3

I am not experienced in this, so there might be some points that I am missing. Initially I tried to setup Cyrus Mail w/ SASL for AD authentication. After several tries, it failed to work.

I switched to Dovecot and authentication failed in Dovecot, too. So, I started troubleshooting:

  1. I created a user in AD and called it "vmail".
  2. ran `ldapsearch -x -h ad.example.com -D 'vmail' -W -b 'dc=example,dc=com' "([email protected])" and entered the password. The results were successful (returned the ldap user attributes)
  3. Then I ran ldapwhoami -x -W -D cn=vmail,dc=example,dc=com -h ad.example.com and entered the password. However, this script fails with

    ldap_bind: Invalid credentials (49)
       additional info: 80090308: LdapErr: DSID-0C0903A9, comment: AcceptSecurityContext error, data 52e, v1db1
    

Dovecot and Postfix both fail on parameters similar to this. In Dovecot and Postfix I setup password attribute as userPassword=password. AD authentication works (e.g I can log in to my Windows machine that is connected to domain, using [email protected]).

The "vmail" user is a domain administrator and administrator (I wanted to be sure that being administrator has nothing to do with binding). I really started to think that the problem is in Windows Server not allowing authentication with Linux machines (is that a possibility?) because everything in Linux is correct (at least it looks like it is)

I am using CentOS 7.1.1503 (Core) if it matters.

EDIT: After more troubleshooting I have found that if I don't specify the domain controllers, ldapwhoami succeeds and returns the user:

ldamwhoami -x -W -D vmail -h ad.example.com

However, dovecot still doesn't work. I set base = (empty) to check it out and it still failed to authenticate.

1
  • 1
    where is your vmail user? Does it INDEED reside under "dc=example,dc=com" - it's quite unlikely for a user be placed right at the top. You want to find out vamail's DN first, and use correct DN in -D parameter.
    – strongline
    Nov 20, 2015 at 14:22

0

You must log in to answer this question.

Browse other questions tagged .