breaking(feat): Config Templates for LDAP support by polarathene · Pull Request #3524 · docker-mailserver/docker-mailserver
This was referenced
Sep 4, 2023This avoids the ENV overriding user-provided settings due to the ENV having hard-coded fallback defaults when not explicitly set.
Similar to the prior commit, this ensures default ENV fallback doesn't accidentally override explicit user-provided config settings.
Same process as described by earlier commits for SASLAuthd. To avoid introducing potential breakage, the ENV fallback convenience for `DOVECOT_PASS_FILTER` is retained.
- `postfix.base` defaults are now potentially breaking: - The `query_filter` default is common between `ldap-users.cf` and `ldap-senders.cf`, but the `mailEnabled` attribute locks it in to requiring the `postfix-book` OpenLDAP schema. Like the `result_attribute` setting, this is only set as a convenient default but not as broadly useful like the `bind` + `version` settings. - `version = 3` is required as unlike SASLAuthd and Dovecot, the default for Postfix is `2`. - `bind = yes` because we only support configuring for this in DMS? - `ldap-senders.cf` originally differed with it's `result_attribute` setting, but that default chosen looks to be more of a workaround introduced and should be more explicit? - The Postfix `.base` template does not include the four common attributes (_that Dovecot and SASLAuthd base configs do_), as the `LDAP_` prefix is presently the same (no`POSTFIX_` prefix), thus would override user config regardless.. - `sender_login_maps.ldap` doesn't exist and isn't relevant to LDAP queries (seems to be accidentally included here). `ldap-senders.cf` provides this functionality. - `ldap-senders.cf` was not supporting copying over a user-provided config, it does now. - Internal location for these Postfix generated configs is now `/etc/postfix/ldap/`.
Remove the prefix in favor of moving these files into a subdirectory: `/etc/postfix/ldap/`. Original LDAP config files provided via `Dockerfile` are now removed as the new `.tmpl` generation makes them redundant.
Generic approach to configuring Postfix with the LDAP tables in `main.cf`. Instead of opt-in when file exists (always did), opt-out when the `query_filter` is missing. This fixes a bug reported when deployment does not require LDAP queries for a lookup type, like groups. Avoids introducing misconfiguration by default.
Previously only `query_filter` had this support via an inconsistent `_${QUERY_KIND}` ENV suffix.
This has been shifted to the left under the new `POSTFIX_` prefix, so that it can easily leverage the ENV prefix with config templates, layering after the generic `POSTFIX_` template. Naming is now consistent with `${QUERY_KIND}` (upper-cased). This also enables using the common `LDAP_` prefix in the Postfix `.base` template.
As a part of the previous commit toggling based on presence of `query_filter`, this is now dropped from the Postfix `.base` template.
- `packages.sh` + `utils.sh` lint fix. - `.tmpl` + `.base` files column aligned. - `mail_with_ldap.bats` updated to ignore white-space between key/value entries being checked.
Inverse the assert to process the config file entry lookup to reduce the white-space between key and value to a consistent ` = ` which can then be compared directly to the `KEY_VALUE` input (_instead of the KV isolation dance used previously_).
polarathene
changed the title
feat: Config Templates for LDAP support
breaking(feat): Config Templates for LDAP support
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters