ZARAFA-LDAP.CFG(5)

NAME
zarafa-ldap.cfg - The Zarafa LDAP configuration file

SYNOPSIS

ldap.cfg

DESCRIPTION

The ldap.cfg is a configuration file for LDAP user plugin. All options to correctly retrieve user and group information can be set here.

FILE FORMAT

The file consists of one big section, but parameters can be grouped by functionality.

The parameters are written in the form:

name = value

The file is line-based. Each newline-terminated line represents either a comment, nothing, a parameter or a directive. A line beginning with `#' is considered a comment, and will be ignored by Zarafa. Parameter names are case sensitive. Lines beginning with `!' are directives.

Directives are written in the form:

!directive [argument(s)]

The following directives exist:

include
    Include and process argument Example: !include common.cfg

EXPLANATION OF EACH PARAMETER

ldap_host
    The hostname or ip-adress of the LDAP server. Default: localhost

ldap_port
    The port number of the LDAP server. LDAP normally runs on port 389. Default: 389

ldap_network_timeout
    The timeout for network operations in seconds. Default: 30

ldap_protocol
    The protocol to be used to connect to the LDAP server. Can be either 'ldap' or 'ldaps' for SSL connections. You will probably have to specify port 636 for ldap_port also. Zarafa will not use STARTTLS for such an SSL connection but instead will connect directly to an SSL encrypted port. Default: ldap

ldap_server_charset
    The charset that the LDAP server uses to store strings. All strings sent to the LDAP server or retrieved from the server will be interpreted in this charset. In most setups, utf-8 is used, but may also be iso-8859-15. All charsets supported by the system iconv() are supported here. Default: utf-8

ldap_bind_user
    The bind dn as to connect to the LDAP server. Leave empty to connect anonymous. Default value is empty.

ldap_bind_passwd
    When ldap_bind_user is a valid DN, this should be filled in too. Default value is empty.

ldap_user_search_base
    This is the subtree entry where the users are defined in the LDAP server. Default: cn=users,dc=zarafa,dc=com

ldap_user_scope
    This value can be one of three values: base, one or sub. Default: sub

ldap_user_search_filter
    Add a filter to the user search. Default: (objectClass=posixAccount)

ldap_user_unique_attribute
    This is the unique attribute of a user which is never going to change, unless the user is removed from LDAP. When this value changes, Zarafa will remove the previous user and store from the database, and create a new user with this unique value. Default: cn

ldap_user_unique_attribute_type
    Contents type for the ldap_user_unique_attribute this value can be binary or text. For LDAP this value should be text. For ADS this value should be binary>. Default: text

ldap_group_search_base
    This is the subtree entry where the groups are defined in the LDAP server. Default: cn=groups,dc=zarafa,dc=com

ldap_group_scope
    This value can be one of three values: base, one or sub. Default: sub

ldap_group_search_filter
    Add a filter to the group search. Default: (objectClass=posixGroup)

ldap_group_unique_attribute
    This is the unique attribute of a group which is never going to change, unless the group is removed from LDAP. When this value changes, Zarafa will remove the previous group from the database, and create a new group with this unique value. Default: cn

ldap_group_unique_attribute_type
    Contents type for the ldap_group_unique_attribute this value can be binary or text. For LDAP this value should be text. For ADS this value should be binary Default: text

ldap_fullname_attribute
    This value is the fullname of a user. It will be used on outgoing messages, and store names. Default: cn

ldap_loginname_attribute
    This value is the loginname of a user. This is what the user uses to login on zarafa. The DAgent will use this value to open the store of the user. Default: uid

ldap_password_attribute
    This value is the password of a user. When using ldap_authentication_method = password, this value will be checked. The ldap_bind_user should have enough access rights to read the password field. Default: userPassword

ldap_emailaddress_attribute
    This value is the email address of a user. It will be used to set the From on outgoing messages. Default: mail

ldap_isadmin_attribute
    This value indicates if a user has administrator rights. 0 or not presents means no. 1 means yes. In multi-company environment a value of 1 means that the user is administrator over his own company. A value of 2 means he is administrator over all companies within the environment. Default: zarafaAdmin

ldap_nonactive_attribute
    This value indicates if a user is nonactive. Nonactive users cannot login, but the store can be used as a shared store for other users. By default this option is set to empty, doing this will effectively disable the availability of the nonactive user feature and will assign all users to be active. The nonactive attribute provided by the Zarafa schema for nonactive users is zarafaSharedStoreOnly Default: empty

ldap_user_sendas_attribute
    This attribute contains the list of users for which the user can use the sendas feature. Default: zarafaSendAsPrivilege

