kopano-core/doc/kopano-ldap.cfg.5

'\" t
.\"     Title: kopano-ldap.cfg
.\"    Author: [see the "Author" section]
.\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
.\"      Date: November 2016
.\"    Manual: Kopano Core user reference
.\"    Source: Kopano 8
.\"  Language: English
.\"
.TH "KOPANO\-LDAP\&.CFG" "5" "November 2016" "Kopano 8" "Kopano Core user reference"
.\" -----------------------------------------------------------------
.\" * Define some portability stuff
.\" -----------------------------------------------------------------
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.\" http://bugs.debian.org/507673
.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.ie \n(.g .ds Aq \(aq
.el       .ds Aq '
.\" -----------------------------------------------------------------
.\" * set default formatting
.\" -----------------------------------------------------------------
.\" disable hyphenation
.nh
.\" disable justification (adjust text to left margin only)
.ad l
.\" -----------------------------------------------------------------
.\" * MAIN CONTENT STARTS HERE *
.\" -----------------------------------------------------------------
.SH "NAME"
kopano-ldap.cfg \- The Kopano LDAP configuration file
.SH "SYNOPSIS"
.PP
\fBldap\&.cfg\fR
.SH "DESCRIPTION"
.PP
The
ldap\&.cfg
is a configuration file for LDAP user plugin\&. All options to correctly retrieve user and group information can be set here\&.
.SH "FILE FORMAT"
.PP
The file consists of one big section, but parameters can be grouped by functionality\&.
.PP
The parameters are written in the form:
.PP
\fBname\fR
=
\fIvalue\fR
.PP
The file is line\-based\&. Each newline\-terminated line represents either a comment, nothing, a parameter or a directive\&. A line beginning with `#\*(Aq is considered a comment, and will be ignored by Kopano\&. Parameter names are case sensitive\&. Lines beginning with `!\*(Aq are directives\&.
.PP
Directives are written in the form:
.PP
!\fBdirective\fR
\fI[argument(s)] \fR
.PP
The following directives exist:
.PP
\fBinclude\fR
.RS 4
Include and process
\fIargument\fR
.sp
Example: !include common\&.cfg
.RE
.PP
\fBpropmap\fR
.RS 4
Propmap delivers the capabilities to map additional attributes to addressbook properties (e\&.g\&. firstname, lastname, telephonenumber)\&.
.sp
In the propmap the configuration names must be the hex property tag of the requested property\&. The value given to the configuration name must be the LDAP attribute to which the property should be mapped\&.
.sp
Example: !propmap ldap\&.propmap\&.cfg
.RE
.SH "EXPLANATION OF EACH PARAMETER"
.PP
\fBldap_host\fR
.RS 4
The hostname or ip\-adress of the LDAP server\&.
.sp
Default:
\fIlocalhost\fR
.RE
.PP
\fBldap_port\fR
.RS 4
The port number of the LDAP server\&. LDAP normally runs on port 389\&.
.sp
Default:
\fI389\fR
.RE
.PP
\fBldap_protocol\fR
.RS 4
The protocol to be used to connect to the LDAP server\&. Can be either \*(Aqldap\*(Aq or \*(Aqldaps\*(Aq for SSL connections\&. You will probably have to specify port 636 for ldap_port also\&. Kopano will not use STARTTLS for such an SSL connection but instead will connect directly to an SSL encrypted port\&.
.sp
Default:
\fIldap\fR
.RE
.PP
\fBldap_uri\fR
.RS 4
Instead of using ldap_host, ldap_port and ldap_protocol, you may also use ldap_uri which should specify the URI of the LDAP server like \*(Aqldap://server:389\*(Aq\&. If ldap_uri is set, the values of ldap_host, ldap_port and ldap_protocol are ignored\&. You may also specify multiple space\-separated LDAP server URI\*(Aqs\&.
.sp
Default:
.RE
.PP
\fBldap_server_charset\fR
.RS 4
The charset that the LDAP server uses to store strings\&. All strings sent to the LDAP server or retrieved from the server will be interpreted in this charset\&. In most setups, utf\-8 is used, but may also be iso\-8859\-15\&. All charsets supported by the system iconv() are supported here\&.
.sp
Default:
\fIutf\-8\fR
.RE
.PP
\fBldap_bind_user\fR
.RS 4
The bind dn as to connect to the LDAP server\&. Leave empty to connect anonymous\&.
