-01-27 21:02:31 ===
D(<0.455.0>:eldap:696) : {searchRequest,
                          {'SearchRequest',"dc=lnxcim,dc=example,dc=com",
                           wholeSubtree,neverDerefAliases,0,5,false,
                           {'and',
                            [{equalityMatch,
                              {'AttributeValueAssertion',"objectClass",
                               "posixGroup"}},
                             {equalityMatch,
                              {'AttributeValueAssertion',"objectClass",
                               "extensibleObject"}},
                             {equalityMatch,
                              {'AttributeValueAssertion',"info",
                               "jabbergroup"}}]},
                           ["cn"]}}

* see the result of the roster filter:

=INFO REPORT==== 2014-01-27 21:02:31 ===
D(<0.455.0>:eldap:767) : {searchResEntry,
                             {'SearchResultEntry',
                                 "cn=CIM2,ou=jabber,ou=services,dc=lnxcim,dc=example,dc=com",
                                 [{'PartialAttributeList_SEQOF',"cn",
                                      ["CIM2"]}]}}
=INFO REPORT==== 2014-01-27 21:02:31 ===
D(<0.455.0>:eldap:767) : {searchResDone,
                             {'LDAPResult',success,[],[],asn1_NOVALUE}}

* find the query of the gfilter:

=INFO REPORT==== 2014-01-27 21:02:31 ===
D(<0.455.0>:eldap:696) : {searchRequest,
                          {'SearchRequest',"dc=lnxcim,dc=example,dc=com",
                           wholeSubtree,neverDerefAliases,0,5,false,
                           {'and',
                            [{equalityMatch,
                              {'AttributeValueAssertion',"objectClass",
                               "posixGroup"}},
                             {equalityMatch,
                              {'AttributeValueAssertion',"objectClass",
                               "extensibleObject"}},
                             {equalityMatch,
                              {'AttributeValueAssertion',"info",
                               "jabbergroup"}},
                             {equalityMatch,
                              {'AttributeValueAssertion',"cn","CIM2"}}]},
                           ["cn","description","memberUid"]}}

* result of gfiler with ldap_memberattr = memberUid

=INFO REPORT==== 2014-01-27 21:02:31 ===
D(<0.455.0>:eldap:767) : {searchResEntry,
                             {'SearchResultEntry',
                                 "cn=CIM,ou=jabber,ou=services,dc=lnxcim,dc=example,dc=com",
                                 [{'PartialAttributeList_SEQOF',"cn",["CIM"]},
                                  {'PartialAttributeList_SEQOF',
                                      "description",
                                      ["Team: CIM"]},
                                  {'PartialAttributeList_SEQOF',"memberUid",
                                      ["x00076","x00008"]}]}}
=INFO REPORT==== 2014-01-27 21:02:31 ===
D(<0.455.0>:eldap:767) : {searchResDone,
                             {'LDAPResult',success,[],[],asn1_NOVALUE}}

* here I guess the ufilter should be applied it doesn't, so we got never a match of memberUid with uid=%u

=INFO REPORT==== 2014-01-27 21:02:31 ===
D(<0.287.0>:eldap:696) : {searchRequest,
                          {'SearchRequest',"dc=lnxcim,dc=example,dc=com",
                           wholeSubtree,neverDerefAliases,0,0,false,
                           {'and',
                            [{equalityMatch,
                              {'AttributeValueAssertion',"mail",
                               "x00076@example.com"}},
                             {equalityMatch,
                              {'AttributeValueAssertion',"objectClass",
                               "posixAccount"}}]},
                           ["mail"]}}

* Result: no match since this is not my ufilter????
* instead it's matched for mail-address created out of the "memberUid"+@+"Domain"

=INFO REPORT==== 2014-01-27 21:02:31 ===
D(<0.287.0>:eldap:767) : {searchResDone,
                             {'LDAPResult',success,[],[],asn1_NOVALUE}}

Did you have any hints or idea why this happens?

How can I get the users data from PosixAccount member within a PosixGroups?

Thank you very much for any help here!
Sebastian

Filtering groups by membership

pafcio00 — Tue, 07 Jan 2014 07:42:19 +0000

Is there a way to filter groups avaliable to the user to only those he is a member of?

If so how it can be done?

Re: more than one ldap server or rootdn in shared roster

devil_inside — Mon, 17 Dec 2012 13:25:05 +0000

mikekaganski wrote:

1. msrl should be able to run successfully with per-vhost configuration. If it does not, it should be considered a bug. But in this case, you get different shared rosters for different vhosts.
2. It is impossible in current msrl. In theory, it is possible to modify it so that it would become possible to get users from different directories, but in this configuration, it would be impossible to keep the overall phylosophy of this module: to get all needed information from LDAP. It would be possible only to show all users from all servers to each other, while there would be no easy way to restrict one's shared roster groups to some subset of groups from server a + some groups from server b + ... So it seems impractical to modify msrl this way.

we did openldap with slapd-meta+slapd-pcache.
it makes visual all ldap servers as one.

Re: ldap timeouts with using msrl

devil_inside — Thu, 06 Dec 2012 05:51:04 +0000

mikekaganski wrote:

devil_inside wrote:

can msrl choice to use poersistent or non-persistent connection?

