Native Microsoft Outlook Configuration Guide

If your organization uses a LDAP server such OpenLDAP, Novell eDirectory, Apache Directory or any other solution, you must use Samba 4’s internal directory server and synchronize the data between both.

Synchronization scripts are not provided and unless you have clear-text passwords of your existing users, they will have to be changed during your initial synchronization so that your LDAP’s server passwords are identical to the ones from Samba 4.

Any modifications to your existing LDAP server (password change, user addition or deletion, etc.) will have to be replicated to Samba 4’s internal directory server.

Note that if you install Samba 4 on a server that is already running a LDAP service, you will have to change to TCP port on which your LDAP server listens to. Samba 4 will use the TCP port 389 and it can’t be changed.

For example, with OpenLDAP, you can use the -h parameter for slapd to make it listen on an other TCP port.

If your organization uses Microsoft Active Directory, Samba 4 will need to be joined to your Active Directory domain, as a DC.

Samba 4 will be able to reuse all the information contained in Microsoft Active Directory and no synchronization process needs to be put in place as information will get replicated to Samba 4 automatically.

For more information on joining Samba 4 to an existing Microsoft Active Directory domain, please refer to the Samba 4 documentation available at the following URL:

http://wiki.samba.org/index.php/Samba4

More specifically, have a look at the samba-tool domain join command. Note that joining Samba 4 to your Active Directory domain as a member will currently not work. An authentication bug is present in Samba 4 which then prevents all Outlook users to successfully authenticate through Samba 4. This issue has been reported to the Samba team and is being worked on.

If your organization neither uses a LDAP server or Microsoft Active Directory, you can start using Samba 4 as your directory server.

Samba 4’s directory can be queried over LDAP just like Microsoft Active Directory and can also serve as a domain controller for Windows-based environments.

For example, SOGo can very well use Samba 4’s built-in directory server to authenticate users. A SOGoUserSources entry to achieve this wold look like this:

Please refer to the SOGo Installation and Configuration Guide for more information regarding SOGoUserSources.

An IMAP server supporting the ACL, UIDPLUS and QRESYNC IMAP extensions is required, such as Cyrus IMAP version 2.4 or later, or Dovecot version 2.1 or later. If your current IMAP server does not support these extensions, you can use Dovecot’s proxying capabilities. The follow configuration example makes Dovecot proxy all IMAP request to an existing server:

SOGo would then be configured to use Dovecot’s proxy as the IMAP server.

Moreover, the authentication mode in use by Windows with Samba and Exchange servers prevent the backend from knowing the real password being used by the user. This implies that the IMAP server must accept any passwords from the host on which Samba is running.

To accomplish this with Cyrus IMAP Server, set sasl_pwcheck_method to alwaystrue in /etc/imapd.conf. You should restrain this to an imapd instance dedicated to SOGo.

For Dovecot, use an authentication source similar to:

You should also make sure that you restrain this only to the SOGo processes.

For any other IMAP server, refer to the product’s documentation. If such capability is not offered, you can alternatively define the cleartext password for each user. Please refer to the Adding Users section from this document.

Please follow the instructions from https://sogo.nu/download.html to setup your apt sources.

Then install Samba 4 on top of an existing SOGo installation:

Once completed, install the packages related to OpenChange and the SOGo provider:

Once the packages are installed, refer to the Configuration chapter from this guide.

First thing to do is to configure SOGo to use your current services, which are your IMAP, SMTP and SQL database servers. The configuration instructions for this are available in the SOGo Installation and Configuration Guide available from http://www.sogo.nu/.

Please refer to that documentation before continuing with the instructions included in this guide.

Run the following commands as root: 

You might consider changing the realm and domain used, to suit your environment.

You might also have to remove /etc/samba/smb.conf prior running this command.

Add the following parameters to the [global] section of the /etc/samba/smb.conf configuration file:

Your Samba 4 configuration file should look like this:

Since v2.2, OpenChange stores its metadata in MySQL so you need to have it installed.

First, create the OpenChange MySQL user:

The Samba AD schema needs to be filled with additional object definitions by running the following commands: 

Create the OpenChange database: 

Finally, modify /etc/samba/smb.conf to specify OpenChange connection information for its indexing database. Add the following at the end of the [global] section:

Next, you can start Samba using the usual command:

On upstart-based distributions, use:

You can also launch the OpenChange web services:

The OpenChange web services consist of two components:

For Debian-based distributions, these files can be found in /etc/apache2/conf.d/ or /etc/apache2/conf-available.

The configuration requires three Apache modules:  mod_proxy, mod_proxy_http and mod_wsgi. These are usually already installed but might need to be activated on Debian-based installations:

The OCS Manager and RPC Proxy configuration module can be enabled using:

The reqtimeout apache module is known to cause problems when using the default configuration shipped with Debian-based systems. On such distributions, Apache will close (HTTP/1.1 500) any HTTP request for which the HTTP body hasn’t arrived in 10 seconds.

While this is arguably good practice with regular HTTP, it will disrupt the RPC over HTTP protocol implemented by RPC Proxy: Outlook will continuously disconnect and reconnect leading to suboptimal performance.

To avoid this problem, use a much higher timeout or disable the module:

You should now restart the Apache service and make sure it will start on boot.

On Debian-based distributions, do:

Finally, you must adjust the OCS Manager configuration file, which is located in /etc/ocsmanager/ocsmanager.ini. You should enable LDAP-based authentication in the main section and configure it accordingly. You should also enable rpcproxy. You file should be similar to this one:

Once completed, start the OCS Manager service:

The autodiscovery service must be made accessible in order to advertise the web services provided by OpenChange. This can be done in two ways.

For example:

Again, the autodiscovery service must be accessible over HTTPS.

The current version of the Native Microsoft Outlook compatibility layer has some limitations.

Those limitations will be overcome in the upcoming releases. If you are interested in having those limitations fixed more rapidly, please contact Inverse by sending an email to support@inverse.ca.