.sp
Default value is empty\&.
.RE
.PP
\fBldap_bind_passwd\fR
.RS 4
When ldap_bind_user is a valid DN, this should be filled in too\&.
.sp
Default value is empty\&.
.RE
.PP
\fBldap_network_timeout\fR
.RS 4
The timeout for network operations in seconds\&.
.sp
Default:
\fI30\fR
.RE
.PP
\fBldap_last_modification_attribute\fR
.RS 4
This value is used to detect changes in the item in the LDAP server\&. Since it is a standard LDAP attribute, you should never have to change this\&. It is mainly used for addressbook synchronisation between your server and your offline data\&.
.sp
Default:
\fImodifyTimeStamp\fR
.RE
.PP
\fBldap_page_size\fR
.RS 4
Limit result sets in pages of this size, downloading fewer results at a time from the LDAP server\&.
.sp
Default:
\fI1000\fR
.RE
.PP
\fBldap_search_base\fR
.RS 4
This is the subtree entry where all objects are defined in the LDAP server\&.
.sp
Default:
\fIdc=kopano,dc=com\fR
.RE
.PP
\fBldap_object_type_attribute\fR
.RS 4
An object is defined by this attribute what type it is, eg\&. user, group, etc\&. Every object type should have a unique value in this attribute in order to define what which entry is\&.
.sp
The value of this attribute must be specified in the ldap_*_type_attribute_value settings\&. Each of those settings may specify multiple values for the type attribute, separated by comma\*(Aqs\&. All of these values must be present in the objects type attribute for a match to be made and the object to be recognised as that type\&.
.sp
It is possible for ambiguities to arise by setting the same string for multiple ldap_*_type_attribute_value settings\&. This ambiguity will be resolved by preferring objects with more matching values\&. If the ambiguity cannot be resolved in this way, then the first possibility is chosen from the list (addresslist, tenant, dynamic group, group, contact, user)\&.
.sp
Default:
\fIobjectClass\fR
.RE
.PP
\fBldap_user_type_attribute_value\fR
.RS 4
The value in
\fBldap_object_type_attribute\fR
which defines a user\&.
.sp
Default for OpenLDAP:
\fIposixAccount\fR
.sp
Default for ADS:
\fIuser\fR
.RE
.PP
\fBldap_group_type_attribute_value\fR
.RS 4
The value in
\fBldap_object_type_attribute\fR
which defines a group\&.
.sp
Default for OpenLDAP:
\fIposixGroup\fR
.sp
Default for ADS:
\fIgroup\fR
.RE
.PP
\fBldap_contact_type_attribute_value\fR
.RS 4
The value in
\fBldap_object_type_attribute\fR
which defines a contact\&.
.sp
Default for OpenLDAP:
\fIinetOrgPerson\fR
.sp
Default for ADS:
\fIcontact\fR
.RE
.PP
\fBldap_company_type_attribute_value\fR
.RS 4
The value in
\fBldap_object_type_attribute\fR
which defines a tenant\&. This option is only used in multi\-tenancy installations\&.
.sp
Default for OpenLDAP:
\fIorganizationalUnit\fR
.sp
Default for ADS:
\fIkopano\-company\fR
.RE
.PP
\fBldap_addresslist_type_attribute_value\fR
.RS 4
The value in
\fBldap_object_type_attribute\fR
which defines an addresslist\&.
.sp
Default:
\fIkopano\-addresslist\fR
.RE
.PP
\fBldap_dynamicgroup_type_attribute_value\fR
.RS 4
The value in
\fBldap_object_type_attribute\fR
which defines a dynamic group\&.
.sp
Default:
\fIkopano\-dynamicgroup\fR
.RE
.PP
\fBldap_user_search_filter\fR
.RS 4
Adds an extra filter to the user search\&.
.sp
Hint: Use the kopanoAccount attribute in the filter to differentiate between non\-kopano and kopano users\&.
.sp
Default for OpenLDAP is empty\&.
.sp
Default for ADS:
\fI(objectCategory=Person)\fR
.RE
.PP
\fBldap_user_unique_attribute\fR
.RS 4
This is the unique attribute of a user which is never going to change, unless the user is removed from LDAP\&. When this value changes, Kopano will remove the previous user and store from the database, and create a new user with this unique value\&.
