Hi,

Anybody can explain me how to populate a roster for every user with my user in my OU?

I really don't understand this mod.

Authent is ok, we've set mod_shared_roster_ldap: and mod_roster is already activated.

mod_shared_roster_ldap:
ldap_base: "ou=Internal,ou=Users,dc=xxxxxxx,dc=xxx"
ldap_rfilter: "(&(objectClass=inetOrgPerson)(ou)"
ldap_filter: ""
ldap_userdesc: "displayName"

what did i miss ?

Hi, please forgive me is this isn't the right place to ask. I've been struggling two days straight to get dynamic shared rosters from Active Directory to work correctly. I msut mention that our DIT is years long and therefore I can't make many big changes, I have to use what is there.

We have two groupings: one for quick overview when managing the tree and for Policy propagation, disposed in coarse OUs. The other one, which is used for the more granular tasks of security mappings in storage, and for mail distribution lists is based on Security and Distribution Groups, of which many are nested. Users and groups that should have mail (and now XMPP) have their mail fields populated with their sAMAccountName@our.domain.com..I have to get the users and groups from the groups, not from the OUs.

My ejabberd authenticates with LDAP to the Active Directory, Vcard information is also pulled from there. These two things are working seamlessly from the start. The non-LDAP shared rosters also worked fine when testing (except for @all@).

The trouble with shared_roster_ldap was that it didn't handle CN's containing spaces, *every* CN here is "FirstName Lastname". Finally solved it by making the module to connect to a local OpenLDAP proxy that maps and rewrites every entry in the member attributes, making another request with the DN and replacing it with the values of sAMAccountNames. In the mapping the attribute itself is renamed to uid. All this is transparent to the module, which sees a member attribute that contains a list of uids with usernames.

Right when the mapping was up, the roster was populated from Active Directory with all users and groups, and the Vcards are correct for every entry.

But the problem is that now I see every user offline, even if they are connected

I don't get it. When I was testing mod_shared_roster, I added sAMAccountName@our.domain.com. and it worked correctly. Now the same is shown in the list but the status isn't updated. When I browse the address with Psi+ It shows it, along with other JIDS that have some kind of ID appended after the domain. I guess this is related to the real problem, but I don't see in what way (or how can I solve it).

Could you please help me to get it finally working?

Hello.

I've successfully installed ejabberd from Ubuntu 14.04 repo and configured authentication against Active Directory on Windows Server 2012. My problem is that mod_shared_roster_ldap seems not working properly. It is strange but it doesn't work when mod_shared_roster is down, when I uncommented line with mod_shared_roster users appered on contact list. Every changes that I make in mod_shared_rosted_ldap don't do anything even when I commented mod_shared_roster_ldap with everything that is included in it users (only usernames like for ex. user.name) still appear on roster - is it normal? My goal is to authenticate users against AD and have roster with them, not with usernames but with people names. Any suggestions ?

Hi,

we've setup ejabberd for our team delivered with Ubuntu 12.04 LTS (ejabberd v2.1.10).

Currently we try to created shared rosters based on LDAP for the Team and several projects, but have no success to get the ldap_ufilter applied to the members detected by the gfilter.

Did you have any hint for me what's going wrong there?

Here's a example of the LDAP Structure we use + the ldap and mod_shared_roster_ldap module:

LDAP Structure

ejabberd configuration

With this I've got the following output on loglevel 5.

ejabberd log

* find the query for roster filter

* see the result of the roster filter:

* find the query of the gfilter:

* result of gfiler with ldap_memberattr = memberUid

* here I guess the ufilter should be applied it doesn't, so we got never a match of memberUid with uid=%u

* Result: no match since this is not my ufilter????
* instead it's matched for mail-address created out of the "memberUid"+@+"Domain"

Did you have any hints or idea why this happens?

How can I get the users data from PosixAccount member within a PosixGroups?

Thank you very much for any help here!
Sebastian

Is there a way to filter groups avaliable to the user to only those he is a member of?

