Univention 5.0.6 - LDAP Integration Issues

mllockwood

I am using Univention 5.0.6 for Active Directory/LDAP in my home/family LAN and Grommunio 1.14.2 Web UI 2.8.0-27-g33630e9 for our email services. I am wanting to integrate Grommunio in to the Univention LDAP for user authentication. The LDAP connection between Grommunio and Univention was successful, but since I already have users in Grommunio, I receive a "400 User already exists locally" for my email users when the sync task is performed.

So, I created a second Grommunio server using the appliance (fresh/clean install) and performed the same LDAP connection. This time, the users from Univention were imported in to Grommunio and their information was populated. However, when accessing the webmail interface, I am unable to login as any of the users (tried username and also tried full email address). I receive an invalid password error.

Question 1: Is there a way to sync LDAP users to my primary Grommunio server even though the same users are already active on that server? Or, do I have to delete the user and then re-import them? If so, how do I go about saving their emails so that they are not lost?

Question 2: Has anyone actually been able to login using LDAP crendentials from Univention? I have seen a few discussions on this forum that seem to explain the same issues I'm experiencing. (https://community.grommunio.com/d/96-ldap-user-no-login-possible/2)

Thanks!

WalterH

mllockwood login using LDAP credentials from Univention?

If Univention LDAP uses a certificate (Port 636) yo need to modify the file /etc/openldap/ldap.conf and add this line: TLS_REQCERT allow this solves the certificate issue.
If you have local users, it is possible to reimport an LDAP user with same mail address, the reimport converts the local user to an LDAP user.

mllockwood

The LDAP connection between Grommunio and Univention appears to be successful. However, when I do the import, all I receive are errors indicating the user already exists (they are not being converted to LDAP users).

Also, I am running the Community version of Grommunio with a 5 user limit. Is there a setting in LDAP/Univention that I can modify to indicate which users are to be imported and which are not?

WalterH

mllockwood Is there a setting in LDAP/Univention that I can modify to indicate which users are to be imported and which are not?

You may create a LDAP filter based on a flag or other condition.
But if you only have 5 users, browse to DOMAINS - <your domain> - Users - SEARCH IN LDAP and search for the requested user and import only this user. With this method, I re-imported LDAP users today.

externa1

mllockwood

You can add a group where you put the users you may have to be synced and set the ldap filter for that group
like i use:

(&(objectClass=posixAccount)(memberof=cn=grommuniogrp,cn=groups,dc=intern,dc=domain,dc=tld))

rg
Christian

mllockwood

That process worked for importing existing individual users from LDAP over to Grommunio. Thank you!

I imported a single user and it is now synchronized with LDAP. However, that user is now unable to login to the web interface. I tried logging in with just "username" and I also tried logging in as "username@domain.com" with the user's Windows/AD/LDAP password. But, every variation I tried with a working/known password is not working.

mllockwood

I checked the zcore log, and am seeing LDAP connection errors when I attempt to login.

ldap_start_tls_s: Connect error
ldap_adaptor: search with base "cn=users,dc=xxxxxxxx,dc=lan" filter "mailPrimaryAddress=xxxxx@xxxxxxxx.xxxxx": Can't contact LDAP server

What would prevent Grommunio from being able to connect to my LDAP server for password authentication, but connects successfully when importing a user?

WalterH

mllockwood What would prevent Grommunio from being able to connect to my LDAP server for password authentication,

You may try to add TLS_REQCERT allow as described above.

mllockwood

I reconfigured the LDAP connection settings, unchecking "StartTLS" and now it works!!!

🙂

mllockwood

externa1 Perfect, I will give this a try. Thank you!