Hello List,

The only passdb block in /pfx/etc/dovecot/dovecot.conf is:

passdb ldap { args = /pfx/etc/dovecot/dovecot-ldap.conf }

In /pfx/etc/dovecot/dovecot-ldap.conf:

auth_bind = no dn = cn=mymgr,dc=host,dc=tld dnpass = ******** default_pass_scheme = LDAP-MD5

In /pfx/etc/openldap/slapd.conf:

password-hash {MD5}

If I try:

$ /pfx/bin/ldapsearch <...>
| grep '^userPassword'
| sed -e 's;.*:: \(.*\)$;\1;'
| mimencode -u

...I get the correct password (MD5 hashed.)

According to wiki.dovecot.org/AuthDatabase/LDAP/PasswordLookups this should work, and indeed when starting dovecot it does not complain about:

'CRAM-MD5 mechanism can't be supported with given passdbs'

Instead it starts right up, but when a thunderbird client connects and tries authenticating with CRAM-MD5 it fails.

In the wiki page 'PasswordLookups' it mentions:

Supports non-plaintext authentication mechanisms (if returning plaintext/properly hashed passwords).

I've already verified that this works correctly with plaintext (CLEARTEXT in slapd.conf), but I really want to store the passwords in LDAP using some hash. Why doesn't LDAP-MD5 work as advertised?

What did the author mean by 'properly hashed passwords'? Thanks.

-- Eduard