KOPANO-LDAP.CFG(5)

📦 version 8.7.0, in ubuntu jammy

💖 KOPANO-LDAP.CFG 💖

okay bestie, listen up — this is the user reference for Kopano Core, and today we're talking about the Kopano LDAP configuration file. it's giving manual page, section 5, and it's lowkey the blueprint for how Kopano talks to your LDAP server. let's get into it 🦋

✨ NAME ✨

kopano-ldap.cfg — The Kopano LDAP configuration file. that's her. that's the whole name. iconic. 💅

✨ SYNOPSIS ✨

ldap.cfg

just the filename, no drama, she's a file. 🎀

✨ DESCRIPTION ✨

so the ldap.cfg is the configuration file for the LDAP user plugin. every single option you need to correctly pull user and group information out of your LDAP server? yeah, all of it lives right here. no cap. ✨

✨ FILE FORMAT ✨

the file is basically one big section, but bestie you can group the parameters by functionality if you want your config to be organised and cute. do it. your future self will thank you. 🫶

parameters get written like this:

name = value

the file is line-based. every newline-terminated line is either a comment, nothing at all, a parameter, or a directive. a line that starts with # is a comment and Kopano will just ignore it — like, not even reading it, ghosted. 💀

⚠️ parameter names are case sensitive, so ldap_host and LDAP_HOST are absolutely not the same girl. don't do that.

and lines starting with ! are directives. they look like this:

!directive [argument(s)]

here are the directives that exist, periodt:

include

Include and process argument.

example, look:

!include common.cfg

propmap

okay so propmap delivers the capabilities to map additional attributes to addressbook properties — think firstname, lastname, telephonenumber, the whole squad. 🌸

inside the propmap, the configuration names must be the hex property tag of the property you want. and the value you give to that configuration name must be the LDAP attribute you want the property mapped to. simple as.

example:

!propmap ldap.propmap.cfg

✨ EXPLANATION OF EACH PARAMETER ✨

grab a snack, bestie, we're going through every single one. no skipping. 💖

ldap_host, ldap_port, ldap_protocol

these are the historic directives that specify a single LDAP server to use. lowkey their use is discouraged now — go use ldap_uri instead, she's the upgrade. 🔥

Defaults: ldap_host=localhost, ldap_port=389, ldap_protocol=ldap

ldap_uri

specifies the URI of one or more LDAP server(s) to use, without any DN portion. like:

ldap://server:389/
ldaps://server:636/
ldapi:///

and here's the tea: if ldap_uri is set, then the values of the historic directives ldap_host, ldap_port and ldap_protocol are ignored. fully. they don't get a say. 💅

Default: (empty, such that URI list is constructed from ldap_host, ldap_port, ldap_protocol)

ldap_starttls

request that any LDAP connections be secured with TLS, and reject the connection if this security cannot be established. she does not negotiate on safety, bestie. 🛡️ see the OpenLDAP documentation for setting up ldap.cfg and TLS requirements.

Default: no

ldap_server_charset

the charset that the LDAP server uses to store strings. all strings sent to the LDAP server or retrieved from the server will be interpreted in this charset. in most setups, utf-8 is used, but it may also be iso-8859-15. and honestly? all charsets supported by the system iconv() are supported here. versatile queen. 🌈

Default: utf-8

ldap_bind_user

the bind dn as to connect to the LDAP server. leave it empty to connect anonymous — yes, anonymous, she's mysterious like that. 🙈

Default value is empty.

ldap_bind_passwd

when ldap_bind_user is a valid DN, this should be filled in too. like, both of them, together, as a pair. 🫶

Default value is empty.

ldap_network_timeout

the timeout for network operations, in seconds.

Default: 30

ldap_last_modification_attribute

this value is used to detect changes in the item in the LDAP server. since it's a standard LDAP attribute, you should never have to change this. it's mainly used for addressbook synchronisation between your server and your offline data. so like, leave her alone. ✋

Default: modifyTimeStamp

ldap_page_size

limit result sets in pages of this size, downloading fewer results at a time from the LDAP server. little bites, not the whole cake. 🍓

Default: 1000

ldap_search_base

this is the subtree entry where all objects are defined in the LDAP server. the home address of everything. 🏠

Default: dc=kopano,dc=com

ldap_object_type_attribute

an object is defined by this attribute — what type it is, e.g. user, group, etc. every object type should have a unique value in this attribute in order to define what which entry is.

the value of this attribute must be specified in the ldap_*_type_attribute_value settings. each of those settings may specify multiple values for the type attribute, separated by comma's. all of these values must be present in the object's type attribute for a match to be made and the object to be recognised as that type.

