Closed NexZhu closed 7 months ago
Authentication is disabled unless TLS is used. You can put insecure_auth
directive into imap
block in config to disable that, but this is not recommended for production use for obvious reasons.
@foxcpp
Thanks. Tried with TLS also:
Without email domain:
openssl s_client -crlf -connect mx1.example.com:993
* OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR CHILDREN UNSELECT MOVE IDLE APPENDLIMIT AUTH=PLAIN AUTH=LOGIN COMPRESS] IMAP4rev1 Service Ready
1 login john password
1 NO Invalid credentials
No server log.
With email domain:
1 login john@example.com password
1 NO Invalid credentials
Server log:
imap: authentication failed {"reason":"no auth. provider accepted creds, last err: unknown credentials","src_ip":"114.254.3.12:35766","username":"john@example.com"}
Looking at the LDAP server log, maddy is using the whole john@example.com
instead of john
as {username}
.
Is there a way to use only the john
part in LDAP bind request?
LDAP config:
auth.ldap idm_example_com {
urls ldaps://idm.example.com:3636
bind off
dn_template "spn={username}@idm.example.com,dc=example,dc=com"
starttls off
debug off
connect_timeout 1m
}
@foxcpp Do you have any advice? Thanks!
Looking at the LDAP server log, maddy is using the whole john@example.com instead of john as {username}. Is there a way to use only the john part in LDAP bind request?
Since 0.7 this is possible using auth_map
directive as described in https://maddy.email/reference/global-config/
Describe the bug
I'm test my Maddy deployment with
telnet mx1.example.com 143
(host name is replaced for privacy)There's no any log on the server side, so I don't know what's going wrong. I'm using LDAP for auth, and no log on the LDAP server either.
Log files
No server log on connection or login
Configuration file
Environment information
Docker