Hello everyone, I'm trying to setup lldap together with maddy mail server (https://maddy.email/reference/auth/ldap/) The problem I have is that maddy sends the email address as username and I have no idea if I can change the dn_template or filter to allow this behavior to match any results in lldap.

imap/sasl: authentication failed        {"reason":"no auth. provider accepted creds, last err: auth.ldap: search: LDAP Result Code 50 \"Insufficient Access Rights\": No user currently bound","src_ip":"xxx:42058","username":"test@sub.example.com"}

or

imap/sasl: authentication failed        {"reason":"no auth. provider accepted creds, last err: unknown credentials","src_ip":"xxx:51592","username":"test@sub.example.com"}

I'm not really experienced with ldap yet so I tried different filter's like any combinations of mail_attribute and username with

filter "(&(objectClass=posixAccount)({mail_attribute}={username}))"

without any luck. In maddy they say to change "auth_map (see documentation page for used storage backend)" which would be lldap but I didn't found any option like this

that was fast

yeah I was trying it for an hour already, but I actually looked at the error again which said 'Insufficient Access Rights' so I looked up the docs again and saw that when filter is used a "bind" has to be used with a valid accoutn to lookup the data. So I had to provide an account for it to lookup. my final maddy config is thus:

auth.ldap local_authdb {
    urls ldap://lldap:3890

    bind plain "cn=admin,ou=people,dc=example,dc=com" "password_of_user_admin"
    base_dn "dc=example,dc=com"
    filter "(&(|(uid={username})(mail={username}))(objectClass=person))"

    starttls off
    debug off
    connect_timeout 1m
}

nice! You might want to use a service account with fewer privileges (member of lldap_strict_readonly for instance), but otherwise admin is good as well

Thanks for the info! I'm just testing it out right now before bringing it to production so I will make sure to do that there. I can create a PR in the next days sure

Thanks a lot!

Thank you for such an awesome and lightweight tool!