=
On 2022-04-20 16:39, Harry G. Coin via FreeIPA-users wrote:
Hi Francis
Hi Harry,
Thanks a lot for your input on this!
I integrated freeipa with postfix/dovecot, and many other anti-spam / address validation capabilities. I can tell you -- it's quite a bumpy ride.
I can imagine - did you put the spamassassin on ldap as well?
A 'good plan' has more to do with your model of how 'real
people' would expect to map onto domains, accounts and the like. To do it properly, there has to be pretty tight integration into DNS, with a fair few administrative accounts and related records and a whole bunch of support packages. It's possible to do well, but it's a way bigger project than the relationship between freeipa and postfix.
The domain issue is important, and I am still trying to think of a model that will be flexible and straightforward at the same time:
- using DNS zones as autoritative source for valid domains for mailboxes or - relying entirely on a domain container on LDAP for mail domains
I am inclined for the latter, thus not having an integration with DNS.
My main idea was a model where existing FreeIPA users with a `mail` attribute would have mailboxes. That would be a paradigm I would like to keep. So if there's a need for a mailbox called "contact@example.com", so "contact" would need to be a user. Groups would be treated like aliases, but I could think that for many use cases, groups would also need a mailbox.
For example, many business users have a concept of 'their primary email address' with secondary addresses that might 'float' among staffers (techsupport@ productspecialistfoo@ info@). You might require those to be separate users with separate email boxes, or 'groups' and then have to deal with passwords, etc. Also secondary addresses that appear later that allow for name changes ( jsmith@domain also gets email for jjones@domain). Another issue is whether to allow 'one email bucket' to get email from 'secondary domains entirely' and not just different accounts within the domain, for example shippingclerk@brandx.com shippingclerk@brandz.com are aliases for jjones@warehousefoo.com
I believe that this could be solved with aliases, and that's where the bulk of the project lies, actually. What I think of it as a postfixadmin-like interface on FreeIPA to administer virtual domains and virtual accounts. Virtual accounts would necessarily have a `mail` (or `maildrop` attribute) that corresponds to a real mailbox.
Address validation would be a bit of a concern, as there's no guarantee that the `mail` attribute of a user would contain a domain that is configured on postfix, but maybe that can be done on the query side.
It goes on, but big picture, the tradeoff is admin setup-time vs admin-management time vs user-account setup time. I find users, with their many various devices and so on, generally want 'one account with one password' they can set up for all their devices, then have 'the system' route 'whatever from whereever' to that. Generally, not always of course.
That's how I think as well. That's why aliases are important here.
Good luck!
Thank you!
Francis