Custom Mapping map uid to altname

EureGraueKompetenz

Hello,
since it is possible to add alternative names to users, I was wondering if it is possible to map the LDAP UID to the alternative name via ‘Custom Mapping’ since the Admin UI states that the alternative names will be overwritten with the next LDAP sync

I know that ‘altnames’ is a list, as it can contain more than one alternative name.
What should the mapping look like?
Name: altnames -> Value: uid does not seem to work.
Same goes for: Name: altnames[1] -> Value: uid and Name: altname -> Value: uid

Has anyone already managed to do this?

crpb

EureGraueKompetenz I know that ‘altnames’ is a list, as it can contain more than one alternative name.

i don't think that is possible.

ckd

I tried doing something similar in the past:
https://community.grommunio.com/d/1563-active-directory-ldap-custom-mapping-unable-to-map-certain-fields

I think the problem is related to special maps, since there is no MAPI tag for ALTNAMES.
grommunio-admin taginfo '*'

That's probably the reason why it won't work.

I was using Kopano for many years and I was used to login using the UID instead of MAIL, similar to AD which uses sAMAccountName / userPrincipalName.

EureGraueKompetenz

ckd

Thanks. That helped a lot or at least it will save me my time as i don't need to put more effort into research.

ckd I was using Kopano for many years and I was used to login using the UID instead of MAIL, similar to AD which uses sAMAccountName / userPrincipalName

yeah. I had the hope my users would also be able to login with their UID into the webmail client just as they used to from Open-Xchange

ckd

EureGraueKompetenz
If you don't have too many users, you should still be able to set the ALTNAME manually -- which should not be overwritten by LDAP sync.

TGM

EureGraueKompetenz

for the WebApp you could use this:

        // Defines the default domain of email addresses to login with
        // If this is set, you can login with only the user part of an email.
        // Examples: define("DEFAULT_DOMAIN", "example.com");

You can configure this in /etc/grommunio-web/config.php then you do not need an alternative name for the web app, that the user can use it with their UID.

EureGraueKompetenz

ckd
True.
Just tought there might be a more elegant solution 🙂

crpb

fwiw, as similiar things bugged me in the past i opened an issue
https://github.com/grommunio/admin-api/issues/62
and during that i found some oddities 😆
https://github.com/grommunio/admin-api/issues/61

EureGraueKompetenz

crpb
#61 seems to be a feature.
Were you able to assign this to multiple users? So that everyone can log in only with their own password? ^^

And thank you for making a bugreport in #62
I think this is a missing feature as the ui clearly says that the altnames will be overwritten by the ldap sync.

TGM

Yeah, that would partially solve the problem.
But the LDAP UID does not necessarily have to be <FirstameFirstletter>.<Surname>, it could also be <Surname><FirstnameFirstletter>.
Example:
j.doe@domain.tld should be able to log in with ‘doej’ if that is his LDAP UID.

crpb

some companies are just using their employee number or whatever as a login. otherwise the users are wining when they get un/married and the name changes 😆.

EureGraueKompetenz Were you able to assign this to multiple users? So that everyone can log in only with their own password? ^^

hehe, luckily that is prevented by the database layout 😛

# grommunio-admin user modify cb@clownflare.de --altname "$(printf '\t')"
...
# grommunio-admin user modify server@clownflare.de --altname "$(printf '\t')"
An error occurred: IntegrityError('(MySQLdb._exceptions.IntegrityError) (1062, "Duplicate entry \'\\t\' for key \'altname\'")').
# mysql --table grommunio <<< "DESCRIBE altnames"
+---------+------------------+------+-----+---------+-------+
| Field   | Type             | Null | Key | Default | Extra |
+---------+------------------+------+-----+---------+-------+
| user_id | int(10) unsigned | NO   | PRI | NULL    |       |
| altname | varchar(320)     | NO   | PRI | NULL    |       |
| magic   | int(10) unsigned | NO   |     | 0       |       |
+---------+------------------+------+-----+---------+-------+

fwiw, the magic number 99 is for ldap from what i could make out but sadly nothing more.
https://github.com/grommunio/admin-api/blob/730814f1b62eff1b385899b239c336931fe5e8ef/res/openapi.yaml#L5510-L5522
https://github.com/grommunio/admin-api/blob/730814f1b62eff1b385899b239c336931fe5e8ef/orm/users.py#L925-L938