Thank you for the reply. I checked and indeed the domain name was set, I probably had entered the name values using one of the setup guides.

This explains the login item, but the main issue is still there. As the mailbox is shown as xxxyyy@domain.com, it's not really helpful since most people like to see the name of the person they're writing to. So I'd need to know if I can configure postfix/dovecot to link an xxxyyy account to a firstname.lastname value somehow. Can the AD "e-mail" field be used for this?

I did follow the tutorial, so that's why I'm already able to authenticate against AD. But as far as I see it does not mention cases where the AD domain names and mail domain names are different, or where the AD user name is different from the mail user name. In my case (xxxyyy@internal.domain.com in AD versus firstname.lastname@domain.com for mail), both are different. So I'm confused about which settings in the config files have to be adjusted to make this work transparently.

Here they are.

ad_sender_login_maps.cf

server_host     = dc1.internal.mydomain.com
server_port     = 389
version         = 3
bind            = yes
start_tls       = no
bind_dn         = vmail@internal.mydomain.com
bind_pw         = pw
search_base     = dc=internal,dc=mydomain,dc=com
scope           = sub
query_filter    = (&(userPrincipalName=%s)(objectClass=person)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))
result_attribute= userPrincipalName
debuglevel      = 0

ad_virtual_mailbox_maps.cf

server_host     = dc1.internal.mydomain.com
server_port     = 389
version         = 3
bind            = yes
start_tls       = no
bind_dn         = vmail@internal.mydomain.com
bind_pw         = pw
search_base     = dc=internal,dc=mydomain,dc=com
scope           = sub
query_filter    = (&(objectclass=person)(userPrincipalName=%s))
result_attribute= userPrincipalName
result_format   = %d/%u/Maildir/
debuglevel      = 0

dovecot-ldap.conf

hosts           = dc1.internal.mydomain.com:389
ldap_version    = 3
auth_bind       = yes
dn              = vmail@internal.mydomain.com
dnpass          = pw
base            = dc=internal,dc=mydomain,dc=com
scope           = subtree
deref           = never
user_filter     = (&(userPrincipalName=%u)(objectClass=person)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))
pass_filter     = (&(userPrincipalName=%u)(objectClass=person)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))
pass_attrs      = userPassword=password
default_pass_scheme = CRYPT
user_attrs      = =home=/var/vmail/vmail1/%Ld/%Ln/Maildir/,=mail=maildir:/var/vmail/vmail1/%Ld/%Ln/Maildir/

The LDAP queries against AD from the tutorial work and I'm also able to configure Thunderbird with the mail server as IMAP + SMTP host, using my AD account. But when I authenticate using xxxyyy (AD account), I'm still not allowed to send mails using firstname.lastname@mydomain.com or firstname.lastname@internal.mydomain.com. Yet, firstname.lastname@mydomain.com is the address filled in the "e-mail" field in AD.

To avoid a possible issue with the domain name, I already changed the UPN xxxyyy@internal.mydomain.com into xxxyyy@mydomain.com (I first added the root domain as an UPN suffix in the AD forest). But the main issue seems to be the autentication with the xxxyyy account format and then requiring a link with e-mail firstname.lastname@something.com.

I started to test with a regular mail client, just to be sure it's not a Roundcube config issue. But the behavior so far is the same.

Right now I'm not able to login with my e-mail address firstname.lastname@mydomain.com, so I can't really check the result. In AD, firstname.lastname is not an account so this could make sense. Isn't it possible with iRedmail to define aliases and just make one of those aliases the primary address? If so, I could keep xxxyyy@mydomain.com as one of the adresses and just add firstname.lastname@mydomain.com for every account in AD. Then, if that one could be made primary, every user that configures his client would stil be able to send/receive from firstname.lastname@mydomain.com.

*) The UPN is xxxyyy@mydomain.com. While I still need to provision AD with around 350 users, I'd prefer to keep it that way. Firstname.Lastname is just way too long for many people to use as a login.

*) I'd like to try, but that's mainly why I'm here. :-) I'm not familiar with the way the config files (and LDAP queries) are constructed. Can you tell me how to adjust the files then?

Hi ZhangHuangbin

I tried a few alternatives in the config files, but the result was never really satisfying. At some point I made the LDAP query look for either the UPN or sAMAccountname and then I was able to login with both xxxyyy and firstname.lastname. However, in the former case, I wasn't able to send out mails with the firstname.lastname@domain.com address (I got an error saying that the mailbox did not belong to xxxyyy)...

In the end, I modified the AD UPN of my accounts. Now that it's firstname.lastname@domain.com, I can keep the "original" config files from the tutorial. Since I can still use the pre-W2000 account (xxxyyy) to login to workstations, I guess this is the better approach for making it work.

In Thunderbird/Roundcube I can't login with my xxxyyy anymore, but since this is 100% e-mail related, users shouldn't complain about having to login with their e-mail address.

I'm already stumbling into additional questions, but I'll have a look at them first before opening another topic. Thanks for the assistance you provided!