Re: Does Dovecot LDAP auth support LDAP referral

[Xuan Jia]

Hello Sami,

Thanks.


*From:* Sami Ketola
*Sent:* Friday, Feb 2, 2018 9:17 GMT
*To:* Xuan Jia
*Cc:* dovecot@dovecot.org
*Subject:* Does Dovecot LDAP auth support LDAP referral


On 2 Feb 2018, at 10.38, Xuan Jia  wrote:

We using Dovecot with LDAP.
 From the beginning, we using GC LDAP query with port 3268 for email accounts.
For example, us...@our-organization.org (in the USA) with "base = 
dc=our-organization, dc=org" works fine.

But refer to this document:
https://wiki2.dovecot.org/AuthDatabase/LDAP
When we change the LDAP from 3268 to 389 and with TLS, the base should be 
changed like this:
"base = ou=usa, dc=our-organization, dc=org"

But if the user (user2) located in United Kingdom (ou=gbr), the user can not 
login.

When we debug with ldapsearch:
ldapsearch -ZZ -v -h dc.our-organization.org -p 389 -D 
'cn=auth_user,ou=usa,dc=our-organization,dc=org' -W -b 'dc=our-organization, 
dc=org' '(userPrincipalName=us...@our-organization.org)'
It can return user2 information with some "numReferences".

But in Dovecot, if "base = dc=our-organization, dc=org" it only reported auth 
error with timeout.

So my question is: does Dovecot LDAP auth support LDAP referral?
If Dovecot relies on OpenLDAP, it should be support.
If not, why and what is the walkthrough?

TBH, I don't think that it's supported. Looking at the source code at least it 
does not look it is.

What you could do is to have separate passdb for both ldap bases.
one that would query base = ou=usa, dc=our-organization, dc=org and one that 
would query
base = ou=gbr, dc=our-organization, dc=org

and then use skip=authenticated on the second passdb if user already found in 
first passdb.

Sami

Re: Does Dovecot LDAP auth support LDAP referral

[Sami Ketola]

> On 2 Feb 2018, at 10.38, Xuan Jia  wrote:
> 
> We using Dovecot with LDAP.
> From the beginning, we using GC LDAP query with port 3268 for email accounts.
> For example, us...@our-organization.org (in the USA) with "base = 
> dc=our-organization, dc=org" works fine.
> 
> But refer to this document:
> https://wiki2.dovecot.org/AuthDatabase/LDAP
> When we change the LDAP from 3268 to 389 and with TLS, the base should be 
> changed like this:
> "base = ou=usa, dc=our-organization, dc=org"
> 
> But if the user (user2) located in United Kingdom (ou=gbr), the user can not 
> login.
> 
> When we debug with ldapsearch:
> ldapsearch -ZZ -v -h dc.our-organization.org -p 389 -D 
> 'cn=auth_user,ou=usa,dc=our-organization,dc=org' -W -b 'dc=our-organization, 
> dc=org' '(userPrincipalName=us...@our-organization.org)'
> It can return user2 information with some "numReferences".
> 
> But in Dovecot, if "base = dc=our-organization, dc=org" it only reported auth 
> error with timeout.
> 
> So my question is: does Dovecot LDAP auth support LDAP referral?
> If Dovecot relies on OpenLDAP, it should be support.
> If not, why and what is the walkthrough?


TBH, I don't think that it's supported. Looking at the source code at least it 
does not look it is.

What you could do is to have separate passdb for both ldap bases.
one that would query base = ou=usa, dc=our-organization, dc=org and one that 
would query 
base = ou=gbr, dc=our-organization, dc=org

and then use skip=authenticated on the second passdb if user already found in 
first passdb.

Sami