If so how it can be done?

we have ejabberd (2.1.11)+ ldap server (communigate) + mod_shared_roster_ldap + ~2100 users.
sometimes ejabberd makes stop it activity (new users can't connect to it with "connection timeout, early connected and logged on users stays working.)
in logs i see

=ERROR REPORT==== 2012-11-30 12:52:37 ===
E(<0.19874.8>:eldap_pool:81) : LDAP request failed: timed out

=ERROR REPORT==== 2012-11-30 12:52:37 ===
E(<0.19876.8>:eldap_pool:81) : LDAP request failed: timed out

=ERROR REPORT==== 2012-11-30 12:52:37 ===
E(<0.19878.8>:eldap_pool:81) : LDAP request failed: timed out

(huge list of such messages).

where i make stop to mode_shared_roster_ldap, i (next 30 or 90 miinutes!!!) see:

=ERROR REPORT==== 2012-11-30 13:03:27 ===
'mod_shared_roster_ldap_domain.com' crashed: {noproc,
{gen_server,call,
['mod_shared_roster_ldap_domain.com',
{get_user_displayed_groups,
"j.bubueva"},
600000]}}

(huge list of such messages).
after last of these messages(when _all_ examples of running msrl shuted down), ejabberd is working fine.
when i make start msrl by-hand later, it works fine too to next trouble with timeout.

my config of msrl:
{mod_shared_roster_ldap,[
{ldap_user_cache_validity,7200},
{ldap_group_cache_validity,7200},
{ldap_auth_check,off},
{ldap_servers,["10.177.74.3"]},
{ldap_port,389},
{ldap_rootdn,"uid=master,o=domain"},
{ldap_base,"o=domain"},
{ldap_groupattr,"JABBERGROUP"},
{ldap_password,"123"},
{ldap_memberattr,"uid"},
{ldap_rfilter,"(objectclass=CommuniGateAccount)"},
{ldap_filter,"(objectclass=CommuniGateAccount)"},
{ldap_useruid, "uid"},
{ldap_userdesc,"cn"}
]}

i did read a lot of documentation and huge pages of google and (in my current opinion) problem is in method of managing and making connection to ldap server.
seems, i began to think, that msrl uses persistent connection and not all of connection, which it takes, are operational. tuning keepalive timeout on server doesn't solve the problem, our firewall has not set to watch for timeout of connections.

my question:
can msrl choice to use poersistent or non-persistent connection?
how can i make it to establish new connecton to ldap?
or what direction i have to take in my searchs to solve this problem?

Hi,

I'm using a text book OpenLDAP setup here and would like to know how I debug the results saved by eldap. My setup is as follows (LDAP auth is all OK and works) with comments added by me to help me understand the various settings as per the docs:

Here's the LDAP data and searches that I see in the OpenLDAP logs:

LDAP data:

Above is a group. So we use "member" and a member_format of "cn=%u,ou=Users,dc=ghenry,dc=co,dc=uk"

A user looks like:

uid is the JID.

search logs, which is what I *only ever* see and *never* get a roster:

Why doesn't this work and how do I see what's in the cache and eldap results?

Thanks.

i have three ldap servers with about twelve domains in different offices and one ejabberd server in central office, which does service all offices at ones.
for all offices i made shared rosters with mod_shared_roster_ldap. one roster for one domain. but i still have a few questions:
1. is msrl able to run some different instances with different settings for one domain?
may be with "per host config + global config". i'd have tried this, but without results: msrl run with last settings, that i did.
2. is msrl able to get data from two or more ldap servers or from two or more rootdns ?
one ldap (communigate) has a one ldap tree for each domain, and binding to basedn="" doesn't work. only to basedn="my1.domain.com", etc.

i'm trying find a way to create shared roster for all domains together without making fourth ldap server with whole domain tree and syncing data or integrating communigate servers in external ldap.

Hello,

I have been racking my brain for days trying to get this to be configured, so any help would be much appreciated.

I am authing against ldap, and all my users can login, and now I want them to see each other using the ldap shared roster tool. Because the mod_shared_roster @all@ does not support ldap.

Running ejabberd 2.1.8-2 from fedora

My DIT:
base = ou=People,ou=IT,o=school,c=US
Everyone is under this ou
the ldap attribute nsRole needs to be queried for it to be appear (doesnt show up automatically)
the role for everyone that I want to login and show is
nsRole=cn=jabber,ou=IT,o=school,c=US

example:

base = ou=People,ou=IT,o=school,c=US =below this => uid=GIR,ou=People,ou=IT,o=school,c=US

GIR has these other normal attributes
uid = gir
cn = Gir Loves Bacon
sn = BACON
objectclass=Person
nsRole=cn=jabber,ou=IT,o=school,c=US

The ldap searches work fine, and they look like this, it will show the uid of everyon that has this attribute.

ldapsearch -x -b "ou=people,ou=IT,o=school,c=us" "(nsRole=cn=jabber,ou=people,ou=it,o=school,c=us)" uid

==

I have tried various settings but I can not get group to show up. I have got everyone to show in the OU, or in a group, but their CN wont be associated, so all I see are uid's. Its driving me nuts, the polish examples in the documentation are funny and make some sense, so it might just be me, so any help would be appreciated.

