Hello,

Dovecot 2.2.25 CentOS 7

I setup ldap (FreeIPA) to have a user for dovecot that can (read search compare) all attributes that I need for dovecot.

I must also have mailAlternateAddress

When I make a ldapsearch with this user, I found all I need to configure dovecot.

But for me it is not possible to configure this correct ?

I can make for user

doveadm auth test office and doveadm auth test office@examle.com

with success authentication

but when I make a doveadm auth test info@example.co (mailAlternateAddress)

I have a broken authentication

Can any give me a hint what is wrong, or is this not possible ?

Space separated list of LDAP hosts to use. host:port is allowed too.

#hosts = 192.168.100.204 192.168.100.214 #hosts = 192.168.100.204 hosts = ipa.example.com

LDAP URIs to use. You can use this instead of hosts list. Note that this

setting isn't supported by all LDAP libraries.

#uris = ldap://ipa.example.com ldap://ipa1.example.com

Distinguished Name - the username used to login to the LDAP server.

Leave it commented out to bind anonymously (useful with auth_bind=yes).

dn = uid=system,cn=sysaccounts,cn=etc,dc=example,dc=com

Password for LDAP server, if dn is specified.

dnpass = 'XXXXXXXXXXXXXX'

Use SASL binding instead of the simple binding. Note that this changes

ldap_version automatically to be 3 if it's lower. Also note that SASL binds

and auth_bind=yes don't work together.

sasl_bind = yes

SASL mechanism name to use.

sasl_mech = gssapi

SASL realm to use.

sasl_realm = EXAMPLE.COM

SASL authorization ID, ie. the dnpass is for this "master user", but the

dn is still the logged in user. Normally you want to keep this empty.

sasl_authz_id = imap/mx01.example.com@EXAMPLE.COM

Use TLS to connect to the LDAP server.

#tls = yes

TLS options, currently supported only with OpenLDAP:

tls_ca_cert_file = /etc/ipa/ca.crt #tls_ca_cert_dir = #tls_cipher_suite =

TLS cert/key is used only if LDAP server requires a client certificate.

#tls_cert_file = #tls_key_file =

Valid values: never, hard, demand, allow, try

tls_require_cert = demand

Use the given ldaprc path.

#ldaprc_path =

LDAP library debug level as specified by LDAP_DEBUG_* in ldap_log.h.

-1 = everything. You may need to recompile OpenLDAP with debugging enabled

to get enough output.

#debug_level = 0

Use authentication binding for verifying password's validity. This works by

logging into LDAP server using the username and password given by client.

The pass_filter is used to find the DN for the user. Note that the pass_attrs

is still used, only the password field is ignored in it. Before doing any

search, the binding is switched back to the default DN.

auth_bind = yes

If authentication binding is used, you can save one LDAP request per login

if users' DN can be specified with a common template. The template can use

the standard %variables (see user_filter). Note that you can't

use any pass_attrs if you use this setting.

If you use this setting, it's a good idea to use a different

dovecot-ldap.conf.ext for userdb (it can even be a symlink, just as long as

the filename is different in userdb's args). That way one connection is used

only for LDAP binds and another connection is used for user lookups.

Otherwise the binding is changed to the default DN before each user lookup.

For example:

auth_bind_userdn = cn=%u,ou=people,o=org

auth_bind_userdn = uid=%n,cn=users,cn=accounts,dc=example,dc=com

LDAP protocol version to use. Likely 2 or 3.

ldap_version = 3

LDAP base. %variables can be used here.

For example: dc=mail, dc=example, dc=org

base = cn=users,cn=accounts,dc=example,dc=com

Dereference: never, searching, finding, always

#deref = never

Search scope: base, onelevel, subtree

scope = subtree #scope = onelevel

User attributes are given in LDAP-name=dovecot-internal-name list. The

internal names are:

uid - System UID

gid - System GID

home - Home directory

mail - Mail location

There are also other special fields which can be returned, see

http://wiki2.dovecot.org/UserDatabase/ExtraFields

#user_attrs = homeDirectory=home,uidNumber=uid,gidNumber=gid user_attrs = uid=user,uid=home=/srv/vmail/%$,=uid=10000,=gid=10000

Filter for user lookup. Some variables can be used (see

http://wiki2.dovecot.org/Variables for full list):

%u - username

%n - user part in user@domain, same as %u if there's no domain

%d - domain part in user@domain, empty if user there's no domain

user_filter = (&(objectClass=mailrecipient)(|(uid=%Ln)(mail=%Lu) (mailAlternateAddress=%Lu)))

Password checking attributes:

user: Virtual user name (user@domain), if you wish to change the

user-given username to something else

password: Password, may optionally start with {type}, eg. {crypt}

There are also other special fields which can be returned, see

http://wiki2.dovecot.org/PasswordDatabase/ExtraFields

pass_attrs = uid=user,userPassword=password,mailAlternateAddress=user

If you wish to avoid two LDAP lookups (passdb + userdb), you can use

userdb prefetch instead of userdb ldap in dovecot.conf. In that case you'll

also have to include user_attrs in pass_attrs field prefixed with "userdb_"

string. For example:

#pass_attrs = uid=user,userPassword=password,\

homeDirectory=userdb_home,uidNumber=userdb_uid,gidNumber=userdb_gid

Filter for password lookups

#pass_filter = (&(objectClass=posixAccount)(uid=%u)) pass_filter = (&(objectClass=mailrecipient)(|(uid=%Ln)(mail=%Lu) (mailAlternateAddress=%Lu)))

Attributes and filter to get a list of all users

iterate_attrs = uid=user, mailAlternateAddress=user iterate_filter = (objectClass=posixAccount)

Default password scheme. "{scheme}" before password overrides this.

List of supported schemes is in: http://wiki2.dovecot.org/Authentication

#default_pass_scheme = CRYPT

-- mit freundlichen Grüßen / best regards,

Günther J. Niederwimmer