dovecot - Jan 2009 - Symlink shared mailboxes and system_user extra field

Hello,

I'm trying to set up, as explained in the wiki, shared mailboxes with
symlink.
I'm running dovecot-1.1.8 with LDAP pass/userdb. The Maildir layout goes
like this :

  /courriel/boites/foobar : Maildir of user foobar (nfs)
  /courriel/meta/foobar : control files of user foobar (nfs)
  /var/dovecot/indexes : indexes (locally stored)

I created :

  /courriel/boites/doveshared/.box/ : the Maildir I want to share
  /courriel/boites/foobar/.box -> /courriel/boites/doveshared/.box (symlink)
  /courriel/boites/foobaz/.box -> /courriel/boites/doveshared/.box (symlink)
 
  the unix and LDAP group doveshared, so /etc/group holds :

    doveshared:*:<gid>:foobar,foobaz

  the permissions on the real Maildir are ok for that group :  

    drwxrwx---  3 root  doveshared  4096 Jan 26 18:58
/courriel/boites/doveshared
    drwxrwx---  5 root  doveshared  4096 Jan 26 18:58 .box (in /courriel/boites)

  I made the userdb (prefetch) return the system_user extra_field (for now,
I'm
  using an used LDAP attribute - I will create a new attribute in my schema
  later) :

    pass_attrs =
uid=user,userPassword=password,homeDirectory=userdb_home,,,uidNumber=userdb_uid,gidNumber=userdb_gid,shadowMax=userdb_system_user

  and it seems to be actually returned :

    Jan 27 09:34:10 munster3 dovecot: auth(default): ldap(foobar,157.99.64.42):
result: uid(user)=foobar uidNumber(userdb_uid)=xxx gidNumber(userdb_gid)=xxx
homeDirectory(userdb_home)=/home1/xxx/foobar
userPassword(password)=<hidden> shadowMax(userdb_system_user)=380

But I can't subscribe to the mailbox :

  stat(/courriel/boites/doveshared/.box/tmp) failed: Permission denied (euid=xxx
egid=<primary gid>)

as a matter of fact, the egid seems to be the primary gid.

What am I missing ?

Thanks.

-- 
Thomas Hummel 	    | Institut Pasteur
<hummel at pasteur.fr> | P?le informatique - syst?mes et r?seau

On Tue, Jan 27, 2009 at 09:51:51AM +0100, Thomas Hummel wrote:
> What am I missing ?
Or maybe it's because I cannot implement symlink shared mailboxes without
using ACL (I
thought ACL were used to fine tune what unix permissions allowed to to) ?

-- 
Thomas Hummel 	    | Institut Pasteur
<hummel at pasteur.fr> | P?le informatique - syst?mes et r?seau

On Tue, Jan 27, 2009 at 09:51:51AM +0100, Thomas Hummel wrote:
>     pass_attrs =
uid=user,userPassword=password,homeDirectory=userdb_home,,,uidNumber=userdb_uid,gidNumber=userdb_gid,shadowMax=userdb_system_user
is it the correct way to pass userdb extra field other than home, uid and gid ?
Is it supposed to work with prefetch userdb as well ?

-- 
Thomas Hummel 	    | Institut Pasteur
<hummel at pasteur.fr> | P?le informatique - syst?mes et r?seau

On Tue, Jan 27, 2009 at 09:51:51AM +0100, Thomas Hummel wrote:
> I'm trying to set up, as explained in the wiki, shared mailboxes with
symlink.
Ok, I'm trying with namespaces and ACL now (it will be cleaner anyway than
symlinks) but I'm still missing something :

I'm still running dovecot-1.1.8 with LDAP pass/userdb. 

- The Maildir layout for the private namespace goes like this :
 
   /courriel/boites/foobar : Maildir of user foobar (nfs)
   /courriel/meta/foobar : control files of user foobar (nfs)
   /var/dovecot/indexes/f/foobar : indexes for user foobar (locally stored)

- In the Public/ namespace :

  /courriel/boites/public/.box/ is the Maildir I want to share

-  I created the unix and LDAP group doveshared, so /etc/group holds :
 
     doveshared:*:<gid>:foobar,foobaz
 
-  The permissions on the Maildir I want to share seem ok for that group :  
 
     drwxrwx---  3 root  doveshared  4096 Jan 26 18:58 /courriel/boites/public
     drwxrwx---  5 root  doveshared  4096 Jan 26 18:58
/courriel/boites/public/.box

- I made the userdb (prefetch) return the system_user and acl_groups extra
  fields [temporary hijacking 2 unused LDAP attributes (shadowMax and title)] :

  pass_attrs =
uid=user,userPassword=password,homeDirectory=userdb_home,,,uidNumber=userdb_uid,gidNumber=userdb_gid,shadowMax=userdb_system_user,title=userdb_acl_groups

- the title LDAP attributes holds a comma separated list of groups, one beeing
the doveshared group :

  title: xxx,doveshared

- the maildir I want to share holds 2 files :

  -rwxrwx---  1 root  doveshared    28 Jan 27 11:35 dovecot-acl
  -rwxrwx---  1 root  doveshared     0 Jan 26 18:25 dovecot-shared

  with dovecot-acl holding :

  group=doveshared lrwstiekxa

Here are the relevant part of my dovecot.conf :

namespace public {
  separator = /
  prefix = Public/
  location = maildir:/courriel/boites/public/.box
  inbox = no
  hidden = no
  list = yes
  subscriptions = yes
}
 

That setup doesn't seem to work (I just see the Public folder in the
Thunderbird subscrition list but that'all).

I have several questions :

1) is the namespace prefix case sensitive (i.e. does the unix corresponding
directory have to match
its case ? It seems to me it isn't.

2) is the way I return userdb (which is prefetch) system_user and acl_groups
correct ?

3) is my location correct (it points to the maildir itself instead of the
"public" directory) ?

4) what did I miss :

  opendir(/courriel/boites/public/.box) failed: Permission denied

Thanks

-- 
Thomas Hummel 	    | Institut Pasteur
<hummel at pasteur.fr> | P?le informatique - syst?mes et r?seau