⚠️ and here's the messy part: it is possible for ambiguities to arise by setting the same string for multiple ldap_*_type_attribute_value settings. this ambiguity will be resolved by preferring objects with more matching values. if the ambiguity cannot be resolved in this way, then the first possibility is chosen from the list (addresslist, tenant, dynamic group, group, contact, user). so order matters, bestie. 📋

Default: objectClass

ldap_user_type_attribute_value

the value in ldap_object_type_attribute which defines a user.

Default for OpenLDAP: posixAccount

Default for ADS: user

ldap_group_type_attribute_value

the value in ldap_object_type_attribute which defines a group.

Default for OpenLDAP: posixGroup

Default for ADS: group

ldap_contact_type_attribute_value

the value in ldap_object_type_attribute which defines a contact.

Default for OpenLDAP: inetOrgPerson

Default for ADS: contact

ldap_company_type_attribute_value

the value in ldap_object_type_attribute which defines a tenant. this option is only used in multi-tenancy installations.

Default for OpenLDAP: organizationalUnit

Default for ADS: kopano-company

ldap_addresslist_type_attribute_value

the value in ldap_object_type_attribute which defines an addresslist.

Default: kopano-addresslist

ldap_dynamicgroup_type_attribute_value

the value in ldap_object_type_attribute which defines a dynamic group.

Default: kopano-dynamicgroup

ldap_user_search_filter

adds an extra filter to the user search.

Hint: use the kopanoAccount attribute in the filter to differentiate between non-kopano and kopano users. iykyk. 💅

Default for OpenLDAP is empty.

Default for ADS: (objectCategory=Person)

ldap_user_unique_attribute

this is the unique attribute of a user which is never going to change, unless the user is removed from LDAP. and when this value changes? Kopano will remove the previous user and store from the database, and create a new user with this unique value. so like… don't let it change unless you mean it. 😭

Default for OpenLDAP: uidNumber

Default for ADS: objectGUID

ldap_user_unique_attribute_type

contents type for the ldap_user_unique_attribute. this value can be binary or text.

Default for OpenLDAP: text

Default for ADS: binary

ldap_fullname_attribute

this value is the fullname of a user. it will be used on outgoing messages, and store names. so when people see who sent it, this is her. 👑

Default: cn

ldap_loginname_attribute

this value is the loginname of a user. this is what the user uses to login on kopano. the DAgent will use this value to open the store of the user. so it's important fr fr. 🔑

Default for OpenLDAP: uid

Default for ADS: sAMAccountName

ldap_password_attribute

this value is the password of a user. when using ldap_authentication_method = password, this value will be checked. the ldap_bind_user should have enough access rights to read the password field. no read permission, no vibes. 🔐

Default for OpenLDAP: userPassword

Default for ADS: unicodePwd

ldap_authentication_method

this value can be bind or password.

  • when set to bind, the plugin will authenticate by opening a new connection to the LDAP server as the user with the given password.
  • when set to password, the plugin will read and match the password field from the LDAP server itself.

and when set to password, the ldap_bind_user should have enough access rights to read the password field. (yes, again. it's that serious.) ✨

Default for OpenLDAP: bind

Default for ADS: bind

ldap_emailaddress_attribute

this value is the email address of a user. it will be used to set the From on outgoing messages. main character of the header. 💌

Default: mail

ldap_emailaliases_attribute

this value is the email aliases of a user. it can be used to find extra valid email accounts for incoming email.

⚠️ these email addresses cannot be used for outgoing email. incoming only. she's shy like that. 🙈

Default: kopanoAliases

ldap_isadmin_attribute

this value indicates if a user has administrator rights.

  • 0 or not present means no.
  • 1 means yes. in a multi-tenancy environment, a value of 1 means that the user is administrator over his own tenant.
  • 2 means he is administrator over all companies within the environment. big boss energy. 👑

Default: kopanoAdmin

ldap_nonactive_attribute

this value indicates if a user is nonactive. nonactive users cannot login, but the store can be used as a shared store for other users. so she's not gone, she's just working behind the scenes. 🦋

setting this value to 1 will make a mailbox nonactive. the nonactive attribute provided by the Kopano schema for nonactive users is kopanoSharedStoreOnly.

