I found a good solution. LDAP accounts used to filter users will be moved be under cn=applications,dc=kosmos,dc=org, for example cn=xmpp,ou=kosmos.org,cn=applications,dc=kosmos,dc=org. Then everything under cn=users,dc=kosmos,dc=org are actual users
# applications, kosmos.org
dn: cn=applications,dc=kosmos,dc=org
objectClass: top
objectClass: organizationalRole
cn: users
# kosmos.org, applications, kosmos.org
dn: ou=kosmos.org,cn=applications,dc=kosmos,dc=org
objectClass: top
objectClass: organizationalUnit
ou: kosmos.org
# 5apps.com, applications, kosmos.org
dn: ou=5apps.com,cn=applications,dc=kosmos,dc=org
objectClass: top
objectClass: organizationalUnit
description: 5apps
ou: 5apps.com
# xmpp account, used by ejabberd to search for users and change passwords
dn: cn=xmpp,ou=kosmos.org,cn=applications,dc=kosmos,dc=org
objectClass: simpleSecurityObject
objectClass: organizationalRole
cn: xmpp
userPassword: {SSHA512}snip
# xmpp account, used by ejabberd to search for users and change passwords
dn: cn=xmpp,ou=5apps.com,cn=applications,dc=kosmos,dc=org
objectClass: simpleSecurityObject
objectClass: organizationalRole
cn: xmpp
userPassword: {SSHA512}snip
ACIs need to be set on the Organizational Units to allow the applications accounts to perform the searches
# 5apps.com, users, kosmos.org
dn: ou=5apps.com,cn=users,dc=kosmos,dc=org
changetype: modify
replace: aci
aci: (target="ldap:///cn=*,ou=5apps.com,cn=users,dc=kosmos,dc=org")(targetattr="cn
This has revealed a flaw in the new directory structure. If we remove the filtering altogether, LDAP read-only accounts for the wiki and xmpp become valid XMPP accounts.
Right now my solution is to turn these accounts from a person to a organizationalPerson. Then the filter would look like this (a person, but not an organizationalPerson). In LDAP an organizationalPerson is also a person since it's "subclassing" it.
(&(objectClass=person)(!(objectClass=organizationalPerson)))
The ACIs will also need to be updated to add the objectClass attribute to the list of allowed attributes for the read-only account, because they are not part of the list for now
# kosmos.org, users, kosmos.org
dn: ou=kosmos.org,cn=users,dc=kosmos,dc=org
changetype: modify
replace: aci
aci: (target="ldap:///cn=*,ou=kosmos.org,cn=users,dc=kosmos,dc=org")(targetattr="cn
Docs are on the wiki for the new directory structure: https://wiki.kosmos.org/Infrastructure:LDAP
Closing this one since we've migrated ejabberd
Docs are on the wiki page: https://wiki.kosmos.org/Infrastructure:LDAP
