I too struggled with

dsalzedo — Fri, 02 Nov 2012 01:43:10 +0000

I too struggled with mod_shared_roster_ldap for a long time. What I have found works best for me is to filter the users by a single standard LDAP parameter. This parameter will be displayed in the XMPP client as the name of the group.

I use Windows Active Directory as my LDAP source, the sAMAccountName as the UID and make sure all users have the physicalDeliveryOfficeName attribute filled out. (If they don't they won't be displayed in the roster at all) I use the following module config:

{mod_shared_roster_ldap,[
{ldap_filter, "(objectClass=user)"},
{ldap_rfilter, "(objectClass=user)"},
{ldap_groupattr, "physicalDeliveryOfficeName"},
{ldap_groupdesc, "physicalDeliveryOfficeName"},
{ldap_memberattr, "sAMAccountName"},
{ldap_userdesc, "displayName"}
]}

Your groups and your users

mikekaganski — Fri, 19 Oct 2012 03:40:46 +0000

Your groups and your users seem to only relate by gidNumber attribute. So you cannot get the group names for your groups from LDAP group objects using mod_shared_roster_ldap (this is its functional limitation; it's something that needs to be fixed, maybe as a part of EJAB-1480).

You seem to have tried many variants of configuration, and even invented your own configuration parameters :) Your configuration (at least the possible one) should look like this:

{mod_shared_roster_ldap,[
 %1. Disable useless defaults
 {ldap_filter, ""},
 %2. Prepare the list of group identifiers
 {ldap_rfilter, "(objectClass=posixGroup)"},
 %3. Which attribute of the returned objects represent the identifiers
 {ldap_groupattr, "gidNumber"},
 %4. Now we have the list of all oug group ids (in this case, gidNumbers). Now we need to ask each group individually for its name and its member ids. Unfortunately, there's only one query that must give us both these pieces of info, thus the limitation mentioned above. As a workaround, we will use the departmentNumber as the group name. So, our query will be used only to give us users:
 {ldap_gfilter,"(&(objectClass=posixAccount)(gidNumber=%g))"},
 %5. Where is the group name? The query above will give us multiple user objects, and each will hold the attribute. We need only one name. In this case, the module will just take the value of a last object. You cannot pass an arbitrary string here; it MUST be an attribute name.
 {ldap_groupdesc, "departmentNumber"},
 %6. Where is the member users ids. Note that this MUST be the uid part of jid, so it MUST NOT contain spaces It should be the same as you use for auth.
 {ldap_memberattr, "uid"},
 %7. Now we have list of groups, each has its name and its users ids list. Now we will ask each user for its display name.
 {ldap_ufilter,"(&(objectClass=posixAccount)(uid=%u))"},
 %8. Where is user display name
 {ldap_userdesc,"cn"},
 {ldap_auth_check,"off"},
 {ldap_user_cache_validity, "10"},
 {ldap_group_cache_validity, "10"}
]}

ejabberd - Comments for "mod_shared_roster_ldap"

I too struggled with

Your groups and your users