Thank you,
GIR

Попытался получить ростер с AD2008, но увы не получается.
схема такая:

cn= ФИО
department= Название Отдела
displayName= ФИО
distinguishedName= CN=ФИО,OU=Отдел,OU=Организация,DC=dmain,DC=local
name= ФИО
objectClass= person
objectClass= organizationalPerson
objectClass= user
sAMAccountName= userlogin

пробовал как написано было раньше другими:

но в итоге не получаю ничего. ни групп ни пользователей в ростере(кроме тех кого добавил сам руками по поиску).
по поиску vcard их находит и выводит информацию нормально. на сервере тоже по ldap авторизуется.
версия 2.1.8. модуль брал и из поставки с джаббером и с сайта разработчика.
в логах не ругается.
Грешу на то, что OU группы русские.

Hello everyone using LDAP shared rosters!

I made modifications to the mod_shared_roster_ldap to make it more AD-friendly, and also to make its general use more straightforvard. The modified version is available from the ProcessOne's issue page. The detailed description of changes may be found there,too.

The main feature is that now it's possible to generate user ids ftom another ldap attribute than that is used to find the user in the directory. E.g., it's now possible to specify group users by the "member" attribute of group object in AD, even if user's distinguished name cannot be used to create uid, and then build the uid from sAMAccountName or userPrincipalName.

Other changes include improved caching and less LDAP queries -> less traffic and domain controller load.

Please test it and report any issues you will find to the abovementioned issue page. Also, I need some feedback concerning some further changes. The questions that need your attention are listed there.

Hello porridge!
Thank you for your work supporting this module.

Retrieving the roster section of the Installation and Operation Guide:
Step 2.a performs a query on LDAP to get groups data (this step is executed once).
Step 2.c.i converts the string in ldap_memberattr into the jid.
Step 2.c.ii (optional) checks for existence of this jid (using auth mechanism; thus, it must depend on jid).
Step 3.b.ii.A performs a query on LDAP to get the display name of each jid, at the same time retrieving the ldap_useruid attribute.

Supposedly, the roster is built after the step 3.

This sequence applies some unnecessary restrictions on the LDAP data. Specifically, there are multiple threads on this forum with questions concerning the Active Directory integration. In some environments, it's impossible to use this module as intended, and a workaround needs to be implemented to overcome its deficiency.
For example, in AD, the [group object] has an attribute "member" that has entries defining the DNs of its members.
A DN may not contain the necessary information to construct the jid. First, the DN consists of relative distingueshed names, so no part is guaranteed to be unique across the domain, only the DN is. Second, the CN part of DN isn't required to conform to the requirements for the user part of jid. For example, in our environment, I have my DN like "CN=Kaganski Mikhail Borisovich,OU=my_dept,DC=example,DC=com". Note the spaces in the CN.
[user object] contains an attribute, named "sAMAccountName", that is mandatory, is guaranteed to be unique across the domain, and may be used to construct the user part of the jid (at least we could use it in our environment). But I have no means to get this information if I search for group objects first, to get the list of users in those groups.

The module could make use of an alternative path to get the user information. If a new optional parameter would be introduced, e.g. "member_is_DN", with a default walue of "no", and if it is set to "yes", then instead of steps 2.c.i, 2.c.ii and 3.b.ii.A, it would get the object with that DN, and look there for the "ldap_useruid" attribute, then apply the ldap_memberattr_format(_re) to it to get the user part of the jid, and for the "ldap_userdesc" attribute. That could be still done using the "User Filter", and looking for the entry with corresponding DN. This way the AD problem could be solved successfully, while maintaining full compatibility with current version, and having (almost) no impact on performance.

Thank you for your consideration.

Hi there,

I am trying to get ldap shared_roster working for days now...
If I run the ldapsearch on cli I get the correct results, but in the jabberroster I do not see anybode.
Is there more to config besides the mod_shared_roster_ldap?

