Docker-mailserver: LDAP

[georgehrke]

I think it would be a huge enhancement if one could simply link a docker container containing a LDAP server against the docker-mailserver container and use existing LDAP accounts instead of config/postfix-accounts.cf while preserving the alias capabilities. :)

[tomav]

This will be a mix of configuration file and external authentication. Could be strange to maintain but should work.
Dovecot supports LDAP authentication: http://wiki2.dovecot.org/AuthDatabase/LDAP

Are you planning to work on it?

[tomav]

@georgehrke let us know please. Thank you.

[georgehrke]

Sorry, somehow missed your first answer.

I would just be a nice enhancement but really not something that's mandatory for me.
Given that I'm running short on time right now and that I'm no expert in this topic I'll probably not be able to work on this anytime soon.

[kopax]

+1 for this feature. I am also looking to add this feature. I don't have experience with mail server yet, but I can help you.

[kopax]

I will check what's the content of V2 update and how to migrate on it and then work on the LDAP optional feature.

I will implement it on v1 and wait for more v2 information migration

[omigeot]

Just my 2 cents here, but I just discovered your project while trying to build something similar. On the "external userdb" front (e.g. LDAP), I was thinking about adding a thin layer of abstraction between LDAP and the mail services.

Both Postfix and Dovecot are more or less able to get their userdatabases from either shell-scripts/commands and/or simple telnet-like services. Given that, wouldn't it be better to implement that kind of support in docker-mailserver, and then let external userdb/auth be pluggable?

For instance, dovecot/postfix could talk to another container, which would in turn be able to either : ask LDAP, read local file, ask SQL db, ...

[tomav]

Yep, I think only connector should go in docker-mailserver and use external pre-existing LDAP (or equivalent) images.

[omigeot]

Pluggability has an added advantage : it'd allow to plug non-docker user sources. Think "pre-existing LDAP/AD", "owncloud SQL db", ...

[kopax]

As I told @tomav here, I have already implemented and test ldap.
I will now submit a PR with LDAP, somebody needs to take care of the regression tests and documentation.

PR: https://github.com/tomav/docker-mailserver/pull/251

[citec]

We could add and environment var to define which auth method will be used and the start script would set everything up.
For me is almost mandatory to have a db of users and aliases so an external database container would be great. This way each deployment will have the auth method that suits its needs and, for example, no more container restarts when adding an email account. Also external db would allow the use of GUIs for managing users

[kopax]

@citec, what do you mean?
Two containers, one for mailserver, second for managing users accounts ?
This is exactly what we are talking about by adding authentication through LDAP using a different postfix configuration.
LDAP is an ISO database for distributed directory information services over an Internet Protocol.
https://en.wikipedia.org/wiki/Lightweight_Directory_Access_Protocol

[citec]

no, I mean to specify, by using env vars, when the user accounts are stored. Give different options to user. For example I don't use ldap, but I would like to use mysql or postgres. @tomav likes more files and you like ldap, so all of us can use the stack, but each one of us use different user account storage.
ldap container can be external, not in the project, mysql too, no need to be local, but also possible if user wants to be.