.sp
Default for OpenLDAP:
\fIuidNumber\fR
.sp
Default for ADS:
\fIobjectGuid\fR
.RE
.PP
\fBldap_user_unique_attribute_type\fR
.RS 4
Contents type for the
\fBldap_user_unique_attribute\fR\&. This value can be
\fIbinary\fR
or
\fItext\fR\&.
.sp
Default for OpenLDAP:
\fItext\fR
.sp
Default for ADS:
\fIbinary\fR
.RE
.PP
\fBldap_fullname_attribute\fR
.RS 4
This value is the fullname of a user\&. It will be used on outgoing messages, and store names\&.
.sp
Default:
\fIcn\fR
.RE
.PP
\fBldap_loginname_attribute\fR
.RS 4
This value is the loginname of a user\&. This is what the user uses to login on kopano\&. The DAgent will use this value to open the store of the user\&.
.sp
Default for OpenLDAP:
\fIuid\fR
.sp
Default for ADS:
\fIsAMAccountName\fR
.RE
.PP
\fBldap_password_attribute\fR
.RS 4
This value is the password of a user\&. When using
\fBldap_authentication_method\fR
=
\fIpassword\fR, this value will be checked\&. The
\fBldap_bind_user\fR
should have enough access rights to read the password field\&.
.sp
Default for OpenLDAP:
\fIuserPassword\fR
.sp
Default for ADS:
\fIunicodePwd\fR
.RE
.PP
\fBldap_authentication_method\fR
.RS 4
This value can be
\fIbind\fR
or
\fIpassword\fR\&. When set to bind, the plugin will authenticate by opening a new connection to the LDAP server as the user with the given password\&. When set to password, the plugin will read and match the password field from the LDAP server itself\&. When set to password, the
\fBldap_bind_user\fR
should have enough access rights to read the password field\&.
.sp
Default for OpenLDAP:
\fIbind\fR
.sp
Default for ADS:
\fIbind\fR
.RE
.PP
\fBldap_emailaddress_attribute\fR
.RS 4
This value is the email address of a user\&. It will be used to set the From on outgoing messages\&.
.sp
Default:
\fImail\fR
.RE
.PP
\fBldap_emailaliases_attribute\fR
.RS 4
This value is the email aliases of a user\&. It can be used to find extra valid email accounts for incoming email\&. These email addresses cannot be used for outgoing email\&.
.sp
Default:
\fIkopanoAliases\fR
.RE
.PP
\fBldap_isadmin_attribute\fR
.RS 4
This value indicates if a user has administrator rights\&. 0 or not presents means no\&. 1 means yes\&. In multi\-tenancy environment a value of 1 means that the user is administrator over his own tenant\&. A value of 2 means he is administrator over all companies within the environment\&.
.sp
Default:
\fIkopanoAdmin\fR
.RE
.PP
\fBldap_nonactive_attribute\fR
.RS 4
This value indicates if a user is nonactive\&. Nonactive users cannot login, but the store can be used as a shared store for other users\&.
.sp
Setting this value to 1 will make a mailbox nonactive\&. The nonactive attribute provided by the Kopano schema for nonactive users is
\fIkopanoSharedStoreOnly\fR
.sp
Default:
\fIkopanoSharedStoreOnly\fR
.RE
.PP
\fBldap_resource_type_attribute\fR
.RS 4
This attribute can change the type of a non\-active user\&. The value of this attribute can be
\fIroom\fR
or
\fIequipment\fR
to make it such a resource\&. If this attribute is not present, or not one of the previously described values, the user will be a normal non\-active user\&.
.sp
Default:
\fIkopanoResourceType\fR
.RE
.PP
\fBldap_resource_capacity_attribute\fR
.RS 4
Resources often have a limited capacity\&. Use this attribute to control this value\&. user\&.
.sp
Default:
\fIkopanoResourceCapacity\fR
.RE
.PP
\fBldap_sendas_attribute\fR
.RS 4
This attribute contains the list of users for which the user can use the sendas feature\&.
.sp
Default:
\fIkopanoSendAsPrivilege\fR
.RE
.PP
\fBldap_sendas_attribute_type\fR
.RS 4
Contents type for the
\fBldap_sendas_attribute\fR
this value can be
\fIdn\fR,
\fIbinary\fR
or
\fItext\fR\&.
.sp
Default for OpenLDAP:
\fItext\fR
.sp
Default for ADS:
\fIdn\fR
.RE
.PP
\fBldap_sendas_relation_attribute\fR
.RS 4
This value is used to find the users in the sendas list\&.
