LDAP authentication

[Bob Miller]

Hi,

I would suggest starting with a simplified config.  by example:

> hosts = my.server.local
> auth_bind = yes
> ldap_version = 3
> base = CN=Person,CN=Schema,CN=Configuration,DC=company,DC=local

base = DC=company,DC=local

> scope = subtree
> user_attrs = \
>    =home=/home/imapproxy/%u, \
>    =mail=maildir:/home/imapproxy/%u

remove the user_attrs
In my config, home is defined in userdb in main dovecot.conf

> pass_attrs = uid=%u, userPassword=%w

remove pass_attrs

> pass_filter = (&(objectClass=user)(sAMAccountName=%u))

pass_filter = (sAMAccountName=%Ln)
  And add:
user_filter = (sAMAccountName=%Ln)

> auth_bind_userdn = company\%u

something tickles my brain that says my setup didn't like that.  anyway, 
my config has %Ln at company.xyz

If that works, then you can add the other bits one at a time till it 
fails....








>
> If I try to login on the LDAP-Server using ldapsearch it works, but with
> Dovecot not...
> I see this in my log:
>
> Jun 22 16:14:08 proxy01 dovecot: auth: Debug: client in:
> AUTH#0111#011PLAIN#011service=imap#011secured#011session=+agW4xsZ4gAKADPG#011lip=10.0.46.4#011rip=10.0.51.198#011lport=143#011rport=34018#011resp=<hidden>
>
> Jun 22 16:14:08 proxy01 dovecot: auth: Debug: client passdb out:
> OK#0111#011user=bertoncello
> Jun 22 16:14:08 proxy01 dovecot: auth: Debug: master in:
> REQUEST#0111586495489#01117122#0111#01161785e0770d6c48e7316ab484bc2778c#011session_pid=17125#011request_auth_token
>
> Jun 22 16:14:08 proxy01 dovecot: auth: Debug:
> ldap(bertoncello,10.0.51.198,<+agW4xsZ4gAKADPG>): user search:
> base=CN=Person,CN=Schema,CN=Configuration,DC=company,DC=local
> scope=subtree filter=(&(objectClass=posixAccount)(uid=bertoncello)) fields=
> Jun 22 16:14:08 proxy01 dovecot: auth: Error:
> ldap(bertoncello,10.0.51.198,<+agW4xsZ4gAKADPG>):
> ldap_search(base=CN=Person,CN=Schema,CN=Configuration,DC=company,DC=local filter=(&(objectClass=posixAccount)(uid=bertoncello)))
> failed: Operations error
> Jun 22 16:14:08 proxy01 dovecot: auth: Debug: master userdb out:
> FAIL#0111586495489
> Jun 22 16:14:08 proxy01 dovecot: imap: Error: Internal auth failure
> (client-pid=17122 client-id=1)
> Jun 22 16:14:08 proxy01 dovecot: imap-login: Internal login failure
> (pid=17122 id=1) (internal failure, 1 successful auths):
> user=<bertoncello>, method=PLAIN, rip=10.0.51.198, lip=10.0.46.4,
> mpid=17125, TLS, session=<+agW4xsZ4gAKADPG>
>
> and if I sniff with ngrep the comunication with the AD I see:
>
> ####
> T 10.0.46.4:58761 -> 192.168.168.23:389 [AP]
>    0....`........
> #
> T 192.168.168.23:389 -> 10.0.46.4:58761 [AP]
>    0........a............
> ##
> T 10.0.46.4:58761 -> 192.168.168.23:389 [AP]
>    0#...`......company\bertoncello..secret
> #
> T 192.168.168.23:389 -> 10.0.46.4:58761 [AP]
>    0........a............
> ##
> T 10.0.46.4:58761 -> 192.168.168.23:389 [AP]
>    0....`........
> #
> T 192.168.168.23:389 -> 10.0.46.4:58761 [AP]
>    0........a............
> #
> T 10.0.46.4:58761 -> 192.168.168.23:389 [AP]
>
> 0.....c{.5CN=Person,CN=Schema,CN=Configuration,DC=company,DC=local................1....objectClass..posixAccount....uid..bertoncello0.
>
> #
> T 192.168.168.23:389 -> 10.0.46.4:58761 [AP]
>    0........e................000004DC: LdapErr: DSID-0C0906E8, comment:
> In order to perform this operation a successful bind must be completed
> on the connection., data 0, v1db1.
> ##
> T 10.0.46.4:58761 -> 192.168.168.23:389 [AP]
>    0....B.
> ###
> T 192.168.168.23:389 -> 10.0.46.4:58761 [AR]
>    ..
>
> and I can't understand why:
>
> 1) I read "objectClass..posixAccount"
> 2) The authentication does not work...
>
> Thanks for your help!
> Luca Bertoncello
> (lucabert at lucabert.de)