https://github.com/lldap/lldap logo
Powered by
lostb1t - anyone had any luck with https://stal...
# troubleshooting
d
anyone had any luck with https://stalw.art?
I keep getting authention failed when authenticating from imap
tested with another ldap server and that worked
n
What are you trying to do? Send emails with it or getting it to use LDAP for logging in?
(by send emails, I mean send password recovery emails from LLDAP)
d
authentication with ldap
n
How did you set it up? What's your config?
d
Copy code
toml
#############################################
# LDAP Directory configuration
#############################################

[directory."default"]
type = "ldap"
address = "ldap://100.95.211.149:3890"
#base-dn = "ou=people,dc=sjoerdarendsen,dc=dev"
base-dn = "dc=sjoerdarendsen,dc=dev"
#base-dn="ou=built-in, dc=sjoerdarendsen,dc=dev"

[directory."default".bind]
#dn = "cn=admin,ou=built-in,dc=sjoerdarendsen,dc=dev"
dn = "uid=sarendsen,ou=people,dc=sjoerdarendsen,dc=dev"
secret = "REDACTED"

[directory."default".cache]
entries = 400
ttl = {positive = '1h', negative = '10m'}

[directory."default".options]
catch-all = true
#catch-all = { map = "(.+)@(.+)$", to = "info@${2}" }
subaddressing = true
#subaddressing = { map = "^([^.]+)\.([^.]+)@(.+)$", to = "${2}@${3}" }
superuser-group = "admin"

[directory."default".pool]
max-connections = 10
min-connections = 0
max-lifetime = "30m"
idle-timeout = "10m"
connect-timeout = "30s"

[directory."default".filter]
name = "(&(objectClass=person)(uid=?))"
email = "(&(objectClass=person)(|(mail=?)(mailAlias=?)(mailList=?)))"
verify = "(&(objectClass=person)(|(mail=*?*)(mailAlias=*?*)))"
#email = "(&(objectClass=person)(|(meh=?)(mailAlias=?)(mailList=?)))"
#verify = "(&(objectClass=person)(|(meh=*?*)(mailAlias=*?*)))"
expand = "(&(objectClass=person)(mailList=?))"
domains = "(&(objectClass=person)(|(mail=*@?)(mailAlias=*@?)))"

[directory."default".object-classes]
user = "person"
group = "groupOfUniqueNames"
#user = "posixAccount"
#group = "posixGroup"

[directory."default".attributes]
name = "uid"
description = ["principalName", "description"]
secret = "userPassword"
groups = ["memberOf", "member"]
email = "mail"
#email = "wut"
email-alias = "mailAlias"
quota = "diskQuota"
thats the stalwart config for ldap
im seeing sql queries in lldap being executed in when authenticating
n
Can you surround it with triple backticks?
For readability
d
done
n
Thanks
d
like i said im seeing queries being exevuted ( i can send log) but i dont see andy ldap sessions actually returning those results
which i find weird
n
Can you post the verbose LLDAP logs?
(verbose= true in the config)
Oh, if they require the password hash, we're not going to get along together
(the user's password)
That's a limitation due to the security design of LLDAP
d
they do seem to request the userPassword attribute
so its not in the logs with only verbose, but when using rust debug it will show the sql queries from stalwart
n
The log you have doesn't have any query for users of LLDAP
Maybe they're already cached
d
no let me enable debug hold on
it doesnt show with verbose
n
In stalwart
The queries that I see on LLDAP's side are only about the features supported by the LDAP server
d
this is with debug enabled.
this is the docs on passwords: https://stalw.art/docs/directory/users
do seem they try to get the password
n
Typically, applications will instead try to bind as the user to check the password and get their info
(apart from Synology since they want to work offline as well, but that's why we don't support Synology)
d
Copy code
2023-12-17T15:56:47.290533Z TRACE session{instance="imaptls" protocol=Imap remote.ip="172.17.0.1" remote.port=39722}: imap::core::client: event="read" data="1 AUTHENTICATE PLAIN\r\n" size=22
2023-12-17T15:56:47.290592Z TRACE session{instance="imaptls" protocol=Imap remote.ip="172.17.0.1" remote.port=39722}: imap::core::writer: event="write" data="+ \"\"\r\n" size=6
2023-12-17T15:56:47.451930Z TRACE session{instance="imaptls" protocol=Imap remote.ip="172.17.0.1" remote.port=39722}: imap::core::writer: event="write" data="1 NO [AUTHENTICATIONFAILED] Authentication failed\r\n" size=51
2023-12-17T15:56:47.474802Z TRACE session{instance="imaptls" protocol=Imap remote.ip="172.17.0.1" remote.port=39722}: imap::core::client: event="read" data="2 LOGIN test REDACTED\r\n" size=24
2023-12-17T15:56:47.474868Z TRACE session{instance="imaptls" protocol=Imap remote.ip="172.17.0.1" remote.port=39722}: imap::core::writer: event="write" data="2 NO LOGIN is disabled on the clear-text port.\r\n" size=48
2023-12-17T15:56:47.496792Z TRACE session{instance="imaptls" protocol=Imap remote.ip="172.17.0.1" remote.port=39722}: imap::core::client: event="read" data="3 LOGOUT\r\n" size=10
2023-12-17T15:56:47.496837Z DEBUG session{instance="imaptls" protocol=Imap remote.ip="172.17.0.1" remote.port=39722}: imap::core::session: Disconnecting client. event="disconnect"
2023-12-17T15:56:47.496855Z TRACE session{instance="imaptls" protocol=Imap remote.ip="172.17.0.1" remote.port=39722}: imap::core::writer: event="write" data="* BYE Stalwart IMAP4rev2 v0.4.0 bids you farewell.\r\n3 OK LOGOUT completed\r\n" size=75
n
So as is, stalwart isn't gonna work
d
hm cause they try to handle password validation themself?
n
Yep
d
yeah seems like they build SQL first
and then ldap as an afterthought
n
We don't "hash" the password in a recognizable form
It's an interactive zero knowledge proof
For better security when logging into the web UI
d
hm key. Thanks for the clarification. Ill bing it up with stalwart. As you said binding as the user might be the better way
😂
PreviousNext
Powered by