Default: kopanoSharedStoreOnly

ldap_resource_type_attribute

this attribute can change the type of a non-active user. the value of this attribute can be room or equipment to make it such a resource. if this attribute is not present, or not one of the previously described values, the user will be a normal non-active user. no upgrade for them. 💀

Default: kopanoResourceType

ldap_resource_capacity_attribute

resources often have a limited capacity. use this attribute to control this value. user. 🍓

Default: kopanoResourceCapacity

ldap_sendas_attribute

this attribute contains the list of users for which the user can use the sendas feature. sharing is caring, bestie. 🫶

Default: kopanoSendAsPrivilege

ldap_sendas_attribute_type

contents type for the ldap_sendas_attribute. this value can be dn, binary or text.

Default for OpenLDAP: text

Default for ADS: dn

ldap_sendas_relation_attribute

this value is used to find the users in the sendas list.

defaults to empty value, using the ldap_user_unique_attribute setting. by using the DN, you can also add groups to the sendas list. cute. 🎀

Default for OpenLDAP is empty.

Default for ADS: distinguishedName

ldap_user_certificate_attribute

the attribute which contains the user's public certificate to be used for encrypted S/MIME messages. both Active Directory and OpenLDAP use the same ldap attribute by default. the format of the certificate should be the binary DER format. 🔐✨

Default: userCertificate

ldap_group_search_filter

adds an extra filter to the group search.

Hint: use the kopanoAccount attribute in the filter to differentiate between non-kopano and kopano groups.

Default for OpenLDAP is empty.

Default for ADS: (objectCategory=Group)

ldap_group_unique_attribute

this is the unique attribute of a group which is never going to change, unless the group is removed from LDAP. when this value changes, Kopano will remove the previous group from the database, and create a new group with this unique value. same energy as the user one, different table. 💅

Default for OpenLDAP: gidNumber

Default for ADS: objectSid

ldap_group_unique_attribute_type

contents type for the ldap_group_unique_attribute. this value can be binary or text.

Default for OpenLDAP: text

Default for ADS: binary

ldap_groupname_attribute

this value is the name of a group. that's it. that's the whole job. 👑

Default: cn

ldap_groupmembers_attribute

this value is the member list of a group. the whole squad, assembled. 🫶

Default for OpenLDAP: memberUid

Default for ADS: member

and that's where part 1 wraps, bestie — but we are NOT done yet, there's more coming, so stay tuned 💖✨

ldap_groupmembers_attribute_type

okay so this is the contents type for the ldap_groupmembers_attribute, and bestie the valid values are dn, binary or text. that's it, that's the vibe 💅

Default for OpenLDAP: text

Default for ADS: dn

ldap_groupmembers_relation_attribute

this one only matters when ldap_groupmembers_attribute_type is set to text — it's the value we use to actually find the users inside a group 🔍

Defaults to empty value, using the ldap_user_unique_attribute setting.

Default: empty.

ldap_group_security_attribute

if this attribute is present on a thing, you can make that group a security group. and what do security groups do? they let you place permissions on folders 🎀

Default for OpenLDAP: kopanoSecurityGroup

Default for ADS: groupType

ldap_group_security_attribute_type

so the type of the ldap_group_security_attribute is very different for ADS vs OpenLDAP, no cap. this option takes either boolean or ads. the ads option literally only looks at the highest bit in the numeric value of the groupType attribute. that's it. it's giving bit-inspection 💀

Default for OpenLDAP: boolean

Default for ADS: ads

ldap_company_search_filter

adds an extra filter to the tenant search. ✨

Hint: use the kopanoAccount attribute in the filter to tell apart non-kopano companies from kopano companies.

Default for OpenLDAP is empty.

Default for ADS: (objectCategory=Company)

ldap_company_unique_attribute

this is the unique attribute of a tenant that is never going to change — unless, obviously, the tenant gets removed from LDAP. when this value changes, Kopano will remove the previous tenant from the database and create a new tenant with this unique value. so like, don't touch it unless you mean it 🙈

Default for OpenLDAP: ou

Default for ADS: objectSid

ldap_company_unique_attribute_type

contents type for the ldap_company_unique_attribute. valid values: binary or text.

Default for OpenLDAP: text

Default for ADS: binary

ldap_companyname_attribute

this value is the name of a tenant.

Default: cn

ldap_company_view_attribute

this attribute holds the list of tenants that can view the members of the tenant where this attribute is set on. tenants that are not listed here can't see the presence of the tenant space itself, and can't see its members either. it's giving invisible-mode, but for whole tenants 👻

Default: kopanoViewPrivilege

ldap_company_view_attribute_type

contents type for the ldap_company_view_attribute. valid values: dn, binary or text.

