Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to authenticate Dovecot against a Microsoft Active Directory on a Windows 2008 R2 Domain Controller. Dovecot (Version 2.2.9) is running on Ubuntu 14.04 (3.13.0-30-generic).

My Configs:


protocols = imap

service imap {
inet_listener = *:143

auth_username_format = %Lu
auth_mechanisms = plain login

disable_plaintext_auth = no
ssl = no

mail_location = maildir:/var/vmail/%u/Maildir

first_valid_uid = 1001
last_valid_uid = 1001

first_valid_gid = 1001
last_valid_gid = 1001

valid_chroot_dirs = /var/vmail

passdb {
      driver = ldap
      args = /etc/dovecot/dovecot-ldap.conf

userdb {
      driver = ldap
      args = /etc/dovecot/dovecot-ldap.conf

log_path = /var/log/dovecot.log
syslog_facility = local7


hosts = dc.testdomain.local
dn = CN=scanner,OU=SpecialUsers,DC=testdomain,DC=local
dnpass = scanner
ldap_version = 3
base = DC=testdomain,DC=local
scope = subtree
user_attrs = sAMAccountName=home
user_filter = (&(ObjectClass=user)(|(mail=%u)(sAMAccountName=%u)))
pass_attrs = sAMAccount=user,userPassword=password
pass_filter = (&(ObjectClass=user)(sAMAccountName=%u))
default_pass_scheme = plain

I'm testing my Config with "telnet ub14-dovecot 143" and following commands:

Connected to ub14-dovecot.
Escape character is '^]'.
a1 login scanner scanner
* OK Waiting for authentication process to respond..
* BYE Disconnected for inactivity during authentication.
Connection closed by foreign host.

The Log:

Jul 22 13:08:46 auth: Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth
Jul 22 13:08:46 auth: Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth
Jul 22 13:08:46 auth: Debug: Module loaded: /usr/lib/dovecot/modules/auth/
Jul 22 13:08:46 auth: Debug: Read auth token secret from /var/run/dovecot/auth-token-secret.dat
Jul 22 13:08:46 auth: Debug: auth client connected (pid=28292)
Jul 22 13:08:57 auth: Debug: client in: AUTH    1   PLAIN   service=imap    session=MQf5P8b+bACsEAgU    lip= rip=    rport=36972 resp=    <hidden>
Jul 22 13:08:57 auth: Debug: ldap(scanner,,<MQf5P8b+bACsEAgU>): pass search: base=DC=testdomain,DC=local scope=subtree filter=(&(ObjectClass=user)(sAMAccountName=scanner)) fields=uid,userPassword
Jul 22 13:11:46 imap-login: Info: Disconnected: Inactivity during authentication (disconnected while authenticating, waited 169 secs): user=<>, method=PLAIN, rip=, lip=, session=<MQf5P8b+bACsEAgU>
Jul 22 13:13:11 auth: Error: PLAIN(scanner,,<MQf5P8b+bACsEAgU>): Request 28292.1 timed out after 254 secs, state=1
Jul 22 13:13:11 auth: Debug: client in: CANCEL  1
Jul 22 13:14:11 auth: Info: ldap(scanner,,<MQf5P8b+bACsEAgU>): Shutting down
Jul 22 13:14:11 auth: Debug: client passdb out: FAIL    1   user=scanner    temp

As you can see I get a timeout from the AD. If i try to login with wrong credentials its the same. So I'm sure I have a error in my config. I'm just not able to find it.

share|improve this question

Here is my config and it's working

cat /etc/dovecot/dovecot-ldap.conf
hosts = dc01.mydomain.tld
base = dc=mydomain, dc=tld
ldap_version = 3
auth_bind = yes
auth_bind_userdn = seta-int\%u

And here is my Auth. config dovecot -n

auth_debug = yes
auth_username_format = %Lu
listen = *
mail_location = maildir:/home/vmail/%u/Maildir
mbox_write_locks = fcntl
passdb {
  args = /etc/dovecot/dovecot-ldap.conf
  driver = ldap
protocols = imap pop3
ssl_cert = </etc/pki/dovecot/certs/dovecot.pem
ssl_key = </etc/pki/dovecot/private/dovecot.pem
userdb {
  args = uid=vmail gid=vmail home=/var/vmail/%u
  driver = static

seta-int is my Windows2000 and previous compatibility domain as Windows requirement it only 8 characters long. My domain controler is Windows 2012 R2 and we only have 01 DC at the moment. And I see you using vmail but dovecot userdb is lookup from AD. When use vmail setup, your user db is static and located somewhere belong to vmail:vmail

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.