Dear developers,

Can i pay you to implement this feature? How much?

@zhb

If you didn't already, use https://sogo.nu/support/index_new.html#/commercial for such requests ;-)

Is there already an update regarding this issue? I am intersted in this as well.

I can understand having a dynamic baseDN but is a dynamic bindDN really useful?

We currently have bindAsCurrentUser has an option in SOGo.

So the bindDN can be used on the 'root' of the source to actually perform an initial lookup in case bindFields are being used.

Are you NOT using bindFields?

We can use bindAsCurrentUser instead of dynamic bind dn. The most important parts are base dn and ldap filter.

So I guess %s and %u don't make sense either.

We need %s and %u also, especially in ldap filter.

What do you mean by ldap filter?

Oops, i mixed SOGo with another use case. Sorry about this.
I think %d (domain) is enough for now.

The feature was implemented. baseDN now accepts %d as a placeholder. Please give a try to the upcoming nightly builds (available in 24 hours from now).

Thanks very much. :)

Placeholder (%d) in base DN doesn't work with SOGo nightly build: 4.0.5.20190210-1.

Tested with SOGoUserSources below, it doesn't work. According to OpenLDAP log, the query base dn is "domainName=%d,o=domains,dc=a,dc=io", that means placeholder "%d" was not replaced by real domain name at all. When i remove "domainName=%d," and restart sogo service (all other settings are same), webmail login works fine.

OS: Ubuntu 18.04
OpenLDAP: 2.4.45
SOGo nightly build: 4.0.5.20190210-1

SOGoUserSources = (
    {
        type = ldap;
        canAuthenticate = YES;
        isAddressBook = NO;
        displayName = "LDAP Authentication";

        hostname = "ldap://127.0.0.1:389";
        baseDN = "domainName=%d,o=domains,dc=a,dc=io";
        bindDN = "cn=vmail,dc=a,dc=io";
        bindPassword = "f70c8f378fa49c3684b84637d790da37";
        filter = "objectClass=mailUser AND accountStatus=active AND enabledService=mail AND enabledService=sogo";
        scope = SUB;

        bindAsCurrentUser = YES;

        // The algorithm used for password encryption when changing
        // passwords without Password Policies enabled.
        // Possible values are: plain, crypt, md5-crypt, ssha, ssha512.
        userPasswordAlgorithm = ssha512;

        CNFieldName = cn;
        IDFieldName = mail;
        // value of UIDFieldName must be unique on entire server
        UIDFieldName = mail;
        IMAPLoginFieldName = mail;
        MailFieldNames = (mail);
        bindFields = (mail);
    },

Could you implement %s (full login name) and %u (username part in email address) also? so that we can narrow down the base dn to user account itself, it will help improve ldap query performance. for example:

baseDN = "mail=%s,ou=Users,domainName=%d,o=domains,dc=a,dc=io";

I'm sorry that this issue was reported long time ago and i didn't remember all use cases. :(

Which OS are you testing on? You tested a nightly build (Feb 2nd) and the code landed 2 days AFTER that so it's normal it doesn't work.

It makes NO sense to use mail=%s - that's the base of SOGo for all queries so it'll miserably for example in the shared address book. As said before, use bindAsCurrentUser.

Dear Ludovic,

• OS: Ubuntu 18.04 LTS.
• SOGo version: 4.0.5.20190210-1 (I suppose this version was packed on Feb 10 - 6 days after your commit).

About base dn "mail=%s,ou=Users,domainName=%d,o=domains,dc=xx,dc=xx", this is the best option if we can have for user authentication (with scope set to BASE), not for per-domain or global address book.

By the way, we use 2 sections in SOGoUserSources, one for user authentication, one for per-domain address book.

For the user authentication, we hope to narrow down the LDAP search base dn, this way we can get best performance due.

For the per-domain address book, we use "domainName=%d,o=domains,dc=xx,dc=xx" to build dynamic base dn (with ACL in OpenLDAP config file as well).

The baseDN can NOT contain a user part as it is used everywhere in SOGo where there's no context of a user.

I see no reason why the baseDN's %d wouldn't work - the code is there, I use it and it works.

Dear Ludovic,

I tested again today, it does NOT work.

• OS: Debian 9
• SOGo: 4.0.5.20190213-1
• SOGoUserSources setting in sogo.conf: https://pastebin.com/xjDinJNe

Neither user authentication nor global (per-domain actually) address book works.
If i remove "domainName=%d," from baseDN, it works.

Could you help double check? I believe there's something wrong in the code.
Also, could you implement the %s placeholder for testing? If it doesn't work, let's remove %s before final release. Please.

I think I know what happens - the domain must not be extracted properly in your configuration while it is on mine. I'll do more testing tomorrow and push a fix.

Dear Ludovic,

Thanks for the reply.

Please also be so kind to implement '%s' support in baseDN, at least give me a chance to test it, i believe it works. If it doesn't, we can remove it before final release 4.0.6.

Try the upcoming nightly build which will be available in 24 hours from now.

Tested with SOGo 4.0.5.20190215-1 on Debian 9, %d works in baseDN for user authentication, but NOT for separated global address book.

Also, could you implement the %s placeholder (for user authentication) for testing? If it doesn't work, let's remove %s before final release. Please please please.

What do you mean by separated global address book?

Also, %s CANNOT be implemented, as I said earlier, we do not have the user's context all the time.

I see what you mean in your previous comment. I pushed a fix for that and it works. Please test the nightly builds that will be available in about 16 hours from now.

%d doesn't work in separated ldap address book. Full SOGoUserResources here:
https://pastebin.com/5pq0Nbjx

Note:

• %d works for user authentication (canAuthenticate = YES; isAddressBook = NO;).
• %d does NOT work for ldap address book (canAuthenticate = NO; isAddressBook = YES;).

Tested with SOGo 4.0.5.20190221, nightly build.

That's normal for now, the domain is changed ON THE FLY when the user authenticates.

I don't get it.

After successfully logged in, the login username (full email) is fixed, so that %d should be always expanded to the domain part of login user's email address. Why is it changed on the fly?

Because the authentication source is created once, upon SOGo's startup and reused over time. It is a singleton.

I understand that the latest SOGo release works this way, but can we re-build baseDN each time when we need to query ldap address book? This is the real DYNAMIC base dn, and it's the best per-domain global address book we can get with the flexible LDAP query, and get rid of the "Multi-domains Configuration" which requires updating sogo.conf manually and restart sogo daemon service.

Please please please, help implement this flexible ldap address book.

Dear @ludovic,

Any update / comment?

The baseDN is associated with an authentication source.

I'll check if it's possible to change the code, early next week.

Thanks for the reply.

I believe it's ok, because there're many applications which support placeholders like this while querying LDAP, for example, Roundcube webmail. :)

Dear Ludovic,

Any update about this change?

Yes I found a way to do it but it requires many changes which should be done by the end of the week.

Thanks Ludovic. Let me know when it's ready and i will test it ASAP. :)

Try the upcoming nightly build.

It works. Thanks. :)