On Thu, Jan 08, 2015 at 02:48:47PM +0100, hum...@pasteur.fr wrote:
> Hello Timo,
> a) should I
>
> . change the driver of the first passdb from passwd-file to ldap
> . for user to be rejected, add an LDAP attribute named "foo" with a value of
> "yes" and map it with something like this :
>
> pass_attrs = ....,foo=deny in dovecot-ldap.conf.ext ?
>
This doesn't seem to work but maybe am I misunderstanding the logic :
I thought that in the passdb{} section of auth-deny.conf.ext, you could comment
"deny = yes" as long as the passdb returned an extra_field mapped on "deny"
with the value of "yes" for users you'd want to deny access to: is that the
case ?
Maybe it's just something like : "if user is found in passdb but "deny =
yes" is not stated in the passdb{} section, then access is granted ?
> b) or could I use only one ldap passdb by changing the pass_filter
>
> from
>
> pass_filter = (&(objectClass=posixAccount)(uid=%u))
>
> to something like
>
> pass_filter = (&(objectClass=posixAccount)(uid=%u)(!foo=yes))
>
> ?
This is working but I don't know if this is the recommended way of doing it.
Thanks.
--
Thomas Hummel | Institut Pasteur
<hum...@pasteur.fr> | Groupe Exploitation et Infrastructure
