On Sun, Mar 17, 2013 at 11:12:00PM +0100, Patrick Lists wrote:
> Hi Victor,
>
> On 03/17/2013 07:38 PM, Viktor Dukhovni wrote:
> >
> >Keep in mind that there are many different LDAP email schemas and
> >yours may keep the additional email addresses of each user in an
> >differently named attribute. The "mailDeliveryAddress" attribute
> >is taken from one popular schema (assuming I remembered the attribute
> >name correctly).
>
> Figured that out when I could not find the "mailDeliveryAddress"
> attribute in the schemas present in my OpenLDAP config:
>
> Googling around I found a small postfix.schema and used the
> "maildrop" attribute which works fine using this
This may not be the right choice. The schema that uses "maildrop"
IIRC typically uses:
mail: primary address
mailalternateaddress: secondary addresses (may include primary)
maildrop: delivery mailbox
It is generally wrong to rewrite "maildrop" to mail, because maildrop
is not "another" address for the same user, it is rather where their
mail is rerouted to, may be shared for multiple users (often system
accounts ...).
How do you manage users who have multiple email addresses? You should
avoid domain to domain rewrites, and for each user list all the
valid addresses. Read:
http://tools.ietf.org/html/draft-lachman-ldap-mail-routing-03
where "maildrop" is called "mailRoutingAddress".
> /etc/postfix/ldap-canonical.cf:
>
> server_host = ldapi://%2Fvar%2Frun%2Fldapi
> bind = yes
> bind_dn = cn=Manager,dc=example,dc=org
> bind_pw = 1234
> search_base = ou=hosted,dc=example,dc=org
> version = 3
> scope=sub
> query_filter = mail=%s
> result_attribute = maildrop
>
> Thanks again for your help.
The canonical mapping has to match the actual process for managing
your user addresses. Use the right attributes and define their
semantics clearly.
--
Viktor.
