I'm creating an e-mail server with postfix (v2.7.1 on Debian 6.0) where users and groups are stored in an LDAP server.

Users accounts works fine but I want to create e-mail aliases from group (any e-mail addressed to groupAbc@domain.tld would be sent to the e-mail address of each member of the groupAbc group).

My groups are posixGroup whose members are listed by a memberUid attribute:

dn: cn=groupAbc,ou=Groups,dc=domain,dc=tld
objectClass: CourierMailAlias
objectClass: posixGroup
objectClass: top
cn: groupAbc
gidNumber: 1001
maildrop: groupabc@domain.tld
memberUid: john-doe
memberUid: jane-doe

Here is my ldap-aliases.cf:

# cat /etc/postfix/ldap-aliases.cf
server_host =
version = 3
bind = yes
bind_dn = cn=ldap-reader,dc=domain,dc=tld
bind_pw = SECRET
search_base = dc=domain,dc=tld
query_filter = (&(objectClass=posixGroup)(mail=%s))
result_attribute = mail
special_result_attribute = memberUid
leaf_result_attribute = mail

When I try to send an e-mail to I get the following errors in syslog:

... postfix/cleanup[6601]: warning: dict_ldap_get_values[1]: search error 34: Invalid DN syntax
... postfix/cleanup[6601]: warning: dict_ldap_lookup: Had some trouble with entries returned by search: Invalid DN syntax
... postfix/cleanup[6601]: warning: 40ACF12106E: virtual_alias_maps map lookup problem for groupabc@domain.tld

Postfix is excepting a DN in the attribute I defined with special_result_attribute parameter. If I change the memberUid from "john-doe" to "uid=john-doe,ou=Users,dc=domain,dc=tld", e-mails sent to "groupabc@domain.tld" are delivered to john-doe's e-mail address.

I'm looking for a way to make Postfix do an LDAP search of the UID stored in memberUid attribute. I know it's possible on Zarafa's postfix flavour (http://doc.zarafa.com/7.0/Administrator_Manual/pt-BR/html/_ConfigureOpenLDAP.html) with options ldap_groupmembers_attribute, ldap_groupmembers_attribute_type and ldap_groupmembers_relation_attribute but can't find how to do it properly on standard Postfix.

  • 1
    I didn't see the mail attribute in your ldif file.
    – quanta
    Jun 8 '12 at 6:26

Your ldap config is wrong. Please use:

server_host =
version = 3
bind = no
query_filter = (&(objectClass=posixGroup)(maildrop=%s))
result_attribute = memberUid, mail

You can't use "bind = yes" here - this can't work. No group can/should bind (authenticate).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.