User repositories are required to store James user information and authentication data
Consult usersrepository.xml in GIT to get some examples and hints.
A user has two attributes: username and password. A valid user should satisfy these criteria:
A user is always considered as lower cased, so 'myUser' and 'myuser' are the same user, and can be used as well as recipient local part than as login for different protocols.
All Users Repositories provide at least these three options
JPA (database via OpenJPA) based user repository. This is the default implementation.
The usersrepository tag as 2 attributes: name="LocalUsers" and class="org.apache.james.user.file.UsersFileRepository"> The class tag should be specified for Spring, but is not taken into acount by Guice.
Read-Only LDAP based UsersRepository
Example:
<usersrepository name="LocalUsers" class="org.apache.james.user.ldap.ReadOnlyUsersLDAPRepository" ldapHost="ldap://myldapserver:389" principal="uid=ldapUser,ou=system" credentials="password" userBase="ou=People,o=myorg.com,ou=system" userIdAttribute="uid"> <enableVirtualHosting>true</enableVirtualHosting> </usersrepository>
SSL can be enabled by using ldaps
scheme. trustAllCerts
option can be used to trust all LDAP client certificates
(optional, defaults to false).
Example:
<repository name="LocalUsers" class="org.apache.james.user.ldap.ReadOnlyUsersLDAPRepository" ldapHost="ldaps://myldapserver:636" principal="uid=ldapUser,ou=system" credentials="password" userBase="ou=People,o=myorg.com,ou=system" userIdAttribute="uid" trustAllCerts="true"> <enableVirtualHosting>true</enableVirtualHosting> </usersrepository>
Moreover, per domain base DN can be configured:
<repository name="LocalUsers" class="org.apache.james.user.ldap.ReadOnlyUsersLDAPRepository" ldapHost="ldaps://myldapserver:636" principal="uid=ldapUser,ou=system" credentials="password" userBase="ou=People,o=myorg.com,ou=system" userIdAttribute="uid" trustAllCerts="true"> <enableVirtualHosting>true</enableVirtualHosting> <domains> <domain.tld>ou=People,o=other.com,ou=system</domain.tld> </domains> </usersrepository>
You can connect to multiple LDAP servers for better availability by using ldapHosts
option
(fallback to ldapHost
is supported) to specify the list of LDAP Server URL with the comma ,
delimiter.
We do support different schemas for LDAP servers.
Example:
<usersrepository name="LocalUsers" class="org.apache.james.user.ldap.ReadOnlyUsersLDAPRepository" ldapHosts="ldap://ldapServer1:389,ldaps://ldapServer2:636" principal="uid=ldapUser,ou=system" credentials="password" userBase="ou=People,o=myorg.com,ou=system" userIdAttribute="uid" trustAllCerts="true"> <enableVirtualHosting>true</enableVirtualHosting> </usersrepository>
When VirtualHosting is on, you can enable local part as login username by configure the resolveLocalPartAttribute
.
This is the LDAP attribute that allows to retrieve the local part of users. Optional, default to empty, which disables login with local part as username.
Example:
<usersrepository name="LocalUsers" class="org.apache.james.user.ldap.ReadOnlyUsersLDAPRepository" ldapHosts="ldap://ldapServer1:389,ldaps://ldapServer2:636" principal="uid=ldapUser,ou=system" credentials="password" userBase="ou=People,o=myorg.com,ou=system" resolveLocalPartAttribute="uid" userIdAttribute="mail" trustAllCerts="true"> <enableVirtualHosting>true</enableVirtualHosting> </usersrepository>
The "userListBase" configuration option is used to differentiate users that can login from those that are listed as regular users. This is useful for dis-activating users, for instance.
A different values from "userBase" can be used for setting up virtual logins, for instance in conjunction with "resolveLocalPartAttribute". This can also be used to manage disactivated users (in userListBased but not in userBase).
Note that "userListBase" can not be specified on a per-domain-basis.