.sp
Defaults to empty value, using the
\fBldap_user_unique_attribute\fR
setting\&. By using the DN, you can also add groups to the sendas list\&.
.sp
Default for OpenLDAP is empty\&.
.sp
Default for ADS:
\fIdistinguishedName\fR
.RE
.PP
\fBldap_user_certificate_attribute\fR
.RS 4
The attribute which contains the user\*(Aqs public certificate to be used for encrypted S/MIME messages\&. Both Active Directory and OpenLDAP use the same ldap attribute by default\&. The format of the certificate should be the binary DER format\&.
.sp
Default:
\fIuserCertificate\fR
.RE
.PP
\fBldap_group_search_filter\fR
.RS 4
Adds an extra filter to the group search\&.
.sp
Hint: Use the kopanoAccount attribute in the filter to differentiate between non\-kopano and kopano groups\&.
.sp
Default for OpenLDAP is empty\&.
.sp
Default for ADS:
\fI(objectCategory=Group)\fR
.RE
.PP
\fBldap_group_unique_attribute\fR
.RS 4
This is the unique attribute of a group which is never going to change, unless the group is removed from LDAP\&. When this value changes, Kopano will remove the previous group from the database, and create a new group with this unique value\&.
.sp
Default for OpenLDAP:
\fIgidNumber\fR
.sp
Default for ADS:
\fIobjectSid\fR
.RE
.PP
\fBldap_group_unique_attribute_type\fR
.RS 4
Contents type for the
\fBldap_group_unique_attribute\fR
this value can be
\fIbinary\fR
or
\fItext\fR\&.
.sp
Default for OpenLDAP:
\fItext\fR
.sp
Default for ADS:
\fIbinary\fR
.RE
.PP
\fBldap_groupname_attribute\fR
.RS 4
This value is the name of a group\&.
.sp
Default:
\fIcn\fR
.RE
.PP
\fBldap_groupmembers_attribute\fR
.RS 4
This value is the member list of a group\&.
.sp
Default for OpenLDAP:
\fImemberUid\fR
.sp
Default for ADS:
\fImember\fR
.RE
.PP
\fBldap_groupmembers_attribute_type\fR
.RS 4
Contents type for the
\fBldap_groupmembers_attribute\fR
this value can be
\fIdn\fR,
\fIbinary\fR
or
\fItext\fR\&.
.sp
Default for OpenLDAP:
\fItext\fR
.sp
Default for ADS:
\fIdn\fR
.RE
.PP
\fBldap_groupmembers_relation_attribute\fR
.RS 4
This value is used to find the users in a group if
\fBldap_groupmembers_attribute_type\fR
is
\fItext\fR\&.
.sp
Defaults to empty value, using the
\fBldap_user_unique_attribute\fR
setting\&.
.sp
Default is empty\&.
.RE
.PP
\fBldap_group_security_attribute\fR
.RS 4
If this attribute is present, you can make a group a security group\&. These groups can be used to place permissions on folders\&.
.sp
Default for OpenLDAP:
\fIkopanoSecurityGroup\fR
.sp
Default for ADS:
\fIgroupType\fR
.RE
.PP
\fBldap_group_security_attribute_type\fR
.RS 4
The type of the
\fBldap_group_security_attribute\fR
is very different for ADS and OpenLDAP\&. The value of this option can be
\fIboolean\fR
or
\fIads\fR\&. The ads option only looks at the highest bit in the numeric value of the groupType attribute\&.
.sp
Default for OpenLDAP:
\fIboolean\fR
.sp
Default for ADS:
\fIads\fR
.RE
.PP
\fBldap_company_search_filter\fR
.RS 4
Add an extra filter to the tenant search\&.
.sp
Hint: Use the kopanoAccount attribute in the filter to differentiate between non\-kopano and kopano companies\&.
.sp
Default for OpenLDAP is empty\&.
.sp
Default for ADS:
\fI(objectCategory=Company)\fR
.RE
.PP
\fBldap_company_unique_attribute\fR
.RS 4
This is the unique attribute of a tenant which is never going to change, unless the tenant is removed from LDAP\&. When this value changes, Kopano will remove the previous tenant from the database, and create a new tenant with this unique value\&.
