I've already accessed cluebringer via httpS - no difference.

I questioned about iRedAPD because white-/blacklisting per email-address does not work (set up in iRedAdminPro).

Any hints?

iRedMail.tips:
-----------------
Policyd (cluebringer):
    * Configuration files:
        - /etc/cluebringer/cluebringer.conf
        - /etc/cluebringer/cluebringer-webui.conf
    * RC script:
        - /etc/init.d/postfix-cluebringer
    * Database:
        - Database name: cluebringer
        - Database user: cluebringer
        - Database password: <not shown here...>

Yes, it asks for username/password but no combination works.

In iredadmin/settings.ini I saw that that setting:
[policyd]

# Enable policyd integration: True, False.
enabled = False

Does that matter? Nevertheless iRedAdminPro allows us to change individual white-/blacklisting.

iredapd.ini:
-------------

[general]
# Listen address and port.
listen_addr = 127.0.0.1
listen_port = 7777

# Run as a low privileged user.
# If you don't want to create one, you can try 'nobody'.
run_as_user = iredapd

# Background/daemon mode: yes, no.
# Run iRedAPD as daemon, detach iredapd from terminal.
run_as_daemon = yes

# Path to pid file.
pid_file        = /var/run/iredapd.pid

# Log type: file.
# Set 'log_file = /dev/null' if you don't want to keep the log.
log_type        = file
log_file        = /var/log/iredapd.log

# Log level: info, error, debug.
log_level = info

# Backend: ldap, mysql, pgsql.
backend = ldap

[ldap]
# For ldap backend only.
# LDAP server setting.
# Uri must starts with ldap:// or ldaps:// (TLS/SSL).
#
# Tip: You can get binddn, bindpw from /etc/postfix/ldap_*.cf.
#
uri = ldap://127.0.0.1:389
binddn = cn=vmail,dc=<not shown here...>,dc=xx
bindpw = <not shown here...>
basedn = o=domains,dc=<not shown here...>,dc=xx

# Enabled plugins.
#   - Plugin name is file name which placed under 'src/plugins/' directory.
#   - Plugin names MUST be seperated by comma.
#
# Available plugins:
#   * ldap_domain_wblist: per-domain white/blacklist support.
#       Note: If you want to enable this plugin, it's better to make it the
#             first one in enabled plugin list.
#   * ldap_maillist_access_policy: mail list deliver restrictions.
#   * block_amavisd_blacklisted_senders: per-user white/blacklist support.
plugins = ldap_maillist_access_policy, block_amavisd_blacklisted_senders

[sql]
# For MySQL and PostgreSQL backends
server      = 127.0.0.1
port        = 3306
db          = vmail
user        = vmail
password    = <not shown here...>

# Enabled plugins.
#   - Plugin name is file name which placed under 'src/plugins/' directory,
#     starts with 'sql_'.
#   - Plugin names MUST be seperated by comma.
plugins = ldap_maillist_access_policy, block_amavisd_blacklisted_senders

That's exactly what is NOT working.

Thanks, I'll wait.

Didn't change a thing. Login to iRedAdmin is working like a charm.

Here it is:

<Directory /usr/share/postfix-cluebringer-webui/webui/>
    DirectoryIndex index.php
    Options ExecCGI
    Order allow,deny
    #allow from 127.0.0.1
    allow from all

    AuthType basic
    AuthName "Authorization Required"

    AuthBasicProvider ldap
    AuthzLDAPAuthoritative   Off

    AuthLDAPUrl   ldap://127.0.0.1:389/o=domains,dc=<not shown here>,dc=<not shown here>?mail?sub?(&(objectclass=mailUser)(accountStatus=active)(domainGlobalAdmin=yes))

    AuthLDAPBindDN "cn=vmail,dc=<not shown here>,dc=<not shown here>"
    AuthLDAPBindPassword "<not shown here...>"

    Require valid-user
</Directory>

Thank you!

Apache config file looks fine. No idea yet, sorry.

Does this admin account (postmaster@xxx) placed under LDAP dn "o=domainAdmins,dc=xx,dc=xx"?

We promoted a standard user to "globalAdmin" - his account is able to login now.
It's ok for us now - many thanks for your help!

Best,
Achim