[Dovecot] Apple od/ad authentication problem

[Troy Shafer]

Hello all.  Im pretty new to dovecot and postfix world. I'm completely stumped.

OS X 10.7.3, behind a Cisco asa NAT. 

When trying to authenticate (ssl or not) via the webmail interface I get this error...

NAT IP is the public ip I assigned. 

It doesn't work for an AD account or an account local to the Mac server. However it DOES work on the internal LAN. 

Feb 22 18:15:36 mail dovecot[3501]: auth: Error: od (username,natIP): verify plain: lookup failed for user: username

Feb 22 18:15:51 mail dovecot[3501]: auth: Error: od[getpwnam_ext](username,natIP): No record for user

I figured I'm missing something in the dovecot config.  I have followed apple's kb articles for AD webmail authentication and kerberos, and that works internally.