.sp
Default for OpenLDAP:
\fIou\fR
.sp
Default for ADS:
\fIobjectSid\fR
.RE
.PP
\fBldap_company_unique_attribute_type\fR
.RS 4
Contents type for the
\fBldap_company_unique_attribute\fR
this value can be
\fIbinary\fR
or
\fItext\fR\&.
.sp
Default for OpenLDAP:
\fItext\fR
.sp
Default for ADS:
\fIbinary\fR
.RE
.PP
\fBldap_companyname_attribute\fR
.RS 4
This value is the name of a tenant\&.
.sp
Default:
\fIcn\fR
.RE
.PP
\fBldap_company_view_attribute\fR
.RS 4
This attribute contains the list of tenants which can view the members of the tenant where this attribute is set on\&. tenants which are not listed in this attribute cannot see the presence of the tenant space itself nor its members\&.
.sp
Default:
\fIkopanoViewPrivilege\fR
.RE
.PP
\fBldap_company_view_attribute_type\fR
.RS 4
Contents type for the
\fBldap_company_view_attribute\fR
this value can be
\fIdn\fR,
\fIbinary\fR
or
\fItext\fR\&.
.sp
Default for OpenLDAP:
\fItext\fR
.sp
Default for ADS:
\fIdn\fR
.RE
.PP
\fBldap_company_view_relation_attribute\fR
.RS 4
The attribute of the tenant which is listed in
\fBldap_company_view_attribute\fR\&.
.sp
Default: Empty, using the
\fBldap_company_unique_attribute\fR
.RE
.PP
\fBldap_company_admin_attribute\fR
.RS 4
This attribute contains the list of users outside of the selected tenant space who are administrator over the selected tenant space\&. Note that local users should not be listed as administrator here, those users need the
\fBldap_isadmin_attribute\fR
attribute\&.
.sp
Default:
\fIkopanoAdminPrivilege\fR
.RE
.PP
\fBldap_company_admin_attribute_type\fR
.RS 4
Contents type for the
\fBldap_company_admin_attribute\fR
this value can be
\fIdn\fR,
\fIbinary\fR
or
\fItext\fR\&.
.sp
Default for OpenLDAP:
\fItext\fR
.sp
Default for ADS:
\fIdn\fR
.RE
.PP
\fBldap_company_admin_relation_attribute\fR
.RS 4
The attribute of the user which is listed in
\fBldap_company_admin_attribute\fR\&.
.sp
Default: Empty, using the
\fBldap_user_unique_attribute\fR
.RE
.PP
\fBldap_company_system_admin_attribute\fR
.RS 4
This attribute contains the user who acts as the system administrator of this tenatn space\&. This can either be a local user or a user from a different tenant space\&. At the moment this user is set as the sender of quota warning emails\&.
.sp
Default:
\fIkopanoSystemAdmin\fR
.RE
.PP
\fBldap_company_system_admin_attribute_type\fR
.RS 4
Contents type for the
\fBldap_company_system_admin_attribute\fR
this value can be
\fIdn\fR,
\fIbinary\fR
or
\fItext\fR\&.
.sp
Default for OpenLDAP:
\fItext\fR
.sp
Default for ADS:
\fIdn\fR
.RE
.PP
\fBldap_company_system_admin_relation_attribute\fR
.RS 4
The attribute of the user which is listed in
\fBldap_system_admin_attribute\fR\&.
.sp
Default: Empty, using the
\fBldap_user_unique_attribute\fR
.RE
.PP
\fBldap_addresslist_search_filter\fR
.RS 4
Add a filter to the addresslist search\&.
.sp
Hint: Use the kopanoAccount attribute in the filter to differentiate between non\-kopano and kopano addresslists\&.
.sp
Default:
\fI(objectClass=kopano\-addresslist)\fR
.RE
.PP
\fBldap_addresslist_unique_attribute\fR
.RS 4
This is the unique attribute of a addresslist which is never going to change, unless the addresslist is removed from LDAP\&. When this value changes, Kopano will remove the previous addresslist from the database, and create a new addresslist with this unique value\&.
.sp
Default:
\fIcn\fR
.RE
.PP
\fBldap_addresslist_unique_attribute_type\fR
.RS 4
Contents type for the
\fBldap_addresslist_unique_attribute\fR
this value can be
\fIdn\fR,
\fIbinary\fR
or
\fItext\fR\&. On LDAP this value should be
\fItext\fR\&. On ADS this value should be
\fIdn\fR
.sp
Default:
\fItext\fR
.RE
.PP
\fBldap_addresslist_filter_attribute\fR
.RS 4
This is the name of the attribute on the addresslist object that specifies the filter to be applied for this addresslist\&. All users matching this filter AND matching the default ldap_user_search_filter will be included in the addresslist\&.
