Hello
Postfix + LDAP , Samba as LDAP server, Dovecot

virtual_transport set in postfix to dovecot-lmtp ( for autoresponder support )

Users have their email aliases in the otherMailbox record
For example, account_test@example-domain user has an alias: test@exmaple-domain
Query from command line works fine:

postmap -q test@example-domain ldap://etc/postfix/ad_virtual_mailbox_maps2.cf
account_test/Maildir/

(The filter in the query ad_virtual_mailbox_maps2.cf looks like this:
[cut]
scope = sub
query_filter = (&(objectclass=person)(|(mail=%s)(otherMailbox=%s))
result_attribute= uid
result_format = %u/Maildir/

)

However, sending an email to the alias test@example-domain ends:

Feb 28 12:31:40 mbox-01 postfix/lmtp[13474]: 2367A6EF: to=<test@example-domain>, relay=mbox-01[private/dovecot-lmtp], delay=0.05, delays=0.02/0/0.02, dsn=5.1.1, status=bounced (host mbox-01[private/dovecot-lmtp] said: 550 5.1.1 <test@example-domain> User doesn't exist: test@example-domain (in reply to RCPT TO command))

I modified dovecot-ldap.conf.ext:

I changed:

user_filter = (&(objectClass=person)(uid=%u)(!(userAccountControl=514)))

to:

user_filter = (&(objectClass=person)(|(uid=%u)(otherMailbox=%u))(!(userAccountControl=514)))

but that didn't solve the problem. Where's the bug?  Any hint?

Below dovecot configuration:


# 2.3.4.1 (f79e8e7e4): /etc/dovecot/dovecot.conf
# Pigeonhole version 0.5.4 ()
# OS: Linux 4.19.0-6-amd64 x86_64 Debian 10.2
# Hostname: mbox-01
auth_cache_negative_ttl = 0
auth_username_format = %Ln
disable_plaintext_auth = no
mail_gid = vmail
mail_location = mbox:~/mail:INBOX=/var/mailbox-store/%u
mail_privileged_group = mail
mail_uid = vmail
managesieve_notify_capability = mailto
managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext vacation-seconds
namespace inbox {
  inbox = yes
  location =
  mailbox Drafts {
    special_use = \Drafts
  }
  mailbox Junk {
    special_use = \Junk
  }
  mailbox Sent {
    special_use = \Sent
  }
  mailbox "Sent Messages" {
    special_use = \Sent
  }
  mailbox Trash {
    special_use = \Trash
  }
  prefix =
}
passdb {
  args = /etc/dovecot/dovecot-ldap.conf.ext
  driver = ldap
}
plugin {
  sieve = /var/mailbox-store/%u/.dovecot.sieve
  sieve_dir = /var/mailbox-store/%u
  sieve_extensions = +vacation-seconds
  sieve_trace_debug = yes
  sieve_trace_dir = /tmp/sieve/
  sieve_trace_level = matching
  sieve_vacation_default_period = 10d
  sieve_vacation_max_period = 30d
  sieve_vacation_min_period = 1h
}
protocols = " imap lmtp sieve pop3 sieve"
service auth {
  unix_listener /var/spool/postfix/private/auth {
    group = postfix
    mode = 0666
    user = postfix
  }
  unix_listener auth-userdb {
    mode = 0666
    user = vmail
  }
}
service lmtp {
  unix_listener /var/spool/postfix/private/dovecot-lmtp {
    group = postfix
    mode = 0600
    user = postfix
  }
}
service managesieve-login {
  inet_listener sieve {
    port = 4190
  }
  process_min_avail = 0
  service_count = 1
  vsz_limit = 64 M
}
service managesieve {
  process_limit = 1024
}
service stats {
  unix_listener stats-reader {
    group = vmail
    mode = 0660
    user = vmail
  }
  unix_listener stats-writer {
    group = vmail
    mode = 0660
    user = vmail
  }
}
ssl_cert = </etc/dovecot/private/dovecot.pem
ssl_client_ca_dir = /etc/ssl/certs
ssl_dh = # hidden, use -P to show it
ssl_key = # hidden, use -P to show it
userdb {
  args = /etc/dovecot/dovecot-ldap.conf.ext
  driver = ldap
}
protocol lmtp {
  mail_plugins = " sieve"
}
protocol lda {
  info_log_path = /var/log/dovecot-lda.log
  log_path = /var/log/dovecot-lda-errors.log
  mail_plugins = " sieve"
}

and  dovecot-ldap.conf.ext:
[cut]
deref = never
scope = subtree
user_attrs = =mail=maildir:/var/mailbox-store/%Ln/Maildir/
user_filter = (&(objectClass=person)(|(uid=%u)(otherMailbox=%u))(!(userAccountControl=514)))
pass_attrs = uid=user,userPassword=password
pass_filter = (&(objectClass=person)(uid=%u)(!(userAccountControl=514)))
default_pass_scheme = CRYPT