ldap_user_sendas_attribute_type
    Contents type for the ldap_user_sendas_attribute this value can be dn, binary or text. On LDAP this value should be text. On ADS this value should be dn Default: text

ldap_user_sendas_relation_attribute
    This value is used to find the users in the sendas list. Defaults to empty value, using the ldap_user_unique_attribute setting. Default: Empty

ldap_user_telephone_attribute
    This value indicates the telephone number for the user. Default: telephoneNumber

ldap_user_department_attribute
    This value indicates the department for the user. Default: departmentNumber

ldap_user_location_attribute
    This value indicates the location for the user. Default: physicalDeliveryOfficeName

ldap_user_fax_attribute
    This value indicates the fax number for the user. Default: facsimileTelephoneNumber

ldap_authentication_method
    This value can be bind or password. When set to bind, the plugin will authenticate by opening a new connection to the LDAP server as the user with the given password. When set to password, the plugin will read and match the password field from the LDAP server itself. When set to password, the ldap_bind_user should have enough access rights to read the password field. Default: bind

ldap_groupname_attribute
    This value is the name of a group. Default: cn

ldap_groupmembers_attribute
    This value is the member list of a group. Default: member

ldap_groupmembers_attribute_type
    Contents type for the ldap_groupmembers_attribute this value can be dn, binary or text. On LDAP this value should be text. On ADS this value should be dn Default: text

ldap_groupmembers_relation_attribute
    This value is used to find the users in a group. or sub. Defaults to empty value, using the ldap_user_unique_attribute setting.

ldap_company_search_base
    This is the subtree entry where the companies are defined in the LDAP server. Each user defined below the tree entry of a company is considered a member of that company. Default: dc=zarafa,dc=com

ldap_company_scope
    This value can be one of three values: base,one orsub. Default: sub

ldap_company_search_filter
    Add a filter to the company search. Default: (objectClass=organizationalUnit)

ldap_company_unique_attribute
    This is the unique attribute of a company which is never going to change, unless the company is removed from LDAP. When this value changes, Zarafa will remove the previous company from the database, and create a new company with this unique value. Default: ou

ldap_company_unique_attribute_type
    Contents type for the ldap_company_unique_attribute this value can be binary or text. On LDAP this value should be text. On ADS this value should be binary Default: text

ldap_companyname_attribute
    This value is the name of a company. Default: ou

ldap_company_view_attribute
    This attribute contains the list of companies which can view the members of the company where this attribute is set on. Companies which are not listed in this attribute cannot see the presence of the company space itself nor its members. Default: zarafaViewPrivilege

ldap_company_view_attribute_type
    Contents type for the ldap_company_view_attribute this value can be dn, binary or text. On LDAP this value should be text. On ADS this value should be binary Default: text

ldap_company_view_relation_attribute
    The attribute of the company which is listed in ldap_company_view_attribute Default: Empty, using the ldap_company_unique_attribute

ldap_company_admin_attribute
    This attribute contains the list of users outside of the selected company space who are administrator over the selected company space. Note that local users should not be listed as administrator here, those users need the ldap_isadmin_attribute attribute. Default: zarafaAdminPrivilege

ldap_company_admin_attribute_type
    Contents type for the ldap_company_admin_attribute this value can be dn, binary or text. On LDAP this value should be text. On ADS this value should be binary Default: text

ldap_company_admin_relation_attribute
    The attribute of the user which is listed in ldap_company_admin_attribute Default: Empty, using the ldap_user_unique_attribute

ldap_company_system_admin_attribute
    This attribute contains the user who acts as the system administrator of this company space. This can either be a local user or a user from a different company space. At the moment this user is set as the sender of quota warning emails. Default: zarafaSystemAdmin

ldap_company_system_admin_attribute_type
    Contents type for the ldap_company_system_admin_attribute this value can be dn, binary or text. On LDAP this value should be text. On ADS this value should be binary Default: text

ldap_company_system_admin_relation_attribute
    The attribute of the user which is listed in ldap_system_admin_attribute Default: Empty, using the ldap_user_unique_attribute

ldap_quotaoverride_attribute
    Default: zarafaQuotaOverride

ldap_warnquota_attribute
    Default: zarafaQuotaWarn

ldap_softquota_attribute
    Default: zarafaQuotaSoft

ldap_hardquota_attribute
    Default: zarafaQuotaHard

ldap_userdefault_quotaoverride_attribute
    Default: zarafaUserDefaultQuotaOverride

ldap_userdefault_warnquota_attribute
    Default: zarafaUserDefaultQuotaWarn

ldap_userdefault_softquota_attribute
    Default: zarafaUserDefaultQuotaSoft

ldap_userdefault_hardquota_attribute
    Default: zarafaUserDefaultQuotaHard

ldap_last_modification_attribute
    This value is used to detect changes in the item in the LDAP server. Since it is a standard LDAP attribute, you should never have to change this. It is mainly used for addressbook synchronisation between your server and your offline data. Default: modifyTimeStamp