.sp
Default:
\fIkopanoFilter\fR
.RE
.PP
\fBldap_addresslist_search_base_attribute\fR
.RS 4
This is the name of the attribute on the addresslist object that specifies the search base to be applied for this addresslist\&.
.sp
Default:
\fIkopanoBase\fR
.RE
.PP
\fBldap_addresslist_name_attribute\fR
.RS 4
The attribute containing the name of the addresslist
.sp
Default:
\fIcn\fR
.RE
.PP
\fBldap_dynamicgroup_search_filter\fR
.RS 4
Add an extra filter to the dynamicgroup search\&.
.sp
Hint: Use the kopanoAccount attribute in the filter to differentiate between non\-kopano and kopano dynamic groups\&.
.sp
Default is empty\&.
.RE
.PP
\fBldap_dynamicgroup_unique_attribute\fR
.RS 4
This is the unique attribute of a dynamicgroup which is never going to change, unless the dynamicgroup is removed from LDAP\&. When this value changes, Kopano will remove the previous dynamicgroup from the database, and create a new dynamicgroup with this unique value\&.
.sp
Default:
\fIcn\fR
.RE
.PP
\fBldap_dynamicgroup_unique_attribute_type\fR
.RS 4
Contents type for the
\fBldap_dynamicgroup_unique_attribute\fR
this value can be
\fIbinary\fR
or
\fItext\fR\&. On LDAP this value should be
\fItext\fR\&. On ADS this value should be
\fIbinary\fR
.sp
Default:
\fItext\fR
.RE
.PP
\fBldap_dynamicgroup_filter_attribute\fR
.RS 4
This is the name of the attribute on the dynamicgroup object that specifies the filter to be applied for this dynamicgroup\&. All users matching this filter AND matching the default search filters for objects will be included in the dynamicgroup\&.
.sp
Default:
\fIkopanoFilter\fR
.RE
.PP
\fBldap_dynamicgroup_search_base_attribute\fR
.RS 4
This is the name of the attribute on the dynamicgroup object that specifies the search base to be applied for this dynamicgroup\&.
.sp
Default:
\fIkopanoBase\fR
.RE
.PP
\fBldap_dynamicgroup_name_attribute\fR
.RS 4
The attribute containing the name of the dynamicgroup\&.
.sp
Default:
\fIcn\fR
.RE
.PP
\fBldap_quotaoverride_attribute\fR
.RS 4
Default:
\fIkopanoQuotaOverride\fR
.RE
.PP
\fBldap_warnquota_attribute\fR
.RS 4
Default:
\fIkopanoQuotaWarn\fR
.RE
.PP
\fBldap_softquota_attribute\fR
.RS 4
Default:
\fIkopanoQuotaSoft\fR
.RE
.PP
\fBldap_hardquota_attribute\fR
.RS 4
Default:
\fIkopanoQuotaHard\fR
.RE
.PP
\fBldap_userdefault_quotaoverride_attribute\fR
.RS 4
Default:
\fIkopanoUserDefaultQuotaOverride\fR
.RE
.PP
\fBldap_userdefault_warnquota_attribute\fR
.RS 4
Default:
\fIkopanoUserDefaultQuotaWarn\fR
.RE
.PP
\fBldap_userdefault_softquota_attribute\fR
.RS 4
Default:
\fIkopanoUserDefaultQuotaSoft\fR
.RE
.PP
\fBldap_userdefault_hardquota_attribute\fR
.RS 4
Default:
\fIkopanoUserDefaultQuotaHard\fR
.RE
.PP
\fBldap_quota_multiplier\fR
.RS 4
This value is used to multiply the quota values to bytes\&. When the values in LDAP are in Kb, use 1024 here\&.
.sp
Default:
\fI1\fR
.RE
.PP
\fBldap_quota_userwarning_recipients_attribute\fR
.RS 4
This attribute contains the list of users who will receive an email when a user exceeds his quota\&. User who exceeds his quota will be automatically added to the recipients list, this list only indicates who else will be notified\&.
