Administrator's Guide - Kerio Software Archive

Chapter 7 DomainsUsernameName of the user that have read rights for the LDAP database, either of the root useror of the Open Directory administrator (admin for Mac OS X 10.3 or diradmin for MacOS X 10.4). In case that the administrator’s username is used, it is necessary to makesure the user is an OpenDirectory Administrator, not just a local administrator on theOpenDirectory computer.To connect to the Apple OpenDirectory database insert an appropriate username in thefollowing form:uid=xxx,cn=xxx,dc=xxx• uid — username that you use to connect to the system.• cn — name of the users container (typically the users file).• dc — names of the domain and of all its subdomains (i.e. mail.company.com →dc=mail1,dc=company,dc=com)PasswordPassword of the user that have read rights for the LDAP database.Secured connection (LDAPS)Within the communication of the LDAP database with Kerio MailServer, sensitive datamay be transmitted (such as user passwords). It is possible to secure the communicationby using an SSL tunnel.Warning: SSL encryption is demanding in respect of connection speed and processor operation.Especially when too many connection are established between the LDAP databaseand Kerio MailServer or when too many users are included in the LDAP database, the communicationmight get slow. If the SSL encryption overloads the server, it is recommendedto use the non-secured version of LDAP.Domain controller failoverDNS name or IP address of the backup server with the same LDAP database.Note: If the secured version of LDAP service is used for connection, it is necessary toenter also the DNS name to enable the SSL certificate’s verification.LDAP search suffixIf the Apple OpenDirectory option is selected in the Directory service type entry, inserta suffix in the following form: dc=subdomain,dc=domain.Click the Test connection button to check the defined parameters. The test is performed onthe server name and address (if it is possible to establish a connection with the server) as wellas the username and password (if authentication can be performed).Note: Cooperation with the LDAP database that has been described above has nothing to dowith the built-in LDAP server. The built-in LDAP server is used to access contact lists frommail clients (for details refer to the chapter 19). However, if the MailServer is installed onan Apple Open Directory server the LDAP listening port in the MailServer’s Configuration →Services must be changed to an alternate port to avoid a port conflict.74