Issue connecting Windows AD ↔ Dovecot via LDAPS
Hello, I’m trying to connect my Windows Active Directory to Dovecot 2.4.1 via LDAPS with a self-signed certificate. Authentication works correctly using the template method. I’m using a DN template for the bind DN. The ldap_base and passdb_ldap_filter field is present in my config because its required, otherwise it doen't work, maybe a internal requirement. Authentication succeeds, but sending mail fails.
ldap_uris = ldaps://gr4.lan ldap_base = cn=Users,dc=gr4,dc=lan ssl_client_require_valid_cert = no # self-signed certificate
passdb { driver = ldap passdb_ldap_filter = (objectClass=*) passdb_ldap_bind = yes bind_userdn = cn=%{user},cn=Users,dc=gr4,dc=lan }
userdb { driver = static args = uid=vmail gid=vmail }
So, the command doveadm auth test user@domain work but not doveadm user user@domain The issue in on Debian 13.
Also i have print a doveadm -Dv user pol@gr4.lan
root@deb13:/etc/dovecot/conf.d/ doveadm-Dv user pol@gr4.lan Debug: Loading modules from directory: /usr/lib/dovecot/modules/doveadm Debug: Skipping module doveadm_acl plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib1@_doveadm_acl plugin.so: undefined symbol: acl_user_moc ule (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_quota_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/11b10_doveadm_quota_plugin.so: undefined symbol: quota_us er module (this is usually Intentional, so just ignore this message) Debug: Module loaded: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_sieve_plugin.so Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/1ib20_doveadm_fts_plugin.so: undefined symbol: fts_backend_ rescan (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_flatcurve plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/libdoveadm_fts_flatcurve_plugin.so: undefined syn bol: fts flatcurve_user_module (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_mail_crypt plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadn/libdoveadm_mail_crypt_plugin.so: undefined symbol: c rypt_acl_setting_parser_info (this is usually intentional, so just ignore this message) Jan 24 18:51:29 Debug: Loading modules from directory: /usr/lib/dovecot/modules/doveadm Jan 24 18:51:29 Debug: Skipping module doveadm_acl_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/libie_doveadm_acl_plugin.so: undefined symb ol: acl user module (this is usually intentional, so just ignore this message) Jan 24 18:51:29 Debug: Skipping nodule doveadm_quota_plugin, because diopen() failed: /usr/lib/dovecot/modules/doveadm/lib1@_doveadm_quota_plugin.so: undefined this message) symbol : quota_user_module (this is usually intentional, so just ignore Jan 24 18:51:29 Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib20_doveadm_fts_plugin.so: undefined symb Fol: fts backend_rescan (this is usually intentional, so just ignore this message) Jan 24 18:51:29 Debug: Skipping module doveadm_fts_flatcurve_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/libdoveadm_fts_flatcurve_plugin.s o: undefined symbol: fts flatcurve_user_module (this is usually intentional, so just ignore this message) Skipping module doveadm_mail_crypt plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/libdoveadm_mail_crypt_plugin.so: und Jan 24 18:51:29 Debug: ef ined symbol: crypt_acl_setting_parser info (this is usually intentional, so just ignore this message)
// this is normal
Jan 24 18:51:29 doveadm(pol@gr4.lan) <2777><>: Debug: auth-master: userdb lookup (pol@gr4, lan): Started userdb lookup Jan 24 18:51:29 doveadm(pol@gr4.lan) <2777>>: Debug: auth-master: conn unix:/run/dovecot/auth-userdb: Connecting Jan 24 18:51:29 doveadm(pol@gr4.lan) <2777><>: Debug: auth-master: conn unix:/run/dovecot/auth-userdb (pid=2693,uid=e): Client connected (fd=9) Jan 24 18:51:35 doveadm(pol@gr4.lan) <2777>: Debug: auth-master: conn unix:/run/dovecot/auth-userdb (pid=2693,uid=0): auth input: //why its empty ??? on passwd file its not Jan 24 18:51:35 doveadm(pol@gr4.lan) <2777>: Error: auth-master: userdb lookup(pol@gr4.lan): Auth USER Lookup failed //help ! Jan 24 18:51:35 doveadm(pol@gr4.lan) <2777><>: Debug: auth-master: userdb lookup(polegr4.lan): auth USER Input: Jan 24 18:51:35 doveadm(pol@gr4.lan) <2777>>: Debug: auth-master: userdb lookup(pol@gr4.lan): Userdb lookup failed userdb lookup: Internal error occurred. Refer to server log for more information. Jan 24 18:51:35 Debug: auth-master: conn unix:/run/dovecot/auth-userdb (pid=2693,uid=0): Disconnected: Connection closed (fd=9) field value
Thank for help.
On 24/01/2026 20:21 EET heschung.esteban--- via dovecot <dovecot@dovecot.org> wrote:
Hello, I’m trying to connect my Windows Active Directory to Dovecot 2.4.1 via LDAPS with a self-signed certificate. Authentication works correctly using the template method. I’m using a DN template for the bind DN. The ldap_base and passdb_ldap_filter field is present in my config because its required, otherwise it doen't work, maybe a internal requirement. Authentication succeeds, but sending mail fails.
ldap_uris = ldaps://gr4.lan ldap_base = cn=Users,dc=gr4,dc=lan ssl_client_require_valid_cert = no # self-signed certificate
passdb { driver = ldap passdb_ldap_filter = (objectClass=*) passdb_ldap_bind = yes bind_userdn = cn=%{user},cn=Users,dc=gr4,dc=lan }
userdb { driver = static args = uid=vmail gid=vmail }
Try setting
log_debug=category=auth
restart dovecot and check logs?
