HOWTO: OpenGroupware.org with OpenLDAP

[joemc91]

This is just a howto based on my experiences getting opengroupware.org up and running (minus email, cause I can't seem to get the webmail portion to work). It will use OpenLDAP for authentication.

This guide is written for someone with little linux experience or just shallow experience, like myself.

Stuff you'll need that isn't automatically downloaded, or at least not in the portage tree yet:

The OpenGroupware.org ebuild and associated files: https://bugs.gentoo.org/attachment.cgi?id=30316&action=view
The latest ebuild file (rename it to opengroupware-0.2.1-r2): https://bugs.gentoo.org/attachment.cgi?id=31433&action=view

Recommended USE flags: "ldap, imap, apache2, sasl2, sasl, pam", some of these are most likely redundant, but I know they work.

Step 1, Install OpenLDAP:

I reccommend following the official OpenLDAP guide (http://www.gentoo.org/doc/en/ldap-howto.xml). The great thing about using OpenLDAP is you can configure opengroupware.org, cyrus, postfix, and the system to all authenticate off of it.

After getting OpenLDAP running according to the guide, open your slapd.conf file (usually in /etc/openldap/) and add the line


Code:

allow   bind_v2


This will allow opengroupware to bind to the server to authenticate a user.

Step 2, make sure the opengroupware ebuild file is ready

There have been a few cases the after downloading the latest ebuild file when running the emerge gives an error, usually a syntax error. There's a really simple fix, open the latest ebuild file in your favorite text editor and simply save it. That should do the trick.

Step 3, emerge opengroupware

Make sure ACCEPT_KEYWORDS="~x86". This step takes a decent amount of time.

Step 4, configure postgresql.conf

Open "/var/lib/postgresql/data/postgresql.conf" (or whereever your data directory is) in your favorite text editor.
Find the commented line #tcpip_socket = false. Uncomment it and change it to true: "tcpip_socket = true"
This will allow postgresql to listen for tcpip traffic

Step 5, start postgresql

You've got to do this manually.

Step 6, setup the opengroupware databases

Navigate to where you extracted your opengroupware folder to, mine's in /usr/portage/net-misc/opengroupware
configure the ebuild "ebuild opengroupware-0.2.1-r2 config" and watch the script make lots of tables.

Step 7, configure apache to load to opengroupware module

Add "-D OGo" to your apache opts (in /etc/conf.d/apache2 for those of you who are like me)

Step 8, configure opengroupware LDAP authentication

Open the NSGlobalDomain.plist file, usually in "/opt/opengroupware.org/.libFoundation/Defaults/NSGlobalDomain.plist" with your favorite text editor.
Add the following lines at the bottom of the file, but before the closing bracket:


Code:

LSAuthLDAPServer = "ldap.mydomain.com"; LSAuthLDAPServerRoot = "dc=mydomain,dc=com";


LSAuthLDAPServer is your ldap server's FQDN and LSAuthLDAPServerRoot is the LDAP root of your directory.

Step 9, create an LDAP root account for opengroupware

OpenGroupware normally authenticates to the passwd file and uses the root user to configure stuff. If you're using LDAP, you must create a root user in the LDAP database. I actually create the root LDAP user to have the same credentials as the standard root account so everything is through LDAP now. Create an .ldif file such as this:


Code:

dn: uid=root,ou=People,dc=mydomain,dc=com objectClass: organizationalPerson objectClass: top objectClass: posixAccount objectClass: shadowAccount uid: root uidNumber: 0 gidNumber: 0 sn: Root cn: Root homeDirectory: /root loginShell: /bin/bash gecos: Root


Add the person to the directory using


Code:

ldapadd -x -D "cn=Manager,dc=mydomain,dc=com" -W -f root.ldif"


This is assuming the in your slapd.conf file (in /etc/openldap/) has the setting


Code:

rootdn   "cn=Manager,dc=mydomain,dc=com"


Do NOT logout! Test this by trying to change the root's password. Instead of giving the generic password changed reply, it should respond "LDAP password information changed for root". If you want to you can comment out the root lines in both /etc/passwd and /etc/shadow and everything should be fine, the system will authenticate root against LDAP and still give the user root priveledges. I don't reccomend deleting any lines so it's recoverable if ldap fails.

Step 10 (optional), set autologin for IMAP

Open the NSGlobalDomain.plist file again and add the following lines at the bottom:


Code:

imap_host = "imap.mydomain.com"    UseSkyrixLoginForImap = YES;

Step 11, it works! We hope

Start postgresql (if not still running), opengroupware, and apache2
Navigate to "http://ogo.mydomain.com/OpenGroupware" in your webbrowser and login as root, should work now!
Please note that you should not use the OpenGroupware user manager to create users this way, though it's good to set permissions this way. If you want a graphical user manager, I personally like phpldapadmin. It's currently masked as unstable, but it runs great and is extremely easy to setup and use.

Notes:

Postfix
Postfix works great with OpenGroupware, especially with authentication is done against OpenLDAP. To configure Postfix to allow delivery to LDAP users, add this code


Code:

alias_maps = hash:/etc/mail/aliases, ldap:ldapsource ldapsource_server_host = ldap.mydomain.com ldapsource_search_base = dc=mydomain,dc=com ldapsource_bind = no #the following enables authentication and sets security so non-local hosts can relay as long as they're authenticated smtpd_sasl_auth_enable = yes smtpd_sasl2_auto_enable = yes smtpd_sasl_local_domain = $myhostname smtpd_sasl_security_options = noanonymous broken_sasl_auth_clients = yes   #for those poor souls using Outlook smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, check_relay_domains #for those of you using cyrus imap, add the following, but you probably already knew this mailbox_transport = cyrus


Adding "ldap:ldapsource" to the alias-maps will tell Postfix to look up users in LDAP as well as the standard user file. The ...server_host and ...server_base tell postfix where to find the LDAP server and in which directory to start the search for users. SASL auth is enabled to allow users to authenticate to relay. This will have postfix authenticate the users against SASL, which will in turn authenticate against LDAP.

