Hi,
I am having stability problems setting up dovecot to authenticate virtual users against Active Directory on Win2k3. If the correct userid and password are used, everything works fine, see first logfile snippet below. If an unknown userid is used, again everything works fine. If I try logging in with a valid userid but get the password wrong, that connection is rejected (see second logfile snippet), and all subsequent connection even with correct userid/password are rejected with thunderbird getting a temporary auth failure (see third logfile snippet below).

I am using auth_bind = yes and it seems as though after the failed login with an incorrect password, dovecot is loosing the dn & dnpass settings for the initial user lookup.

I have found numerous references to PHP and ActiveDirectory on Win2k3 getting a similar "ldap_search() failed: Operations error" error and they suggested ensuring LDAP Version 3 is used and the Deref is set to 'never'. I am already using these setting to no avail.

Has anyone else experience these problems, or have any suggestions on how to overcome it ?

Many thanks,
Rob Coward

Normal Login with correct password

Aug 16 10:08:52 gm-ho-lin-05 dovecot: auth(default): client in: AUTH    1       PLAIN   service=IMAP    secured lip=127.0.0.1    rip=127.0.0.1   resp=ADA5OTlAc3RvcmVzLmdhbWUuY28udWsAOTk5MA==
Aug 16 10:08:52 gm-ho-lin-05 dovecot: auth(default): ldap(0999@stores.game.co.uk,127.0.0.1): bind search: base=OU=Stores,OU=UK,DC=group,DC=game,DC=net filter=(&(objectClass=user)(mail=0999@stores.game.co.uk))
Aug 16 10:08:52 gm-ho-lin-05 dovecot: auth(default): client out: OK     1       user=0999@stores.game.co.uk
Aug 16 10:08:52 gm-ho-lin-05 dovecot: auth(default): master in: REQUEST 6       20765   1
Aug 16 10:08:52 gm-ho-lin-05 dovecot: auth(default): ldap(0999@stores.game.co.uk,127.0.0.1): base=OU=Stores,OU=UK,DC=group,DC=game,DC=net scope=subtree filter=(&(objectClass=user)(mail=0999@stores.game.co.uk)) fields=uid,,,uid,,
Aug 16 10:08:52 gm-ho-lin-05 dovecot: auth(default): master out: USER   6       0999@stores.game.co.uk uid=12367       gid=12367
Aug 16 10:08:52 gm-ho-lin-05 dovecot: imap-login: Login: user=<0999@stores.game.co.uk>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured
Aug 16 10:08:52 gm-ho-lin-05 dovecot: IMAP(0999@stores.game.co.uk): Effective uid=12367, gid=12367
Aug 16 10:08:52 gm-ho-lin-05 dovecot: IMAP(0999@stores.game.co.uk): maildir: data=/data/mailstore/stores.game.co.uk/0999
Aug 16 10:08:52 gm-ho-lin-05 dovecot: IMAP(0999@stores.game.co.uk): maildir: root=/data/mailstore/stores.game.co.uk/0999, index=/data/mailstore/stores.game.co.uk/0999, control=, inbox=
Aug 16 10:08:52 gm-ho-lin-05 dovecot: IMAP(0999@stores.game.co.uk): Disconnected: Logged out

Login with incorrect password

Aug 16 10:09:37 gm-ho-lin-05 dovecot: auth(default): client in: AUTH    1       PLAIN   service=IMAP    secured lip=127.0.0.1    rip=127.0.0.1   resp=ADA5OTlAc3RvcmVzLmdhbWUuY28udWsAMTIzNA==
Aug 16 10:09:37 gm-ho-lin-05 dovecot: auth(default): ldap(0999@stores.game.co.uk,127.0.0.1): bind search: base=OU=Stores,OU=UK,DC=group,DC=game,DC=net filter=(&(objectClass=user)(mail=0999@stores.game.co.uk))
Aug 16 10:09:39 gm-ho-lin-05 dovecot: auth(default): client out: FAIL   1       user=0999@stores.game.co.uk
Aug 16 10:09:39 gm-ho-lin-05 dovecot: imap-login: Aborted login: user=<0999@stores.game.co.uk>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured

Subsequent logins with correct password

Aug 16 10:09:48 gm-ho-lin-05 dovecot: auth(default): client in: AUTH    1       PLAIN   service=IMAP    secured lip=127.0.0.1    rip=127.0.0.1   resp=ADA5OTlAc3RvcmVzLmdhbWUuY28udWsAOTk5MA==
Aug 16 10:09:48 gm-ho-lin-05 dovecot: auth(default): ldap(0999@stores.game.co.uk,127.0.0.1): bind search: base=OU=Stores,OU=UK,DC=group,DC=game,DC=net filter=(&(objectClass=user)(mail=0999@stores.game.co.uk))
Aug 16 10:09:48 gm-ho-lin-05 dovecot: auth(default): ldap(0999@stores.game.co.uk,127.0.0.1): ldap_search() failed: Operations error
Aug 16 10:09:49 gm-ho-lin-05 dovecot: auth(default): client out: FAIL   1       user=0999@stores.game.co.uk     temp
Aug 16 10:09:49 gm-ho-lin-05 dovecot: imap-login: Aborted login: user=<0999@stores.game.co.uk>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured

This e-mail and any files transmitted with it are confidential and intended solely  for the use of the individual or entity to whom they are addressed. If you have  received this e-mail in error please notify the system manager at:

        mailto:postmaster@game.net

The recipient acknowledges that the transmissions made via the Internet can be corrupted and therefore THE GAME GROUP PLC and any of its subsidiaries  do not give any warranty as to the quality or accuracy of any information  contained in the message or assume any liability for it or for its transmission,  reception or storage.

This footnote also confirms that this e-mail message has been swept by anti-virus software for the presence of computer viruses.

http://www.game.co.uk
http://www.gamegroup.plc.uk