Authenticate against Zimbra's LDAP

[mattwalston]

I know it is not designed for this application, but we are a small deployment of about 20 users evaluating Zimbra. I know directory information is stored in OpenLDAP. I am not experienced with either OpenLDAP or Zimbra but would like to utilize Zimbra's OpenLDAP to authenticate users in a POSIX environment (Fedora Core 6 to be exact).


A plugin to manage additional directory information necessary to distribute POSIX login information would be a huge enhancement to the product. But for now, what is the shortest distance to our goal of only maintaining one password store?

[MidSpeck]

I know it is not designed for this application, but we are a small deployment of about 20 users evaluating Zimbra. I know directory information is stored in OpenLDAP. I am not experienced with either OpenLDAP or Zimbra but would like to utilize Zimbra's OpenLDAP to authenticate users in a POSIX environment (Fedora Core 6 to be exact).


A plugin to manage additional directory information necessary to distribute POSIX login information would be a huge enhancement to the product. But for now, what is the shortest distance to our goal of only maintaining one password store?

Not a bad idea to have a single store of information. It makes it easier in the end to manage users, etc. I think you could go about this one of two ways:

1, make some sort of module that allows for extensions to Zimbra's LDAP server and authenticate your OS logins against that.

2, Zimbra can authenticate users against an external LDAP (and even Active Directory). You could set up an LDAP server -- with whatever additional schema you wish -- and then just authenticate Zimbra against it (kind of the other way around from what you are thinking). I would kind of lean toward this idea because all the work is already done besides setting up another LDAP server to hold all your user information.
(Note that Zimbra will still maintain its own LDAP server as far as I know to store its own configuration, etc.)

[mattwalston]

The module would be the preferred method for us. We only have one machine to provide the network services. Beyond Zimbra we also run a Ruby on Rails deployment, NFS sharing, DHCP server for 10 clients, tftp for pxe information for installations, and some form of directory server.


Obviously, the RoR and LDAP could bind to an alternate port, but why? Most of the data in the LDAP would be replicated in the Zimbra directory. The complexity of a module that extends management of users and groups should not be that difficult on the surface.


While I am relatively inexperienced with openldap and Zimbra; I am a capable administrator and half competent developer. If someone there is much interest in this project, I can work on such a project utilizing company time.


If you are interested PM me.

[dlbewley]

We are creating users on a fedora box and authenticating them against zimbra with pam_ldap. They wil ssh to this box and run pine which will IMAP to zimbra. We're still testing, but it works.

It requires making the user account on both systems and enforcing password complexity twice, but at least there is only one password and users can avoid zimbra and stick to pine if they want.

I intend to also auth web apps against zimbra once we're in production.
It'll go on the wiki somewhere when it's tested a little more.

[adamthehutt]

Did anything ever become of this? This would be useful for me as well.