Do I need to set up a roster and configure a group to see this "ldapgroup"

thx for any help in advance

greets

I'm trying to use unit tests from this mod source.
Test is crashed at "mock:new".

There is the only mention in doc about "added unit tests for several important functions, using a couple of mocking libraries".

There is in source next message:

I found gen_server_mock at https://github.com/jashmenn/gen_server_mock Is that correct module?

What about the other "mock modules"?

I have some questions about using this mod.

I need following functionality equal to mod_shared_roster:
1) Edit shared roster with contacts from different jabber servers (different jabber domains)

To this mod I expect I store this roster (group) in LDAP DIT.

2) Get this shared roster by each user (including from different servers) at user login

I expect each jabber server will get shared roster from the LDAP DIT (maybe connecting to different LDAP servers serving the same DIT).

So the questions:
How this mod makes JID (username@servername) for shared roster contacts? I understand that "username" is taken from value of attribute "ldap_useruid" of user entry. What about "servername"?

Can I teach this mod to get JID (username@servername) right from any special attribue (for example, "jabberID" from user entry)? Of course I fixed LDAP schema for adding this attribute to user entry.

PS:
I look for any advices with other ways.
The whole picture: I need deploy some federated servers with "See all online" concept. And I'm looking for an easy way to add new user to this system, i.e. without manual adding this user to rosters at all servers.

Also I'm thinking about Clustering, but there are a lot of questions... Is clustering suitable for system where servers and links between them can be eventually switched off and on.

whis config mod_shared_roster_ldap(0.5.3) working with openldap(zimbra OSE 7.0.1):

{mod_roster,[]},
{mod_shared_roster,[]},
{mod_shared_roster_ldap,[
{ldap_base, "dc=example,dc=com"},
{ldap_rfilter, "(objectClass=*)"},
{ldap_filter,""},
{ldap_ufilter,"(uid=%u)"},
{ldap_groupattr,"cn"},
{ldap_groupdesc,"description"},
{ldap_memberattr,"memberUid"},
{ldap_memberattr_format,"%u"},
{ldap_useruid, "uid"},
{ldap_userdesc,"displayName"}
]},

EDIT: nevermind, I'm just crazy. I already had the users in a different roster, and my IM client didn't put them into the shared LDAP roster for some reason. Once I added a user that wasn't already in my IM client, it showed up under the group just fine. I'll leave this here in case it's useful to anybody.

Since I'm just setting up LDAP as I'm setting up ejabberd, I copied the deep group structure that is presented on the http://ejabberd-msrl.alioth.debian.org/doc/0.5.3/msrl.html#htoc1 documentation page. So, the ldif for a user looks like:

And the ldif for a group looks like this:

In my config for mod_shared_roster_ldap, I have:

The commented-out line there is what the page recommends, but that gives me no results, so I changed it to just "%u", and that does give me a shared roster. The problem I'm having is that rather than the roster entries being other@example.com and tsuraan@example.com, I'm getting roster entries of "uid=tsuraan,ou=People,dc=example,dc=com" and "uid=other,ou=People,dc=example,dc=com". This seems like a sort of unique problem, and I don't have any idea why it's happening or how to solve it. If there were some name-manging regex substitute I could apply, then I could hack it that way, but I can't find anything like that. Digging through mod_shared_roster_ldap.erl, I don't even see where the thing builds the foo@bar names; the '@' symbol only appears in the header comment of the file, so I really have no idea how the module is supposed to be building JIDs at all. Any help would be very appreciated.

Я настроил сортировку пользователей по группам, пришлось добавить в атрибут каждого пользователя новый параметр postalAddress
==================================================
{ldap_rfilter, "(objectClass=inetOrgPerson)"},
{ldap_groupattr, "postalAddress"},
{ldap_memberattr, "uid"},
{ldap_filter, "(objectClass=inetOrgPerson)"},
{ldap_userdesc, "displayName"}
==================================================
Вопрос к вам такой, можно ли сделать чтобы один пользователь был членом 2х групп одновременно? Я предположил что можно параметр ldap_groupattr использовать с двумя значениями "postalAddress" и "postOfficeBox" эти оба атрибута прописаны у пользователя.
Как правильно записать в конфиге?
может как-то так: {ldap_groupattr, "(&(postalAddress)(postOfficeBox))"},
или так: {ldap_memberattr, [{"postalAddress"},{"postOfficeBox"}]},
В общем у меня не заработало с такими параметрами.
Помогите пожалуйста кто знает......