DN to use for ldap bind?

[gwjones]

I was not able to find a definitive answer by searching, so I thought I would ask here. With version 5, we have a perl script that gets a list of all aliases in use that does an anonymous bind with ldap. Since the version 6 release notes point out that anonymous binds are no longer allowed, what would be the proper DN to bind with? I found reference to using uid=zimbra,cn=admins,cn=zimbra in the wiki article on merging two servers (which I used recently and it worked well, btw). Would this still be an appropriate DN to use for this purpose with version 6.0.7.1?

Thanks.

Wendell

[quanah]

Two things:

1) anonymous binds are disabled by default if it is a new install. They remain enabled if it is an upgrade, and you can always enable them if you want.

2) Yes, the zimbra admin dn is a perfectly good dn to use for this type of search. If you want to use one with fewer permissions, you might try the postfix user or the replication user. The zimbra admin DN can do pretty much anything in the main db, so just be aware of that.

[gwjones]

Originally Posted by quanah

Two things:

1) anonymous binds are disabled by default if it is a new install. They remain enabled if it is an upgrade, and you can always enable them if you want.

2) Yes, the zimbra admin dn is a perfectly good dn to use for this type of search. If you want to use one with fewer permissions, you might try the postfix user or the replication user. The zimbra admin DN can do pretty much anything in the main db, so just be aware of that.

Thanks for the response.

It seems like requiring authenticated binds is a good thing. Will that affect anything other than external access to the ldap information?

Since all we need to do with this is read the mail and zimbraMailAlias attributes, would the postfix user have the necessary privileges? I assume that the DN would be uid=postfix,cn=admins,cn=zimbra?

Thanks again.

Wendell

[quanah]

Hm, no postfix won't work for you in that case, because it doesn't have access to the mail attribute.

[gwjones]

OK thanks. I guess we'll just use uid=zimbra then. Since we're only reading, there shouldn't be much risk.

Wendell