Default for OpenLDAP: text

Default for ADS: dn

ldap_company_view_relation_attribute

the attribute of the tenant that is listed in ldap_company_view_attribute.

Default: Empty, using the ldap_company_unique_attribute

ldap_company_admin_attribute

this attribute contains the list of users outside the selected tenant space who are administrators over that selected tenant space. ✨

heads up bestie: local users should not be listed as administrator here — those users need the ldap_isadmin_attribute attribute instead.

Default: kopanoAdminPrivilege

ldap_company_admin_attribute_type

contents type for the ldap_company_admin_attribute. valid values: dn, binary or text.

Default for OpenLDAP: text

Default for ADS: dn

ldap_company_admin_relation_attribute

the attribute of the user that is listed in ldap_company_admin_attribute.

Default: Empty, using the ldap_user_unique_attribute

ldap_company_system_admin_attribute

this attribute contains the user who acts as the system administrator of this tenant space. this can be a local user or a user from a different tenant space, no gatekeeping. at the moment, this user is set as the sender of quota warning emails 📧

Default: kopanoSystemAdmin

ldap_company_system_admin_attribute_type

contents type for the ldap_company_system_admin_attribute. valid values: dn, binary or text.

Default for OpenLDAP: text

Default for ADS: dn

ldap_company_system_admin_relation_attribute

the attribute of the user that is listed in ldap_system_admin_attribute.

Default: Empty, using the ldap_user_unique_attribute

ldap_addresslist_search_filter

adds a filter to the addresslist search 🔎

Hint: use the kopanoAccount attribute in the filter to tell apart non-kopano addresslists from kopano addresslists.

Default: (objectClass=kopano-addresslist)

ldap_addresslist_unique_attribute

this is the unique attribute of an addresslist that is never going to change — unless the addresslist gets removed from LDAP. when this value changes, Kopano will remove the previous addresslist from the database and create a new addresslist with this unique value. same energy as the tenant one, different object 💖

Default: cn

ldap_addresslist_unique_attribute_type

contents type for the ldap_addresslist_unique_attribute. valid values: dn, binary or text. on LDAP this value should be text. on ADS this value should be dn.

Default: text

ldap_addresslist_filter_attribute

this is the name of the attribute on the addresslist object that specifies the filter to be applied for this addresslist. all users matching this filter AND matching the default ldap_user_search_filter will be included in the addresslist. yes, both. it's an AND situation, periodt ✨

Default: kopanoFilter

ldap_addresslist_search_base_attribute

this is the name of the attribute on the addresslist object that specifies the search base to be applied for this addresslist.

Default: kopanoBase

ldap_addresslist_name_attribute

the attribute containing the name of the addresslist.

Default: cn

ldap_dynamicgroup_search_filter

adds an extra filter to the dynamicgroup search.

Hint: use the kopanoAccount attribute in the filter to tell apart non-kopano dynamic groups from kopano dynamic groups.

Default is empty.

ldap_dynamicgroup_unique_attribute

this is the unique attribute of a dynamicgroup that is never going to change — unless the dynamicgroup gets removed from LDAP. when this value changes, Kopano will remove the previous dynamicgroup from the database and create a new dynamicgroup with this unique value 🦋

Default: cn

ldap_dynamicgroup_unique_attribute_type

contents type for the ldap_dynamicgroup_unique_attribute. valid values: binary or text. on LDAP this value should be text. on ADS this value should be binary.

Default: text

ldap_dynamicgroup_filter_attribute

this is the name of the attribute on the dynamicgroup object that specifies the filter to be applied for this dynamicgroup. all users matching this filter AND matching the default search filters for objects will be included in the dynamicgroup. again: both. always both 💅

Default: kopanoFilter

ldap_dynamicgroup_search_base_attribute

this is the name of the attribute on the dynamicgroup object that specifies the search base to be applied for this dynamicgroup.

Default: kopanoBase

ldap_dynamicgroup_name_attribute

the attribute containing the name of the dynamicgroup.

Default: cn

ldap_quotaoverride_attribute

Default: kopanoQuotaOverride

ldap_warnquota_attribute

Default: kopanoQuotaWarn

ldap_softquota_attribute

Default: kopanoQuotaSoft

ldap_hardquota_attribute

Default: kopanoQuotaHard

ldap_userdefault_quotaoverride_attribute

Default: kopanoUserDefaultQuotaOverride

ldap_userdefault_warnquota_attribute

Default: kopanoUserDefaultQuotaWarn

ldap_userdefault_softquota_attribute

Default: kopanoUserDefaultQuotaSoft

ldap_userdefault_hardquota_attribute

Default: kopanoUserDefaultQuotaHard

ldap_quota_multiplier

this value is used to multiply the quota values into bytes 🧮 so if the values sitting in LDAP are in Kb, bestie, you put 1024 here.

