Using LDAP without being admin

[Fernando]

Hello,

we are changing LDAP (from openldap to IDM based on FreeIPA).

We have connected EGroupWare to new LDAP without an admin account and using SQL for EGroupWare specific information (ACL, applications, …).

Is there a way to import accounts, groups from LDAP to EGroupWare ?
To synchronize already existing accounts ?

We want to avoid EGroupWare changing LDAP content. Is it possible ? If yes, how ?

Thanks and Regards

[RalfBecker]

There are two ways to do that - assuming you used EGroupware previously to administrate your LDAP or at least gave it the root account with all access:

• you can give EGroupware an account with just read-access to everything and get an error, when you try to update eg. an account from within EGroupware (EGroupware users would still be able to change there password, if that is allowed from them in LDAP using their own account)
• you migrate from storing EGroupware users, groups and memberships from LDAP to SQL by either keeping the authentication to LDAP or also moving that to SQL

EGroupware setup has a tool for migrating from LDAP to SQL.

Of cause the above is also possible migrating to ActiveDirectory …

Ralf

[sandersbud4]

you can give EGroupware an account with just read-access to everything and get an error, when you try to update eg. an account from within EGroupware (EGroupware users would still be able to change there password, if that is allowed from them in LDAP using their own account)

I have followed this approach. It was easier for me to follow and understand this approach.