Postfix/Dovecot multiple authentication against Active Directory

Question

So I have working mail server which authenticates against active directory. Everything works fine until I try to add a secondary authentication backend..

Server info:

Server OS: CentOS 7.1.1503
Postfix version: 2.10.1
Dovecot version: 2.2.10

At the moment mine configuration looks like this:

Postfix Configuration files:

/etc/postfix/main.cf

virtual_mailbox_base = /homes/vmail/homes 
virtual_mailbox_maps = ldap:/etc/postfix/ldap-users-primary.cf 
virtual_alias_maps = ldap:/etc/postfix/ldap-groups-primary.cf
virtual_uid_maps = static:989 
virtual_gid_maps = static:987

ldap-users-primary.cf

server_host = 192.168.250.200
search_base = cn=Users, dc=domain, dc=local
version = 3
query_filter = (&(objectclass=person)(mail=%s))
result_attribute = samaccountname
result_format = %s/
bind = yes
bind_dn = [email protected]
bind_pw = password

ldap-groups-primary.cf

server_host = 192.168.250.200
search_base = ou=Email_Groups, dc=domain,dc=local
version = 3
query_filter = (&(objectclass=group)(mail=%s))
leaf_result_attribute = mail
special_result_attribute = member
bind = yes
bind_dn = [email protected]
bind_pw = password
start_tls = no

Dovecot configuration files:

/etc/dovecot/conf.d/10-auth.conf

passdb {
driver = ldap
args = /etc/dovecot/dovecot-ldap-primary.conf
}

userdb {
driver = static
args = uid=989 gid=987 home=/homes/vmail/homes/%u
}

dovecot-ldap-primary.conf

hosts = 192.168.250.200
base = cn=Users, dc=domain, dc=local
ldap_version = 3
auth_bind = yes
auth_bind_userdn = domain\%u

All the above setup is working fine and doesn't cause any problems. Until I try to add secondary domain controller..

To do that I have created new configuration files: ldap-users-secondary.cf, ldap-groups-secondary.cf, dovecot-ldap-secondary.conf.

The only thing that is different in those files are and IP address of server (it just points to secondary domain controller). If I use those files alone everything works just fine. But if I modify /etc/postfix/main.cf like this:

virtual_mailbox_base = /homes/vmail/homes 
virtual_mailbox_maps = ldap:/etc/postfix/ldap-users-primary.cf, ldap:/etc/postfix/ldap-users-secondary.cf
virtual_alias_maps = ldap:/etc/postfix/ldap-groups-primary.cf, ldap:/etc/postfix/ldap-groups-secondary.cf
virtual_uid_maps = static:989 
virtual_gid_maps = static:987

And /etc/dovecot/conf.d/10-auth.conf

passdb {
driver = ldap
args = /etc/dovecot/dovecot-ldap-primary.conf
}

passdb {
driver = ldap
args = /etc/dovecot/dovecot-ldap-secondary.conf
}

userdb {
driver = static
args = uid=989 gid=987 home=/homes/vmail/homes/%u
}

It just stops working and starts giving out these errors:

NOQUEUE: reject: RCPT from localhost[127.0.0.1]: 451 4.3.0 <[email protected]>: Temporary lookup failure;

Anyone can help me with this?

Answer 1

It turns out that Postfix and Dovecot both allow failover with multiple ldap hosts in the ldap configs. As far as I can tell, though, the configs have to be the same on all the LDAP servers. At least for postfix.

On Postfix, this does NOT work reliably :

virtual_mailbox_maps = ldap:/etc/postfix/ad-users-dc-1.cf, ldap:/etc/postfix/ad-users-dc-2.cf

This does work. In main.cf :

virtual_mailbox_maps = ldap:/etc/postfix/ad-users.cf

... and in the ad-users.cf file :

server_host     = 192.168.44.75,192.168.44.76
server_port     = 389
version         = ...
bind            = ...
start_tls       = ...
bind_dn         = CN=...
bind_pw         = ...
... etc

In Dovecot, this works. In your ldap target config file :

hosts   = 192.168.44.75:389, 192.168.44.76:389

Answer 2

Solution was pretty simple.. Just as @sam_pan_mariusz sugested instead of IP address I've putted DNS name. Runned some testing and everything works as it should.