September 27, 2004

LDAP Aliases working in Sendmail

It takes a bit of work, but I’ve got a working sample of the alias map in LDAP for sendmail.

Trying to debug this is difficult. It appears that within the ALIAS_FILE LDAP definition one cannot have anything besides the -k and -v options (I was hoping to restrict it to a subtree using -b, but adding a -b caused M4 to make a CF file that seemed to indicate an alias file with the value of -b). It also interacts strangely with LDAP routing.

In any case, I’ve found the following LDIF will produce a proper object:

dn: cn=ALIAS, ou=Aliases, dc=example, dc=edu
objectClass: top
objectClass: groupOfUniqueNames
objectClass: mailrecipient
objectClass: mailGroup
cn: ALIAS
mail: ALIAS
mail: ALIAS@example.edu
mailRoutingAddress: ALIAS
mgrpRFC822MailMember: recipient1
mgrpRFC822MailMember: recipient2

Both of the mail attributes are required for both the local and esmtp mailers to work right (i.e., this is the part where LDAP routing can bit you). The recipients in the mgrpRFC822MailMember attributes can be local recipients (without the @domain) or full addresses for aliases that forward off-site.

With this in place, the following in the MC file can be used:

  • define(`confLDAP_DEFAULT_SPEC’, `-h directory.earlham.edu -b ou=Aliases,dc=example,dc=edu -d uid=search,ou=Administrators,ou=TopologyManagement,o=NetscapeRoot -P /etc/mail/ldappass’)
  • define(`ALIAS_FILE’, `ldap:-k (&(objectClass=mailGroup)(mail=%0)) -v mgrpRFC822MailMember’)
  • FEATURE(`ldap_routing’, `ldap -1 -T -b dc=example,dc=edu -v mailHost -k (&(objectClass=mailrecipient)(mail=%0))’,`ldap -1 -T -b dc=example,dc=edu -v mailRoutingAddress -k (&(objectClass=mailrecipient)(mail=%0))’,`reject’,`preserve’)

The default LDAP spec needs to have the base DN for searches added to it, and in our case it can be restricted to the aliases subtree since the LDAP routing feature will have a different base DN specified (in this case the whole subtree because wee need to be able to hit both the People and Aliases subtrees, and we can be pretty certain that no other subtrees will have any objects that match).

Posted by Rowan Littell at September 27, 2004 02:55 PM