Not implemented.

devil_inside wrote:

how can i make it to establish new connecton to ldap?

Seems like a patch needed. I cannot promise anything now, but I'll try to look into it; and if I'll do something I'll leave a note here or at EJAB-1480.

i'd tried again.
now, i think, that it is not ldap problem, it strange rate of connections at all.
when at one moment of time some decades of users try to connect to ejabberd, it takes on approximately 15-18 users quickly and much slowly takes on another users with huge delay between acceptions of connetcions.
why?
i did turn off all max_stanza_size and all shapers in config, but problem persist as in beginning.
what setting in ejabberd server makes connection rate?

Re: ldap timeouts with using msrl

devil_inside — Tue, 04 Dec 2012 19:22:52 +0000

mikekaganski wrote:

devil_inside wrote:

can msrl choice to use poersistent or non-persistent connection?

Not implemented.

devil_inside wrote:

how can i make it to establish new connecton to ldap?

Seems like a patch needed. I cannot promise anything now, but I'll try to look into it; and if I'll do something I'll leave a note here or at EJAB-1480.

some interesting(maybe) information:
today i droped ejabberd some times one by once with ~150 connected users.
with msrll or without msrl quick and fine connected was 24 users (may be, 25)
other users had timeoute in endless connections.
i dropped server 5 times (one time i did reject connections to port 5222 before dropping, unload msrl and wait some minutes and then delete fw rules) and quickconnected users was always ~24-25, and after them server goes to timeoutes from ldap.

at last half of test time i did cicle large query (list of all users and attributes) to my ldap server and it answers me always with no delay.

Re: ldap timeouts with using msrl

mikekaganski — Tue, 04 Dec 2012 13:46:37 +0000

devil_inside wrote:

can msrl choice to use poersistent or non-persistent connection?

Not implemented.

devil_inside wrote:

how can i make it to establish new connecton to ldap?

Seems like a patch needed. I cannot promise anything now, but I'll try to look into it; and if I'll do something I'll leave a note here or at EJAB-1480.

ldap timeouts with using msrl

devil_inside — Fri, 30 Nov 2012 11:43:04 +0000

we have ejabberd (2.1.11)+ ldap server (communigate) + mod_shared_roster_ldap + ~2100 users.
sometimes ejabberd makes stop it activity (new users can't connect to it with "connection timeout, early connected and logged on users stays working.)
in logs i see

=ERROR REPORT==== 2012-11-30 12:52:37 ===
E(<0.19874.8>:eldap_pool:81) : LDAP request failed: timed out

=ERROR REPORT==== 2012-11-30 12:52:37 ===
E(<0.19876.8>:eldap_pool:81) : LDAP request failed: timed out

=ERROR REPORT==== 2012-11-30 12:52:37 ===
E(<0.19878.8>:eldap_pool:81) : LDAP request failed: timed out

(huge list of such messages).

where i make stop to mode_shared_roster_ldap, i (next 30 or 90 miinutes!!!) see:

=ERROR REPORT==== 2012-11-30 13:03:27 ===
'mod_shared_roster_ldap_domain.com' crashed: {noproc,
{gen_server,call,
['mod_shared_roster_ldap_domain.com',
{get_user_displayed_groups,
"j.bubueva"},
600000]}}

(huge list of such messages).
after last of these messages(when _all_ examples of running msrl shuted down), ejabberd is working fine.
when i make start msrl by-hand later, it works fine too to next trouble with timeout.

my config of msrl:
{mod_shared_roster_ldap,[
{ldap_user_cache_validity,7200},
{ldap_group_cache_validity,7200},
{ldap_auth_check,off},
{ldap_servers,["10.177.74.3"]},
{ldap_port,389},
{ldap_rootdn,"uid=master,o=domain"},
{ldap_base,"o=domain"},
{ldap_groupattr,"JABBERGROUP"},
{ldap_password,"123"},
{ldap_memberattr,"uid"},
{ldap_rfilter,"(objectclass=CommuniGateAccount)"},
{ldap_filter,"(objectclass=CommuniGateAccount)"},
{ldap_useruid, "uid"},
{ldap_userdesc,"cn"}
]}

i did read a lot of documentation and huge pages of google and (in my current opinion) problem is in method of managing and making connection to ldap server.
seems, i began to think, that msrl uses persistent connection and not all of connection, which it takes, are operational. tuning keepalive timeout on server doesn't solve the problem, our firewall has not set to watch for timeout of connections.

my question:
can msrl choice to use poersistent or non-persistent connection?
how can i make it to establish new connecton to ldap?
or what direction i have to take in my searchs to solve this problem?

Confused. Seems to be working

ghenry — Mon, 23 Jul 2012 23:05:05 +0000

Confused. Seems to be working now. Must have been what you said about a bad roster. Thanks for everything.

I already gave you the

mikekaganski — Mon, 23 Jul 2012 20:50:13 +0000

I already gave you the suggestions. Why should I think you need them this time? Repeating "Use the link to modified version above" sounds annoying and advertising.

Maybe the other clients check

ghenry — Mon, 23 Jul 2012 14:13:00 +0000

Maybe the other clients check this client side but Pidgin doesn't even with a bug in the module.

Suggestions for your fix?