.sp
Default:
\fIkopanoQuotaUserWarningRecipients\fR
.RE
.PP
\fBldap_quota_userwarning_recipients_attribute_type\fR
.RS 4
Contents type for the
\fBldap_quota_userwarning_recipients_attribute\fR
this value can be
\fIdn\fR,
\fIbinary\fR
or
\fItext\fR\&. On LDAP this value should be
\fItext\fR\&. On ADS this value should be
\fIdn\fR
.sp
Default:
\fItext\fR
.RE
.PP
\fBldap_quota_userwarning_recipients_relation_attribute\fR
.RS 4
The attribute of the user which is listed in
\fBldap_quota_userwarning_recipients_attribute\fR
.sp
Default: Empty, using
\fIldap_user_unique_attribute\fR
.RE
.PP
\fBldap_quota_companywarning_recipients_attribute\fR
.RS 4
This attribute contains the list of users who will receive an email when a tenant exceeds its quota\&. The system administrator of the tenant that is over quota will automatically be added to the recipients list, this list only indicates who else will be notified\&.
.sp
Default:
\fIkopanoQuotaCompanyWarningRecipients\fR
.RE
.PP
\fBldap_quota_companywarning_recipients_attribute_type\fR
.RS 4
Contents type for the
\fBldap_quota_companywarning_recipients_attribute\fR
this value can be
\fIdn\fR,
\fIbinary\fR
or
\fItext\fR\&. On LDAP this value should be
\fItext\fR\&. On ADS this value should be
\fIdn\fR
.sp
Default:
\fItext\fR
.RE
.PP
\fBldap_quota_companywarning_recipients_relation_attribute\fR
.RS 4
The attribute of the user which is listed in
\fBldap_quota_companywarning_recipients_attribute\fR
.sp
Default: Empty, using
\fIldap_user_unique_attribute\fR
.RE
.PP
\fBldap_addressbook_hide_attribute\fR
.RS 4
The attribute indicating the object must be hidden from the addressbook\&. The object will still be detected as kopano user and is allowed to login and work as regular kopano user, but will not be visible in the addressbook for other users\&.
.sp
Default:
\fIkopanoHidden\fR
.RE
.PP
\fBldap_object_search_filter\fR
.RS 4
When searching in the addressbook, this filter will be used\&. Normally, the storage server will only search in the unique attribute, loginname, fullname and emailaddress\&. You might want to search in more fields, like \*(Aqlastname\*(Aq\&. Kopano also uses a postfix wildcard only\&. Using the \*(Aq*\*(Aq wildcard with prefixes makes a search slower, but can return more results\&.
.sp
Hint: Use the kopanoAccount attribute in the filter to differentiate between non\-kopano and kopano objects\&.
.sp
You can set a custom search filter here\&. \*(Aq%s\*(Aq will be replaced with the string being searched\&.
.sp
Active Directory has a shortcut for searching in the addressbook using the \*(Aqanr\*(Aq attribute\&. This is recommended on ADS installations\&.
.sp
Default:
.sp
Recommended for ADS installations:
\fI(anr=%s)\fR
.sp
Optional for OpenLDAP installations:
\fI(|(mail=%s*)(uid=%s*)(cn=*%s*)\:(fullname=*%s*)(givenname=*%s*)(lastname=*%s*)(sn=*%s*))\fR
.RE
.PP
\fBldap_filter_cutoff_elements\fR
.RS 4
When the ldap plugin retrieves information from the LDAP Server, large queries can be created to retrieve data for multiple objects at once\&. These large queries can perform badly on some LDAP server implementations\&. This option limits the number of elements that can be retrieved in one search filter and therefore limits the size of the filter\&. Instead, a broader search filter is created which retrieves all objects from the LDAP server\&. This results in slightly higher processing overhead and network activity, but with the bonus that the query can be served by the LDAP server much faster (a factor of 40 in 5000\-object queries has been observed)\&.
.sp
Setting this value to 0 will never limit the filter, setting it to a value of 1 will always limit the filter (since all queries will be retrieving one or more objects)\&.
.sp
Default:
\fI1000\fR
.RE
.SH "FILES"
.PP
/etc/kopano/server\&.cfg
.RS 4
The server configuration file\&.
.RE
.PP
/etc/kopano/ldap\&.cfg
.RS 4
The Kopano LDAP configuration file\&.
.RE
.SH "AUTHOR"
.PP
Written by Kopano\&.
.SH "SEE ALSO"
.PP
\fBkopano-server\fR(8),
\fBkopano-server.cfg\fR(5)