On 2 Feb 2018, at 10.38, Xuan Jia <xuan.jia@gameloft.com> wrote:

We using Dovecot with LDAP.
>From the beginning, we using GC LDAP query with port 3268 for email accounts.
For example, user1@our-organization.org (in the USA) with "base = dc=our-organization, dc=org" works fine.

But refer to this document:
https://wiki2.dovecot.org/AuthDatabase/LDAP
When we change the LDAP from 3268 to 389 and with TLS, the base should be changed like this:
"base = ou=usa, dc=our-organization, dc=org"

But if the user (user2) located in United Kingdom (ou=gbr), the user can not login.

When we debug with ldapsearch:
ldapsearch -ZZ -v -h dc.our-organization.org -p 389 -D 'cn=auth_user,ou=usa,dc=our-organization,dc=org' -W -b 'dc=our-organization, dc=org' '(userPrincipalName=user2@our-organization.org)'
It can return user2 information with some "numReferences".

But in Dovecot, if "base = dc=our-organization, dc=org" it only reported auth error with timeout.

So my question is: does Dovecot LDAP auth support LDAP referral?
If Dovecot relies on OpenLDAP, it should be support.
If not, why and what is the walkthrough?

TBH, I don't think that it's supported. Looking at the source code at least it does not look it is.

What you could do is to have separate passdb for both ldap bases.
one that would query base = ou=usa, dc=our-organization, dc=org and one that would query 
base = ou=gbr, dc=our-organization, dc=org

and then use skip=authenticated on the second passdb if user already found in first passdb.

Sami