Hello,

I've notice this before, and the only thing I found, is to put your 2 OUs (Employees and Partitime) in another OU (called "Companyusers" for example).

After this, you set the search base to this new OU.

Nicolas

Oh, here's another way if you cannot config AD to allow search from root dn (dc=example,dc=com): Uses LDAP query files in Postfix instead of one, and use different base dn (ou=Employees, ou=Parttime) in them. For example:

Original one:

smtpd_sender_login_maps = proxy:ldap:/etc/postfix/ad_sender_login_maps.cf

We now use two query files instead:

smtpd_sender_login_maps =
    proxy:ldap:/etc/postfix/ad_sender_login_maps_employees.cf,
    proxy:ldap:/etc/postfix/ad_sender_login_maps_partime.cf

Update ad_sender_login_maps_employees.cf to use ou=Employees as search base dn:

search_base     = ou=Employees,dc=example,dc=com

Update ad_sender_login_maps_partime.cf to use ou=Parttime as search base dn:

search_base     = ou=Parttime,dc=example,dc=com

That's all. And replace other LDAP queries the same way.

Again, please try to configure AD to allow searching from root dn (dc=example,dc=com) first.

You can use this style in Dovecot too. For example:

#
# Original settings
#
userdb {
    args = /etc/dovecot/dovecot-mysql.conf
    driver = ldap
}

passdb {
    args = /etc/dovecot/dovecot-mysql.conf
    driver = ldap
}

Just add more userdb and passdb for another OU like below:

# For users under ou=Employees
userdb {
    args = /etc/dovecot/dovecot-mysql-employees.conf
    driver = ldap
}

passdb {
    args = /etc/dovecot/dovecot-mysql-employees.conf
    driver = ldap
}

# For users under ou=Parttime
userdb {
    args = /etc/dovecot/dovecot-mysql-parttime.conf
    driver = ldap
}

passdb {
    args = /etc/dovecot/dovecot-mysql-parttime.conf
    driver = ldap
}

I'm sure I already uncheck the box(protect object from accidental deletion). But somehow it won't allow me to move the OU into the new OU, until I rename the New OU into the same name like root.

Anyway, it has been several days, everything work fine, so I'm gonna leave it as it is.
Not going to make any other changes.
You guys are awesome!!

I'm stumbling another problem though,
The new iredmail server is using the same mail domain as the old server (run on solaris system).
I asked my boss if it's okay to change the mx  so it will point to new iredmail server, and he said no.
He would like to try it first before using iredmail completely.

So I'm wondering, if it is possible to make the mx pointed to New Iredmail server, then from there it will receive the email which recipient have logon at least once to iredmail (means their directory already created in /var/vmail/vmail1) then if it's not there, it will pass the emails to the old email server.

Zhang, should I open up new topic for this?

thanks in advance!