Hi all,
Well, I've compiled and installed dovecot 2.2.6 with following options:
./configure --prefix=/usr/ --sysconfdir=/etc/ --with-mysql
--libexecdir=/usr/lib/ --localstatedir=/var
--with-moduledir=/usr/lib/dovecot/modules --disable-rpath
--disable-static --with-zlib --with-bzlib --with-solr --with-ldap
--with-gssapi --with-nss
doveconf -n:
# 2.2.6: /etc/dovecot/dovecot.conf
# OS: Linux 3.8.0-32-generic x86_64 Ubuntu 12.04.3 LTS ext4
auth_debug = yes
auth_mechanisms = plain login
auth_verbose = yes
first_valid_gid = 20001
first_valid_uid = 20001
log_timestamp = %Y-%m-%d %H:%M:%S
mail_debug = yes
mail_gid = 20001
mail_home = /media/data/email/%n
mail_location = maildir:/media/data/email/%n/mail
mail_plugins = fts fts_solr acl zlib mail_log notify
mail_uid = 20001
managesieve_notify_capability = mailto
managesieve_sieve_capability = comparator-i;octet
comparator-i;ascii-casemap fileinto reject envelope encoded-character
vacation subaddress comparator-i;ascii-numeric relational regex
imap4flags copy include variables body enotify environment mailbox
date spamtest spamtestplus virustest
namespace {
list = no
location =
maildir:/media/data/email/%%n/mail:INDEX=/media/data/email/%n/mail/shared/%%n
prefix = shared/%%n/
separator = /
subscriptions = no
type = shared
}
namespace inbox {
inbox = yes
location = maildir:/media/data/email/%n/mail
mailbox Sent {
auto = subscribe
}
mailbox Spam {
auto = subscribe
}
mailbox SpamFalse {
auto = subscribe
}
mailbox SpamToLearn {
auto = subscribe
}
prefix =
separator = /
type = private
}
passdb {
args = /etc/dovecot/dovecot-ldap-passdb.conf.ext
driver = ldap
}
plugin {
acl = vfile
mail_log_events = delete undelete expunge copy mailbox_delete
mailbox_rename save mailbox_create
mail_log_fields = uid box msgid size
sieve = /media/data/email/%n/dovecot.sieve
sieve_after = /media/data/email/sieve/global.sieve
sieve_dir = /media/data/email/%n/sieve
zlib_save = bz2
zlib_save_level = 9
}
protocols = imap pop3 sieve lmtp
service auth {
unix_listener /var/spool/postfix/private/auth {
group = postfix
mode = 0660
user = postfix
}
unix_listener auth-master {
group = vmail
mode = 0660
user = vmail
}
unix_listener auth-userdb {
group = vmail
mode = 0640
user = vmail
}
}
service imap-login {
inet_listener imap {
address = *
port = 143
}
inet_listener imaps {
address = *
port = 993
ssl = yes
}
process_limit = 256
}
service lmtp {
inet_listener lmtp {
address = *
port = 24
}
user = vmail
}
service managesieve-login {
inet_listener sieve {
address = *
port = 4190
}
process_limit = 256
vsz_limit = 64 M
}
service pop3-login {
inet_listener pop3 {
address = *
port = 110
}
inet_listener pop3s {
address = *
port = 995
ssl = yes
}
}
ssl = required
ssl_ca = </etc/postfix/tls/cacert.pem
ssl_cert = </etc/postfix/tls/radiodjiido-cert.pem
ssl_key = </etc/postfix/tls/radiodjiido-key.pem
ssl_verify_client_cert = yes
userdb {
args = /etc/dovecot/dovecot-ldap-userdb.conf.ext
driver = ldap
}
protocol imap {
imap_client_workarounds = delay-newmail
imap_max_line_length = 64 k
mail_max_userip_connections = 20
mail_plugins = acl imap_acl mail_log notify zlib
}
protocol pop3 {
mail_plugins = zlib mail_log notify
pop3_client_workarounds = outlook-no-nuls oe-ns-eoh
pop3_uidl_format = %08Xu%08Xv
}
protocol sieve {
managesieve_logout_format = bytes ( in=%i : out=%o )
}
protocol lda {
info_log_path =
log_path =
mail_plugins = sieve zlib mail_log notify
quota_full_tempfail = yes
syslog_facility = mail
}
protocol lmtp {
info_log_path =
log_path =
mail_plugins = sieve fts zlib mail_log notify
quota_full_tempfail = yes
}
/etc/dovecot/dovecot-ldap-passdb.conf.ext:
hosts = localhost
auth_bind = yes
auth_bind_userdn = cn=%u,OU=users,dc=domain,dc=lan
ldap_version = 3
base = ou=users,dc=domain,dc=lan
scope = subtree
pass_filter = (&(objectClass=person)(cn=%u)(mail=*))
/etc/dovecot/dovecot-ldap-userdb.conf.ext:
hosts = localhost
dn = cn=ldap,cn=Users,DC=domain,DC=lan
dnpass = My_secret_pass
ldap_version = 3
base = OU=users,DC=domain,DC=lan
scope = subtree
user_attrs = uid=20001, gid=20001, home=/media/data/email/%n,
mail=/media/data/email/%n/mail
user_filter = (&(objectClass=person)(cn=%n)(mail=*))
iterate_attrs = cn=user
iterate_filter = (objectClass=person)
All seems to work as expected up-to-now, but :
If I move a user from OU 'users' to a sub-OU 'administrative' on Active
Directory :
-> The user can't login anymore to Dovecot
I have added the "scope = subtree" to the userdb and passdb files but it
doesn't change anything.
Here is the debug part when user test3 (located in ou=users,
ou=administrative) tries to login:
Oct 30 18:49:12 serveur dovecot: auth: Debug: auth client connected
(pid=4292)
Oct 30 18:49:12 serveur dovecot: auth: Debug: client in:
AUTH#0111#011PLAIN#011service=imap#011secured#011session=L6uskfDpKwAKChTQ#011lip=10.10.20.1#011rip=10.10.20.208#011lport=993#011rport=54827
Oct 30 18:49:12 serveur dovecot: auth: Debug: client passdb out:
CONT#0111#011
Oct 30 18:49:12 serveur dovecot: auth: Debug: client in: CONT<hidden>
Oct 30 18:49:12 serveur dovecot: auth:
ldap(test3,10.10.20.208,<L6uskfDpKwAKChTQ>): invalid credentials
Oct 30 18:49:14 serveur dovecot: auth: Debug: client passdb out:
FAIL#0111#011user=test3
As soon as I move user 'test3' back to ou=users, it can login ...
Oct 30 18:53:57 serveur dovecot: auth: Debug: Loading modules from
directory: /usr/lib/dovecot/modules/auth
Oct 30 18:53:57 serveur dovecot: auth: Debug: Read auth token secret
from /var/run/dovecot/auth-token-secret.dat
Oct 30 18:53:57 serveur dovecot: auth: Debug: auth client connected
(pid=4303)
Oct 30 18:53:57 serveur dovecot: auth: Debug: client in:
AUTH#0111#011PLAIN#011service=imap#011secured#011session=h+ypovDpUAAKChTQ#011lip=10.10.20.1#011rip=10.10.20.208#011lport=993#011rport=54864
Oct 30 18:53:57 serveur dovecot: auth: Debug: client passdb out:
CONT#0111#011
Oct 30 18:53:57 serveur dovecot: auth: Debug: client in: CONT<hidden>
Oct 30 18:53:57 serveur dovecot: auth: Debug: client passdb out:
OK#0111#011user=test3
Thanks in advance for your time and lights.
Nicolas
