Using LDAP without being admin

[Fernando]

Hello,

we are changing LDAP (from openldap to IDM based on FreeIPA).

We have connected EGroupWare to new LDAP without an admin account and using SQL for EGroupWare specific information (ACL, applications, …).

Is there a way to import accounts, groups from LDAP to EGroupWare ?
To synchronize already existing accounts ?

We want to avoid EGroupWare changing LDAP content. Is it possible ? If yes, how ?

Thanks and Regards

[RalfBecker]

There are two ways to do that - assuming you used EGroupware previously to administrate your LDAP or at least gave it the root account with all access:

• you can give EGroupware an account with just read-access to everything and get an error, when you try to update eg. an account from within EGroupware (EGroupware users would still be able to change there password, if that is allowed from them in LDAP using their own account)
• you migrate from storing EGroupware users, groups and memberships from LDAP to SQL by either keeping the authentication to LDAP or also moving that to SQL

EGroupware setup has a tool for migrating from LDAP to SQL.

Of cause the above is also possible migrating to ActiveDirectory …

Ralf

[sandersbud4]

you can give EGroupware an account with just read-access to everything and get an error, when you try to update eg. an account from within EGroupware (EGroupware users would still be able to change there password, if that is allowed from them in LDAP using their own account)

I have followed this approach. It was easier for me to follow and understand this approach.

[Fernando]

Hello,

We are currently making our migration. Willing to apply first point: giving EGroupWare a “read-only” account on new LDAP.

What we are facing now is that all calendars are brand new ones. Groups also are brand new ones. All events are “lost”: there are present but with other accounts.

Looking at database, it appears that there are no “LDAP accounts” in egw_accounts table.

The only solution we are thinking now is:

1. add a user to old LDAP giving permissions on all calendars
2. export all calendars (users and groups calendars) from “old” egroupware
3. change users and group names in this export to make them match new LDAP settings
4. add a user to new LDAP giving write permissions on all calendars
5. import all calendars to “new” egroupware

Is it possible to change LDAP server without losing calendars ? Or should we follow export/import path ?

Regards,
Fernando

[StefanU]

Hi Fernando.

Please create a separate topic for your problem.
You are then welcome to link to this article (copy in the web link).

---

Is it possible to change LDAP server without losing calendars ? Or should we follow export/import path ?

However, your topic is also not one that we can support free of charge here in the Community Forum.

I strongly recommend that you make use of our support:
https://www.egroupware.org/en/professional-support

Otherwise, you can hope that a Community user will be able to help you.

Stefan

[Fernando]

Hello Stefan,

Thank you for your answer I have created this new post.

Let’s see if another community members responds or have a business support from you or maybe a co-worker of mine can go further.

Merry Christmas and Happy New Year !
Regards,
Fernando