On 02/14/2014 08:27 AM, Steffen Kaiser wrote:

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

On Fri, 7 Feb 2014, matthias lay wrote:

...

I experienced that if a Mailaddress matches several users the delivery is aborted.

---

dovecot: auth: Error: ldap(christian.test@securepoint.de): LDAP search returned multiple entries dovecot: auth: ldap(christian.test@securepoint.de): unknown user dovecot: lda: Error: user christian.test@securepoint.de: Auth USER lookup failed

now my question, is there a way to have a mail like that delivered to all users that matches the lookup? havent found anything in the docs.

This is a job of your MTA.

Hi Steffen,

MTA is qmail and doesnt know anything about users. dovecot uses usernames for mailboxes. lets say

/var/mail/userA/Maildir /var/mail/userB/Maildir

both users have mailaddr XY@example.com mapped in Active Directory. Now when mails arrive lda is called like

dovecot-lda -d XY@example.com mailto:dafan.zhai@securepoint.de -m INBOX

and theres my problem.

Hi,

Integrating qmail and active directory pretty much requires you to use qmail-ldap. without it you need to much bubblegum and band aids for it to be suitable for a (publicly accessible) production environment. And I can't see how you wouldn't eventually run into problems without each user having a unique email address.

In a pure qmail environment, I might work around the problem by giving each user a unique mailaddress, then create a user XY and use a .qmail file to override the LDA defaultdelivery and have it forward to the various users, and not deliver to its own maildir. But you still miss important features like validrcptto and smtpauth if qmail can't talk to AD.

But with qmail-ldap for sure you can set up multiple users with the same alias and it works. ie the users are configured with userPrincipal as mail address with an alias of XY@domain.com, then mails sent to XY@domain.com will deliver to all users.

I documented my sandbox qmail-ldap/dovecot system here, maybe it is useful to you:

http://cocnm.computerisms.ca/index.php/Install_Qmail-ldap,_Dovecot,_and_Rela...

-- Computerisms Bob Miller
867-334-7117 / 867-633-3760 http://computerisms.ca

On Fri, 2014-02-14 at 12:07 +0100, Steffen Kaiser wrote:

On Fri, 14 Feb 2014, matthias lay wrote:

...

On 02/14/2014 08:27 AM, Steffen Kaiser wrote:

...

On Fri, 7 Feb 2014, matthias lay wrote:

...

I experienced that if a Mailaddress matches several users the delivery is aborted.

---

dovecot: auth: Error: ldap(christian.test@securepoint.de): LDAP search returned multiple entries dovecot: auth: ldap(christian.test@securepoint.de): unknown user dovecot: lda: Error: user christian.test@securepoint.de: Auth USER lookup failed

now my question, is there a way to have a mail like that delivered to all users that matches the lookup? havent found anything in the docs.

This is a job of your MTA.

MTA is qmail and doesnt know anything about users. dovecot uses usernames for mailboxes. lets say

/var/mail/userA/Maildir /var/mail/userB/Maildir

both users have mailaddr XY@example.com mapped in Active Directory. Now when mails arrive lda is called like

dovecot-lda -d XY@example.com mailto:dafan.zhai@securepoint.de -m INBOX

and theres my problem.

You have implicitly created mail aliases for your users. qmail has to resolve this alias "XY" into the users A and B.

You could wrap your call to the Dovecot LDA by a script resolving the aliases somehow, e.g.:

#!/bin/bash

tmpf=/tmp/split.$$.tmp # save the message in case we have multiple recipients cat - >$tmpf ldapsearch "mailtarget=$1" samaccountname |
awk '$1 == "sAMAccountName:" { print $2 } ' |
while read uid; do dovecot-lda -d "$uid" ..... < $tmpf rc=$? if test $rc -gt 0; then rm -f $tmpf exit $rc fi done rm -f $tmpf

adjust ldap query and attribute names and call to MDA.

This is not really nice, because you cannot handle individual problems, e.g. what shall happen if delivery to userB fails? Shall userA get the message, shall delivery to userA succeeded, but to retried to userB? Currently the first error is returned to qmail and probably one user gets the same message again and again, because of a problem of another user's mailbox. You could return $rc at the very end, then qmail gets the success status of the delivery attemp to the last user.

I wouldn't do such stuff in a non-private environment.

Hi,

so not much to do on the qmail side. and thats the reason everything user related is done in dovecot itself.

ok

...but if nobody knows if its possible inside the dovecot lookup process, a new/seperate lookup process that calls dovecot-lda with the username instead of the mailaddress might be the only opportunity.

As I understand the original problem, you need one mail to be delivered to several users, which means you need to figure out how to alias or forward. Steffen's approach is a super good idea I intend to stuff into my back pocket, and is probably worth pursuing given your usage case.

Other than that, and based on what I know, I would still be inclined to try and solve this by creating a local user and configuring a .qmail file to forward the mails to AD users, but tweaking your defaultdelivery to accommodate a per-user .qmail file might be tricky or impossible in your situation. A global sieve script might be another approach to forwarding mails from a virtual address to valid users, but I haven't implemented one, so I can't say if it fits your situation or provide advice on configuring one. Another approach could be setting up a mailing list, where the list address is the common address that delivers to subscribed users. Perhaps delivery to a single user and a shared folder might provide a usable end result as well...

Whatever you end up doing, I am interested to hear what works for you in the end...

Greetz Matze