breaking(feat): Config Templates for LDAP support by polarathene · Pull Request #3524 · docker-mailserver/docker-mailserver

This was referenced

Sep 4, 2023

georglauterbach

polarathene

georglauterbach

polarathene

This avoids the ENV overriding user-provided settings due to the ENV having hard-coded fallback defaults when not explicitly set.
Similar to the prior commit, this ensures default ENV fallback doesn't accidentally override explicit user-provided config settings.
Same process as described by earlier commits for SASLAuthd.

To avoid introducing potential breakage, the ENV fallback convenience for `DOVECOT_PASS_FILTER` is retained.
- `postfix.base` defaults are now potentially breaking:
  - The `query_filter` default is common between `ldap-users.cf` and `ldap-senders.cf`, but the `mailEnabled` attribute locks it in to requiring the `postfix-book` OpenLDAP schema. Like the `result_attribute` setting, this is only set as a convenient default but not as broadly useful like the `bind` + `version` settings.
  - `version = 3` is required as unlike SASLAuthd and Dovecot, the default for Postfix is `2`.
  - `bind = yes` because we only support configuring for this in DMS?
  - `ldap-senders.cf` originally differed with it's `result_attribute` setting, but that default chosen looks to be more of a workaround introduced and should be more explicit?
- The Postfix `.base` template does not include the four common attributes (_that Dovecot and SASLAuthd base configs do_), as the `LDAP_` prefix is presently the same (no`POSTFIX_` prefix), thus would override user config regardless..
- `sender_login_maps.ldap` doesn't exist and isn't relevant to LDAP queries (seems to be accidentally included here). `ldap-senders.cf` provides this functionality.
- `ldap-senders.cf` was not supporting copying over a user-provided config, it does now.
- Internal location for these Postfix generated configs is now `/etc/postfix/ldap/`.
Remove the prefix in favor of moving these files into a subdirectory: `/etc/postfix/ldap/`.

Original LDAP config files provided via `Dockerfile` are now removed as the new `.tmpl` generation makes them redundant.
Generic approach to configuring Postfix with the LDAP tables in `main.cf`. Instead of opt-in when file exists (always did), opt-out when the `query_filter` is missing.

This fixes a bug reported when deployment does not require LDAP queries for a lookup type, like groups. Avoids introducing misconfiguration by default.
Previously only `query_filter` had this support via an inconsistent `_${QUERY_KIND}` ENV suffix.

This has been shifted to the left under the new `POSTFIX_` prefix, so that it can easily leverage the ENV prefix with config templates, layering after the generic `POSTFIX_` template. Naming is now consistent with `${QUERY_KIND}` (upper-cased). This also enables using the common `LDAP_` prefix in the Postfix `.base` template.

As a part of the previous commit toggling based on presence of `query_filter`, this is now dropped from the Postfix `.base` template.
- `packages.sh` + `utils.sh` lint fix.
- `.tmpl` + `.base` files column aligned.
- `mail_with_ldap.bats` updated to ignore white-space between key/value entries being checked.
These files were created on Windows, linter caught the discrepancy. Now they're `LF`.

@polarathene

Inverse the assert to process the config file entry lookup to reduce the white-space between key and value to a consistent ` = ` which can then be compared directly to the `KEY_VALUE` input (_instead of the KV isolation dance used previously_).

@polarathene

Co-authored-by: Georg Lauterbach <44545919+georglauterbach@users.noreply.github.com>

@polarathene

@polarathene polarathene changed the title feat: Config Templates for LDAP support breaking(feat): Config Templates for LDAP support

Aug 16, 2024