Aki
an 24 19:51:57 auth: Debug: conn unix:/run/dovecot/auth-userdb (pid=3125,uid=0): Server accepted connection (fd=21) 1 protocol=doveadm an 24 19:51:57 auth: Debug: master in: USER an 24 19:51:57 auth(pol): Debug: static: Performing userdb lookup an 24 19:51:57 auth (pol): Debug: Idap: Performing passdb lookup an 24 19:51:57 auth (pol): Debug: Idap: pass search: base=cn=Users,dc=gr4,dc=lan scope subtree filter=(&(objectClass=user) (SAMAccountName=pol)) fields= an 24 19:51:58 auth (pol): Debug: Idap: Finished passdb lookup an 24 19:52:00 auth (pol): Debug: static: Finished userdb lookup an 24 19:52:03 auth: Debug: userdb out: FAIL 1 an 24 19:52:03 auth: Debug: conn unix:/run/dovecot/auth-userdb (pid=3125,uid=0): auth-master client: Disconnected: Connection closed (fd=21)
I don't understand anything, why is it using filter fields etc when I'm asking it to use the template format ???
Actually now that I look at your config it cannot be valid 2.4.1 config anyways.
this should be valid:
passdb ldap { bind = yes bind_userdn = cn=%{user},cn=Users,dc=gr4,dc=lan }
userdb static { fields { uid=vmail gid=vmail } }
Also can you provide doveconf -n?
Aki
On 24/01/2026 21:00 EET ByteWave via dovecot <dovecot@dovecot.org> wrote:
an 24 19:51:57 auth: Debug: conn unix:/run/dovecot/auth-userdb (pid=3125,uid=0): Server accepted connection (fd=21) 1 protocol=doveadm an 24 19:51:57 auth: Debug: master in: USER an 24 19:51:57 auth(pol): Debug: static: Performing userdb lookup an 24 19:51:57 auth (pol): Debug: Idap: Performing passdb lookup an 24 19:51:57 auth (pol): Debug: Idap: pass search: base=cn=Users,dc=gr4,dc=lan scope subtree filter=(&(objectClass=user) (SAMAccountName=pol)) fields= an 24 19:51:58 auth (pol): Debug: Idap: Finished passdb lookup an 24 19:52:00 auth (pol): Debug: static: Finished userdb lookup an 24 19:52:03 auth: Debug: userdb out: FAIL 1 an 24 19:52:03 auth: Debug: conn unix:/run/dovecot/auth-userdb (pid=3125,uid=0): auth-master client: Disconnected: Connection closed (fd=21)
I don't understand anything, why is it using filter fields etc when I'm asking it to use the template format ???
dovecot mailing list -- dovecot@dovecot.org To unsubscribe send an email to dovecot-leave@dovecot.org
Indeed, the driver isn't working, but I used this internet example because it's difficult to copy and paste (virtual machine). I'll try to provide everything. Besides, the filter is mandatory; otherwise, during authentication, it tells me the filter is missing and refuses to connect (just like ldap_base), but the documentation clearly states that they are unnecessary...
2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf
Pigeonhole version 2.4.1-4 (0a86619f)
OS: Linux 6.12.63+deb13-amd64 x86_64 Debian 13.3 ext4
Hostname: deb13
4 default setting changes since version 2.4.0
dovecot_config_version = 2.4.0 auth_mechanisms = plain login auth_username_format = %{user|username|lower} debug_log_path = /var/log/dovecot-debug.log dovecot_storage_version = 2.4.0 fts_autoindex = yes fts_autoindex_max_recent_msgs = 999 fts_search_add_missing = yes info_log_path = /var/log/dovecot.log ldap_base = cn=Users,dc=gr4,dc=lan ldap_uris = ldaps://gr4.lan log_debug = category=auth mail_driver = mdbox mail_gid = vmail mail_home = /home/%{user | username} mail_inbox_path = /var/vhosts/%{user} mail_path = /var/vhosts/%{user} mail_privileged_group = mail mail_uid = vmail protocols { imap = yes lmtp = yes } ssl = required ssl_client { require_valid_cert = no } passdb ldap { bind = yes bind_userdn = cn=%{user},cn=Users,dc=gr4,dc=lan filter = (&(objectClass=user)(sAMAccountName=%{user})) } userdb static { fields { gid = vmail uid = vmail } } namespace inbox { inbox = yes mailbox Drafts { special_use = "\\Drafts" } mailbox Junk { special_use = "\\Junk" } mailbox Trash { special_use = "\\Trash" } mailbox Sent { special_use = "\\Sent" } mailbox "Sent Messages" { special_use = "\\Sent" } } service imap-login { inet_listener imap { port = 0 } inet_listener imaps { port = 993 ssl = yes } } service pop3-login { inet_listener pop3 { } inet_listener pop3s { } } service submission-login { inet_listener submission { } inet_listener submissions { } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service imap { } service pop3 { } service submission { } service auth { unix_listener auth-userdb { } unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service auth-worker { } service dict { unix_listener dict { } } ssl_server { cert_file = /etc/dovecot/private/dovecot.pem key_file = /etc/dovecot/private/dovecot.key } protocol lmtp { postmaster_address = admin@gr4.lan }
participants (3)
-
Aki Tuomi
-
ByteWave
-
heschung.esteban@gmail.com