1 Topic by msh

  • msh
  • Member
  • Offline
  • Registered: 2026-09-16
  • Posts: 1

Topic: Active Directory integration in Dovecot

==== REQUIRED BASIC INFO OF YOUR IREDMAIL SERVER ====
- iRedMail version (check /etc/iredmail-release): 1.8.8
- Deployed with downloadable installer
- Linux/BSD distribution name and version: Debian13
- Store mail accounts: LDAP
- Web server (Apache or Nginx): Nginx
- Manage mail accounts with iRedAdmin-Pro? No
- [IMPORTANT] Related original log or error message is required if you're experiencing an issue.
====

I installed iredmail 1.8.8 with OpenLDAP on Debian13 and configured the integration with ActiveDirectory according to the official instructions

The connection between Dovecot and AD via LDAP is not working. The diagnostics show that Dovecot is using the configuration from the dovecot.conf file and is not taking into account the connection parameters in the dovecot-ldap.conf file.

Example of an error:

# telnet localhost 143
Trying ::1...
Connected to localhost.
Escape character is '^]'.
* OK [CAPABILITY IMAP4rev1 LOGIN-REFERRALS ID ENABLE IDLE SASL-IR LITERAL+ STARTTLS AUTH=PLAIN AUTH=LOGIN] Dovecot ready.
. login mailuser@staff.local ********
. NO [AUTHENTICATIONFAILED] Authentication failed.
==========================================

dovecot-ldap.conf:

hosts           = pc01.staff.local:389
ldap_version    = 3
auth_bind       = yes
dn              = cn=intmail2-ldap,dc=staff,dc=local
dnpass          = ************
base            = ou=chelgu,dc=staff,dc=local
scope           = subtree
deref           = never
debug_level     = 0

# Below two are required by command 'doveadm mailbox ...'
iterate_attrs   = userPrincipalName=user
iterate_filter  = (&(userPrincipalName=*)(objectClass=person)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))

user_filter     = (&(userPrincipalName=%u)(objectClass=person)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))
pass_filter     = (&(userPrincipalName=%u)(objectClass=person)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))
pass_attrs      = userPassword=password
default_pass_scheme = CRYPT
user_attrs      = mail=master_user,mail=user,=home=/var/vmail/vmail1/%Ld/%Ln/,=mail=maildir:~/Maildir/
============================================

The output of doveconf -n shows the default LDAP connection parameters from the dovecot.conf file.

***
ldap_auth_dn = cn=vmail,dc=staff,dc=local
ldap_auth_dn_password = # hidden, use -P to show it
ldap_base = o=domains,dc=staff,dc=local
ldap_uris = ldap://127.0.0.1:389
***

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2 Reply by gautamabuddha

  • gautamabuddha
  • Member
  • Offline
  • Registered: Today
  • Posts: 1

Re: Active Directory integration in Dovecot

Absolutely same problem. I installed iRedMail with integration with AD two years ago, and all worked fine.
Couple days ago i set up a new installation. Postfix is OK, but Dovecot is not. I found a fresh official docs (HowTo), which says, that in current version (2.4.1-4 on debian 13.6) all settings must be done in dovecot.conf.
As user i used a mail attribute instead of mailRoutingAddress:
user = %{ldap:mail}
Also i used this settins to log login attempts:
auth_verbose = yes
auth_debug_passwords = yes
Then restart dovecot service and try to login as described in iRedMail doc (telnet localhost 143 and so on). When login fails, type this:
journalctl -e -u dovecot
It will show details about unsuccessful login attempt.
When i add this
passdb ldap {
  bind_userdn = %{user}
  bind = yes
}
in log i see, that in AD is no mail attribute. How so?
When i remove lines
  bind_userdn = %{user}
  bind = yes
in log i see, that in AD is no mail usePassword attribute.
I don't know, what to do more. Any suggestions, please?