ejabberd - Comments for "Another mod_shared_roster_ldap"

Hi Mike I send the Details

Krishna_vernalis — Fri, 08 Feb 2013 12:39:41 +0000

Hi Mike

I send the Details in Mail ....Please check

**********
Also, please provide the client-server xmpp conversation regarding roster retrieval. You may need to use a client xmpp console (Miranda IM and pidgin have it).
*************

you mean asking client side Log file in above line.

Regards
Krishna

Very strange. I have hoped to

mikekaganski — Fri, 08 Feb 2013 08:11:21 +0000

Very strange. I have hoped to find an error there - say, a missing letter. Everything looks OK.
Well then, you say that if you comment out the "ldap_filter" string, it works, but returns triple copies of every account. Could you post here a part of logs where the ldap queries are being made? As the log may be lengthy, you may wish to send it to me to mikekaganski@hotmail.com (or put it to a web share and post the link here, but note that this forum may put a message with URLs to moderation). Don't forget to purge sensitive info from there.

Also, please provide the client-server xmpp conversation regarding roster retrieval. You may need to use a client xmpp console (Miranda IM and pidgin have it).

Hi Below mentioned my config

Krishna_vernalis — Thu, 07 Feb 2013 12:35:54 +0000

Below mentioned my config Details...

{mod_shared_roster_ldap, [
{ldap_servers, ["Server IP ADDRESS"]},
{ldap_base, "DC=Domain,DC=com"},
{ldap_rootdn, "CN=Username,CN=Users,DC=Domain,DC=com"},
{ldap_password, "password"},
{ldap_filter, ""},

{ldap_rfilter, "(objectClass=user)"},
{ldap_groupattr, "physicalDeliveryOfficeName"},

{ldap_gfilter, "(&(objectClass=user)(physicalDeliveryOfficeName=%g))"},
{ldap_groupdesc, "department"},
{ldap_memberattr, "sAMAccountName"},

{ldap_ufilter, "(&(objectClass=user)(sAMAccountName=%u))"},
{ldap_useruid, "sAMAccountName"},
{ldap_userdesc, "displayName"}
]},

Also i am having Users in AD below manner

OU=Chennai_Users - > contain chennai Users
OU=Pune_Users - > Contain Pune Users
OU=NYC_Users - > Contain NYC Users

Also Help me to sort Users in Group

Thanks Again

Regards
Krishna

No, I would like you to copy

mikekaganski — Thu, 07 Feb 2013 07:12:41 +0000

No, I would like you to copy your mod_shared_roster_ldap config here, please use copy/paste, not retyping, just don't forget to remove sensitive data. I suspect some typo in it.

Hi mike, I am using

Krishna_vernalis — Thu, 07 Feb 2013 07:00:53 +0000

Hi mike,

I am using mod_shared_roster_ldap which is included in Ejabberd 2.1.9 package.

you want me to try with some other package?

Thanks
Krishna

Which module (and which

mikekaganski — Wed, 06 Feb 2013 21:10:23 +0000

Which module (and which module version) do you use?
I mean, there are a original module from http://www.ejabberd.im/mod_shared_roster_ldap, improved module by porridge from https://alioth.debian.org/projects/ejabberd-msrl/, bundled version since 2.1.6 that was prepared by porridge, and an unofficial patch from https://support.process-one.net/browse/EJAB-1480. As you use ejabberd 2.1.9, it seems sensible that you should be using the bundled version, but the error seems to indicate a very old module, so maybe you have replaced the bundled version?

Hi mikekagansk, Thank you so

Krishna_vernalis — Wed, 06 Feb 2013 14:58:53 +0000

Hi mikekagansk,

Thank you so much for your help.

I am getting error while using above config.But after remove the Line *****{ldap_filter, ""},***** no errors in Log file .

Now i am getting single contacts more than 3 times in pidgin.I don't know why..
Any help...sorry

Log report while running above config for your reference
***********************************************************
=INFO REPORT==== 2013-02-06 20:04:02 ===
I(<0.274.0>:eldap:983) : LDAP connection on 10.199.50.2:389

=INFO REPORT==== 2013-02-06 20:04:02 ===
I(<0.289.0>:eldap:983) : LDAP connection on 10.199.50.2:389

=INFO REPORT==== 2013-02-06 20:04:02 ===
I(<0.36.0>:ejabberd_app:202) : Adding machine's DNS IPs to Erlang system:
[]

=ERROR REPORT==== 2013-02-06 20:04:03 ===
E(<0.358.0>:eldap_utils:165) : failed to parse LDAP filter:
** Filter: []
** Reason: {error,["syntax error before: ",[]]}

=INFO REPORT==== 2013-02-06 20:04:03 ===
I(<0.363.0>:eldap:983) : LDAP connection on 10.199.50.2:389

=INFO REPORT==== 2013-02-06 20:04:03 ===
I(<0.384.0>:ejabberd_listener:166) : Reusing listening port for 5222

=INFO REPORT==== 2013-02-06 20:04:03 ===
I(<0.385.0>:ejabberd_listener:166) : Reusing listening port for 5269

=INFO REPORT==== 2013-02-06 20:04:03 ===
I(<0.386.0>:ejabberd_listener:166) : Reusing listening port for 5280

=INFO REPORT==== 2013-02-06 20:04:03 ===
I(<0.36.0>:ejabberd_app:72) : ejabberd 2.1.9 is started in the node ejabberd@chd1veritas