ldap_quota_multiplier
    This value is used to multiply the quota values to bytes. When the values in LDAP are in Kb, use 1024 here. Default: 1

ldap_quota_userwarning_recipients_attribute
    This attribute contains the list of users who will recieve an email when a user exceeds his quota. User who exceeds his quota will be automatically added to the recipients list, this list only indicates who else will be notified. Default: zarafaQuotaUserWarningRecipients

ldap_quota_userwarning_recipients_attribute_type
    Contents type for the ldap_quota_userwarning_recipients_attribute this value can be dn, binary or text. On LDAP this value should be text. On ADS this value should be dn Default: text

ldap_quota_userwarning_recipients_relation_attribute
    The attribute of the user which is listed in ldap_quota_userwarning_recipients_attribute Default: Empty, using ldap_user_unique_attribute

ldap_quota_companywarning_recipients_attribute
    This attribute contains the list of users who will recieve an email when a company exceeds its quota. The system administrator of the company that is over quota will automatically be added to the recipients list, this list only indicates who else will be notified. Default: zarafaQuotaCompanyWarningRecipients

ldap_quota_companywarning_recipients_attribute_type
    Contents type for the ldap_quota_companywarning_recipients_attribute this value can be dn, binary or text. On LDAP this value should be text. On ADS this value should be dn Default: text

ldap_quota_companywarning_recipients_relation_attribute
    The attribute of the user which is listed in ldap_quota_companywarning_recipients_attribute Default: Empty, using ldap_user_unique_attribute

ldap_user_certificate_attribute
    The attribute which contains the user's public certificate to be used for encrypted S/MIME messages. Both Active Directory and OpenLDAP use the same ldap attribute by default. The format of the certificate should be the binary DER format. Default: userCertificate

ldap_addresslist_search_base
    This is the subtree entry where the addresslists are defined in the LDAP server. Default: cn=addresslists,dc=zarafa,dc=com

ldap_addresslist_scope
    This value can be one of three values: base, one or sub. Default: sub

ldap_addresslist_search_filter
    Add a filter to the addresslist search. Default: (objectClass=zarafaAddressList)

ldap_addresslist_unique_attribute
    This is the unique attribute of a addresslist which is never going to change, unless the addresslist is removed from LDAP. When this value changes, Zarafa will remove the previous addresslist from the database, and create a new addresslist with this unique value. Default: cn

ldap_addresslist_unique_attribute_type
    This value can be type or binary. For OpenLDAP, only `text' is used. Default: type

ldap_addresslist_filter_attribute
    This is the name of the attribute on the addresslist object that specifies the filter to be applied for this addresslist. All users matching this filter AND matching the default ldap_user_search_filter will be included in the addresslist. Default: zarafaFilter

ldap_addresslist_name_attribute
    The attribute containing the name of the addresslist Default: cn

ldap_object_search_filter
    When searching in the addressbook, this filter will be used. Normally, the zarafa server will only search in the unique attribute, loginname, fullname and emailaddress. You might want to search in more fields, like 'lastname'. Zarafa also uses a postfix wildcard only. Using the '*' wildcard with prefixes makes a search slower, but can return more results. You can set a custom search filter here. '%s' will be replaced with the string being searched. Active Directory has a shortcut for searching in the addressbook using the 'anr' attribute. This is recommended on ADS installations. Default: Recommended for ADS installations: (anr=%s) Optional for OpenLDAP installations: (|(mail=%s*)(uid=%s*)(cn=*%s*)(fullname=*%s*)(givenname=*%s*)(lastname=*%s*)(sn=*%s*))

ldap_filter_cutoff_elements
    When the ldap plugin retrieves information from the LDAP Server, large queries can be created to retrieve data for multiple objects at once. These large queries can perform badly on some LDAP server implementations. This option limits the number of elements that can be retrieved in one search filter and therefore limits the size of the filter. Instead, a broader search filter is created which retrieves all objects from the LDAP server. This results in slightly higher processing overhead and network activity, but with the bonus that the query can be served by the LDAP server much faster (a factor of 40 in 5000-object queries has been observed). Setting this value to 0 will never limit the filter, setting it to a value of 1 will always limit the filter (since all queries will be retrieving one or more objects). Default: 1000

FILES

/etc/zarafa/server.cfg
    The server configuration file.

/etc/zarafa/ldap.cfg
    The Zarafa LDAP configuration file.

AUTHOR

Written by Zarafa.

SEE ALSO

 zarafa-server(1) zarafa-server.cfg(5)