> Could somone using the mod_shared_roster_ldap paste the part of his ejabberd.cfg please ?
> I'm looking for explanations about this modules, but I can't find any.
Finally, I got it working with OpenLdap.
After spending some times looking at the debug output of openldap, and trying blindly some parameters in mod_shared_roster_ldap, I figured out how it works.
Here are the parameters :
- ldap_groupattr : This is the attribute that holds the groups names, and that is used to differentiate them. (cn=technical | cn=sales | cn=external)
- ldap_groupdesc : Not used in my case. Whatever was the value, it always worked.
- ldap_memberattr : the attribute that contains the ID of the members of these groups. In my case, my groups are posixGroup objectClass, and with posixGroup, "memberUid" is used to contain the ID of the members.
If you use groupOfName, it should be "member=uid"
If you use groupOfUniqueNames -> "uniqueMember=uid"
Not 100% sure for the 2 lasts, not tried. Have a look at your schemas.
- ldap_filter : The search filter you want to apply. If you don't want it, set "[ldap_memberattr]=*". It is mostly here for outlook ldap schemas compatibility.
Now we have something like :
When a user logs in, 2 ldap search are performed :
The first one returns the groups that the user belongs to.
SRCH base="o=E-Group,dc=electronic-group,dc=com" scope=2 deref=0 filter="(&(&(memberUid=test)(cn=*))(memberUid=*))"
the first criteria is [ldap_memberattr]+[ejabberd_user]
the second is [ldap_groupattr]+*
the third is [ldap_filter]
The second one returns the members of the groups returned by the first search.
You can see that the second search criteria is replaced with the name of the group.
SRCH base="o=E-Group,dc=electronic-group,dc=com" scope=2 deref=0 filter="(&(&(memberUid=*)(cn=egroup))(memberUid=*))"
Finally, this is pretty sweet because you can create groups with everything. For instance, my users are in :
I just have to set ldap_groupattr to the location_name attribute : "l" ; and ldap_memberattr to "uid", and my roster will contains all users of my location.
Drawbacks : A much longer login time. The modules makes a lot of identical ldap search. It takes up to 15 seconds.
Sorry for the bad english.
If you have problems, it is good to use ldapsearch or the phpldapadmin search function, to look at the output of your search criteria.
PS : Now I am looking to display groups that I am not part of (so I could see users that are not in the same location than me for instance)