[Dovecot] dovecot not reconnecting to ldap after ldap restart

[Jared]

I've taken some time to try to reproduce my problem on my sandbox.  I 
was able to consistently reproduce it...

In the following scenario:
dovecot -> stunnel -> ldap server
when the ldap server is restarted, dovecot can no longer connect to the 
LDAP server through stunnel.

When I have dovecot connect directly to the ldap server (without 
SSL/TLS) and restart the server, dovecot works properly.  It can 
continue to authenticate when the LDAP server becomes available again.

So I'd like to try to not use stunnel with dovecot.  But how do I 
configure dovecot-ldap.conf to connect directly to the LDAP server with 
SSL/TLS?

I've tried:

hosts = ldaps://ldap.server.com
and
hosts = ldap.server.com:636

But neither work.

I didn't see another directive to use to turn SSL/TLS on in the conf 
file or in the docs.

Thanks,
-jared

On Mar 30, 2004, at 1:30 PM, Jared wrote:

> I upgraded dovecot two weeks ago from 0.99.10-0.rc2 to 
> 0.99.10.4-1woody1 (both from the woody backport packages from 
> braincells.com).
>
> Dovecot is using LDAP on a separate machine for authentication.  
> (through stunnel if it matters)
>
> At 4:00 am, the LDAP server stops, dumps the ldap database, and then 
> starts back up.  Because the LDAP server is stopped, anyone who tries 
> to authenticate during the few seconds will be denied.  This isn't a 
> big deal since it's 4:00 am.  However, twice in the past two weeks, it 
> appears that if dovecot can't connect to the LDAP server, it loses the 
> ability until dovecot is restarted.  It's only happened since I 
> upgraded, and it's only happened twice, presumably when someone was 
> trying to check their mail at the precise moment the LDAP server is 
> down.
>
> I get the following entry in mail.err:
>
> Mar 30 04:00:18 akbar dovecot-auth: LDAP: ldap_result() failed: Can't 
> contact LDAP server
> Mar 30 04:00:19 akbar dovecot-auth: LDAP: Can't connect to server: 
> localhost
> Mar 30 04:00:50 akbar last message repeated 36 times
> .
> .
> .
>
> The two times it has happened, ldap is responding properly (all other 
> services we provide which use LDAP still work), stunnel on the dovecot 
> machine is still running, and dovecot is still running, accepting IMAP 
> and POP connections, but failing at the authentication phase.
>
> Is there some change or bug in dovecot which would make this happen?  
> Or is there a problem with my set up?
>
> Thanks in advance for any ideas.
>
> -jared
>