Postfix, how to allow not everyone to send to the outside world?

Question

postfix

Greetings!
It is necessary to allow sending to the outside world to several users, the remaining users only local correspondence.
Tried like this:
main.cf file

smtpd_recipient_restrictions = check_sender_access texthash:/etc/postfix/restricted_senders, ....
smtpd_restriction_classes = local_only
local_only = check_recipient_access texthash:/etc/postfix/local_domains, reject

file /etc/postfix/restricted_senders

[email protected] local_only
[email protected] local_only
[email protected] local_only

file /etc/postfix/local_domains
mx.test.ru OK
This option turns out that the permissions for forwarding mail to the outside world apply to all users, except for those who are listed in the /etc/postfix/restricted_senders file, i.e. those who are registered in the file are rewritten only locally.
But how to do the opposite, so that the specified users from the list can send mail to the outside world, and all the rest only locally? Already the brain broke and re-read the manuals.

Answer 1

By the method of gouging the brain and poke, the solution turned out like this.
file /etc/postfix/restricted_senders change to this:

mx.test.ru local_only
[email protected] permit
[email protected] permit
[email protected] permit

those. at first, everyone is allowed to send only in their domain, and already elected outside.
If postfix is ​​crossed with Win AD (like mine), then the following is done in the config: the
/etc/postfix/restricted_senders file takes the form:
and the main.cf file will look like this:

smtpd_recipient_restrictions = check_sender_access ldap:/etc/postfix/restricted_senders.cf, 
                               check_sender_access texthash:/etc/postfix/restricted_senders,
                               ...,
                               ...  
smtpd_restriction_classes = local_only
local_only = check_recipient_access texthash:/etc/postfix/local_domains, reject

file /etc/postfix/restricted_senders.cf for sampling from Win AD:

server_host     = 192.168.111.2
server_port     = 389
version         = 3
bind            = yes
start_tls       = no
bind_dn         = [email protected]
bind_pw         = 123qwe
search_base     = ou=Struktura,dc=developer,dc=com
scope           = sub
query_filter    = (&(mail=%s)(objectClass=person)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))
result_attribute= postalCode
debuglevel      = 0

In Win AD, for a user who needs to be allowed to send mail outside, in the "Zip code" field, enter the permit parameter. Other users who have this field will have an empty correspondence only local.