=INFO REPORT==== 2013-02-06 20:05:39 ===
I(<0.384.0>:ejabberd_listener:281) : (#Port<0.441>) Accepted connection {{10,199,50,65},2780} -> {{10,199,50,65},5222}

=INFO REPORT==== 2013-02-06 20:05:39 ===
I(<0.391.0>:ejabberd_c2s:631) : ({socket_state,tls,{tlssock,#Port<0.441>,#Port<0.451>},<0.390.0>}) Accepted authentication for mohan.rasappan by ejabberd_auth_ldap

=INFO REPORT==== 2013-02-06 20:05:40 ===
I(<0.391.0>:ejabberd_c2s:938) : ({socket_state,tls,{tlssock,#Port<0.441>,#Port<0.451>},<0.390.0>}) Opened session for mohan.rasappan@vernalis.com/2404637558136016134091002

=INFO REPORT==== 2013-02-06 20:05:40 ===
I(<0.391.0>:ejabberd_s2s:369) : New s2s connection started <0.392.0>

{mod_shared_roster_ldap, [

mikekaganski — Mon, 04 Feb 2013 11:53:21 +0000

{mod_shared_roster_ldap, [
{ldap_servers, ["dc.domain.tld"]},
{ldap_base, "ou=location,ou=companyname,dc=domain,dc=tld"},
{ldap_rootdn, "cn=username,cn=Users,dc=domain,dc=tld"},
{ldap_password, "SuperSecret"},
{ldap_filter, ""},

{ldap_rfilter, "(objectClass=user)"},
{ldap_groupattr, "physicalDeliveryOfficeName"},

{ldap_gfilter, "(&(objectClass=user)(physicalDeliveryOfficeName=%g))"},
{ldap_groupdesc, "department"},
{ldap_memberattr, "sAMAccountName"},

{ldap_ufilter, "(&(objectClass=user)(sAMAccountName=%u))"},
{ldap_useruid, "sAMAccountName"},
{ldap_userdesc, "displayName"}
]}

Hi, can you give some more

Krishna_vernalis — Mon, 04 Feb 2013 06:15:27 +0000

Hi,

can you give some more explain about ldap_rfilter please...

My User LDAP Config Details

objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
cn: Ezhumalai Desingu
sn: Desingu
description: 17185
physicalDeliveryOfficeName: Chennai
telephoneNumber: 4506
givenName: Ezhumalai
initials: D
distinguishedName: CN=Ezhumalai Desingu,OU=Chennai_Users,DC=testing,DC=com
displayName: Ezhumalai Desingu
wWWHomePage: home.testing.co.in
name: Ezhumalai Desingu
codePage: 0
countryCode: 0
primaryGroupID: 513
sAMAccountName: desinez
sAMAccountType: < samUserAccount >
userPrincipalName: desinez@testing.com
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=testing,DC=com
mail: ezhumalai.desingu@vernal.is
objectGUID: {F92291F3-FA56-445B-B4FF-519734687741}
objectSid: S-1-5-21-1699561171-4188548150-740795862-4482

Regards
Krishna

Your config cannot be

mikekaganski — Sat, 02 Feb 2013 12:33:00 +0000

Your config cannot be used.
You haven't specified ldap_rfilter, which is required.

Hi, Thank you so Much. Is

Krishna_vernalis — Fri, 01 Feb 2013 08:39:07 +0000

Hi,

Thank you so Much.

Is possible to Display the AD User Full Name in client using mod_shared_roster_ldap

Config Commands
****************
{mod_shared_roster_ldap,
[
{ldap_servers, ["dc.domain.tld"]},
{ldap_base, "ou=location,ou=companyname,dc=domain,dc=tld"},
{ldap_rootdn, "cn=username,cn=Users,dc=domain,dc=tld"},
{ldap_password, "SuperSecret"},
{ldap_groupattr, "department"},
{ldap_groupdesc, "department"},
{ldap_memberattr, "sAMAccountName"},
%%{ldap_memberattr_format, "uid=%u*"},
{ldap_filter, "(sAMAccountName=*)"}
]}

Please confirm

Thanks
Krishna

ejabberd does not implement

mikekaganski — Thu, 31 Jan 2013 12:27:11 +0000

ejabberd does not implement this. You only can use one attribute to construct jids.

Maybe there exist some possibility to create an intermediate LDAP server that would take data from AD and internally combine it to change the LDAP representation.

Hi Team, I have ejabberd

Krishna_vernalis — Thu, 31 Jan 2013 07:27:09 +0000

Hi Team,

I have ejabberd Server running with version 2.1.9.Also integrate into AD Server.
Right now i am using Chat JID as Mail attribute in AD server.

{ldap_uids, [{"mail", "%u@domain.com"}]}.

Could you please tell me how to use givenName and SN attribute in AD Server as like below

givenName.SN@domain.com

Please help to come out this issue.

Regards
Moorthy

Sorry to reply too late, but

mikekaganski — Sat, 19 Jan 2013 06:36:24 +0000

Sorry to reply too late,

but the error seems to indicate some problem with LDAP itself.
The error name is invalidDNSyntax (invalid Distinguished Name syntax), I suspect some LDAP entity is internally malformed.
The error text is:

0000208F: NameErr: DSID-031001BA, problem 2006 (BAD_NAME), data 8350, best match of:
	'vicmau'

This seem to support my idea.
And so do your words that logs show normal operation until this "error" (that is not treated as error by ejabberd, as you may note, it's just =INFO REPORT====)