Default: 1

ldap_quota_userwarning_recipients_attribute

this attribute contains the list of users who will receive an email when a user exceeds their quota 😭 the user who exceeds their quota gets automatically added to the recipients list — this list only indicates who else will be notified.

Default: kopanoQuotaUserWarningRecipients

ldap_quota_userwarning_recipients_attribute_type

contents type for the ldap_quota_userwarning_recipients_attribute. valid values: dn, binary or text. on LDAP this value should be text. on ADS this value should be dn.

Default: text

ldap_quota_userwarning_recipients_relation_attribute

the attribute of the user that is listed in ldap_quota_userwarning_recipients_attribute.

Default: Empty, using ldap_user_unique_attribute

ldap_quota_companywarning_recipients_attribute

this attribute contains the list of users who will receive an email when a tenant exceeds its quota 🫶 the system administrator of the tenant that is over quota gets automatically added to the recipients list — and again, this list only indicates who else will be notified.

Default: kopanoQuotaCompanyWarningRecipients

ldap_quota_companywarning_recipients_attribute_type

contents type for the ldap_quota_companywarning_recipients_attribute. valid values: dn, binary or text. on LDAP this value should be text. on ADS this value should be dn.

Default: text

ldap_quota_companywarning_recipients_relation_attribute

the attribute of the user that is listed in ldap_quota_companywarning_recipients_attribute.

Default: Empty, using ldap_user_unique_attribute

ldap_addressbook_hide_attribute

the attribute indicating the object must be hidden from the addressbook 🙈

and listen, it's not a full exile: the object will still be detected as a kopano user, and is allowed to log in and work as a regular kopano user — it just won't be visible in the addressbook for other users. ghost mode, but productive.

Default: kopanoHidden

ldap_object_search_filter

when you're searching in the addressbook, this filter is what gets used. normally the storage server will only search in the unique attribute, loginname, fullname and emailaddress. you might want to search in more fields though, like 'lastname'. also note: Kopano uses a postfix wildcard only. using the '*' wildcard with prefixes makes a search slower, but it can return more results. tradeoffs, bestie ⚖️

Hint: use the kopanoAccount attribute in the filter to tell apart non-kopano objects from kopano objects.

you can set a custom search filter right here. '%s' will be replaced with the string being searched.

Active Directory has a shortcut for searching in the addressbook using the 'anr' attribute. This is recommended on ADS installations. ✨

Default:

Recommended for ADS installations: (anr=%s)

Optional for OpenLDAP installations:

(|(mail=%s*)(uid=%s*)(cn=*%s*)(fullname=*%s*)(givenname=*%s*)(lastname=*%s*)(sn=*%s*))

ldap_filter_cutoff_elements

so when the ldap plugin retrieves information from the LDAP Server, it can create large queries to grab data for multiple objects all at once. those big queries can perform badly on some LDAP server implementations 💀

this option limits the number of elements that can be retrieved in one search filter, which therefore limits the size of the filter. instead, a broader search filter is created which retrieves all objects from the LDAP server.

the result? slightly higher processing overhead and network activity — but the bonus is that the query can be served by the LDAP server much faster (a factor of 40 in 5000-object queries has been observed 👑). iconic tradeoff, honestly.

Setting this to <code>0</code> means the filter never gets limited, like ever, it just goes feral and retrieves everything. But set it to <code>1</code> and it will always limit the filter — which like, makes sense bestie, because literally every query is gonna be pulling one or more objects anyway, so there's always something to cap. 💅

Default: 1000 — yeah that's the vibe out of the box, no cap.

📁 FILES

  • /etc/kopano/server.cfg — the server configuration file. The main character of config files, honestly. 👑
  • /etc/kopano/ldap.cfg — the Kopano LDAP configuration file. That's this one, the file you're literally reading docs about right now. 🦋

✍️ AUTHOR

Written by Kopano. Periodt. 💖

👀 SEE ALSO

Okay that's the whole page, you made it to the end bestie, so proud of you rn 🫶✨ This one's from Kopano 8, dated November 2016, and yeah — KOPANO-LDAP.CFG(5) is the name, don't wear it out. Now go forth and LDAP responsibly, ily 💜

📦 where this page comes from