Cyrus-IMAPD
Cyrus is supposed to play well with OpenGroupware, it is actually the recommended imap server. Unfortunately, I have not been able to get OpenGroupware to work with it. The OpenGroupware program throws an exception whenever it tries to access a user's mailbox, I do not know why this is. Hopefully the problem will be fixed soon. Here's a quick HOWTO to make Cyrus auth against LDAP and automatically create mailboxes when an authenticated user accesses IMAP. This means that all you have to do is create the user and the software does the rest!
First, you must use the modified ebuild available here https://bugs.gentoo.org/show_bug.cgi?id=47803. Make sure you download the specified patch and place it in your cyrus-imapd/files folder in the portage tree. After setting Cyrus up and doing the initial configuration of imapd.conf, add/change these settings in the file


Code:

allowplaintext:      yes sasl_pwcheck_method:   saslauthd   #allows use of PAM authcreatequota:   -1      #no maximum number of folders created, but autocreation allowed autocreateinboxfolders: Sent | Drafts | Trash | Junk


To enable imap to authenticate off of LDAP, add these lines to the TOP of your /etc/pam.d/imap file


Code:

auth      sufficient   /lib/security/pam_ldap.so account      sufficient   /lib/security/pam_ldap.so

I hope this howto was helpful!

[_GeG_]

This is what I had to change to get it running, maybe it helps someone:

[dashnu]

I cant emerge opengroupware.

I downloaded the latest and greatest stuff and I get the following errors

[dashnu]

Ok think i got past that I added it to /usr/portage/net-misc/opengroupware
Than echo "net-misc/opengroupware ~x86" >> /etc/package.keywords

Than tried a emerge net-misc/opengroupware

and it blew up on me

[veurits]

[dashnu]

I got it to work but I did not use the ebuild. I downloaded the source. I however can not bind to our mail server. I can send e-mail but I can not "login" through the opengroup app. wierd
_________________
write quit bang

[kyler]

I seem close to having the opengroupware-0.2.1-r2 ebuild work... after dos2unixing the ebuild file as well as having to run -

[dashnu]

This is my configured one, not sure if it will help ya.

/opt/opengroupware.org/WOApps/OpenGroupware.woa/Resources/English_kde.lproj

[dashnu]

any ideas on how to connect from other computers on the net would be great. I can only connect through the localhost.

I have tried the following my apache2.conf

[kyler]

I'm making a bit more progress on my missing English_kde.lproj/components.cfg file.... It looks like my Defaults.plist in WebUI/ says to make English_kde but there is no English_kde dir there... i'm going to try and hack the ebuild to maybe copy one of the other .lproj dirs - perhaps the opengroupware guys removed the *_kde stuff recently so I just need to update my ebuild to use English_orange.lproj instead of English_kde.lproj
-----

[kyler]

>>> net-misc/opengroupware-0.2.1-r3 merged.

sweet... ok so this is a total hack, and i'm not sure if the thing even works yet, but hey at least it completed a merge. Basically i just patched the ebuild so _kde/English_blue is replaced with _OOo/English_orange in the WebUI Defaults.plist file and OGo.make... ugly but worked so i'll make it pretty later after I test my merged opengroupware.
If anyone else is having trouble with the merge, this is the current workaround -
I had to cp opengroupware-0.2.1-r2.ebuild opengroupware-0.2.1-r3.ebuild and add the following lines after

[Carbs]

I found that I had to manually emerge sudo otherwise the ebuild...config didn't work.

[will_in_wi]

I tried to install and got all the way to the end. I have one problem. When I connect to the server via web, I hit this:

[cweiske]

It seems to me that the sources are not available at the place described in the ebuild.
Furthermore, the sources don't contain a configure script any more.

Does somebody have a new ebuild?

[Haldir]

use either the forum search or the bugzilla search

[chous]

[dirtbag]

* checking ebuild checksums ... [ ok ]
* checking auxfile checksums ... [ ok ]
* checking miscfile checksums ... [ ok ]
* checking gnustep-make-1.12.0.tar.gz ... [ ok ]
i686-pc-linux-gnu-gcc: /var/tmp/portage/net-misc/opengroupware-1.1.6/temp/objc_t est.m: Objective-C compiler not installed on this system
* ObjC Compiler is missing. Please re-emerge gcc with USE="objc"

!!! ERROR: net-misc/opengroupware-1.1.6 failed.
Call stack:
ebuild.sh, line 1630: Called dyn_setup
ebuild.sh, line 702: Called qa_call 'pkg_setup'
ebuild.sh, line 38: Called pkg_setup
opengroupware-1.1.6.ebuild, line 94: Called die

!!! (no error message)
!!! If you need support, post the topmost build error, and the call stack if rel evant.
!!! A complete build log is located at '/var/tmp/portage/net-misc/opengroupware- 1.1.6/temp/build.log'.



so do I really gotta re-emerge gcc with USE="objc" ?!

-db