can anybody help me connecting stalwart to my Samba AD?

[richy-66]

Hi,

i struggle connecting stalwart to my Samba LDAP Active Directory.

I am running stalwart 0.10.7 on top of a completly new and empty debian 12 bookworm.

anything runs smooth and perfectly, i already use it for more than a week now with some local users manually installed and like the great performance and clean setup. dns, dkim, dmarc, spf and acme work so easy and great, really like it.

so i wanted to go a step further and integrate it into the samba domain of my small company and started with a new instance of debain and stalwart.

what i have done so far:

my ldap config

and the lookup filters for samba i fond with the "attribute-editor" in the RSAT Tools.

this is what my debug log says when i try to log into the webamin. imap and smtp does work.

2025-01-05T16:55:30Z DEBUG HTTP request URL (http.request-url) listenerId = "https", localPort = 443, remoteIp = 192.168.111.99, remotePort = 54662, url = "/api/oauth"
2025-01-05T16:55:30Z DEBUG Authentication failed (auth.failed) listenerId = "https", localPort = 443, remoteIp = 192.168.111.99, remotePort = 54662, remoteIp = 192.168.111.99, accountName = "onlysambausername"
2025-01-05T16:55:47Z DEBUG HTTP connection ended (http.connection-end) listenerId = "https", localPort = 443, remoteIp = 192.168.111.69, remotePort = 58376, elapsed = 192515ms
2025-01-05T16:55:48Z DEBUG HTTP request URL (http.request-url) listenerId = "https", localPort = 443, remoteIp = 192.168.111.99, remotePort = 54662, url = "/api/oauth"
2025-01-05T16:55:48Z DEBUG Authentication failed (auth.failed) listenerId = "https", localPort = 443, remoteIp = 192.168.111.99, remotePort = 54662, remoteIp = 192.168.111.99, accountName = "[email protected]"

what did i overlook? what do i miss?

It is the acme certificate? i did not roll it out so far, as it is a internal machine.

Thanks,
Richy

[mdecimus]

Hi,

Try setting the log level to trace, authenticate again and then check your logs. You should see there the response from your LDAP server, that should help you to track down the issue.

[richy-66]

Thanks @mdecimus for your quick reply.

this is my trace-log when i try to login:
type":"rocksdb","_id":"rocksdb"}]}}", code = 200, size = 99
2025-01-06T22:10:47Z DEBUG HTTP request URL (http.request-url) listenerId = "https", localPort = 443, remoteIp = 192.168.111.70, remotePort = 55804, url = "/api/settings/list?prefix=directory.ad-see&"
2025-01-06T22:10:47Z TRACE Expression evaluation result (eval.result) listenerId = "https", localPort = 443, remoteIp = 192.168.111.70, remotePort = 55804, id = "server.http.allowed-endpoint", result = "Integer(200)"
2025-01-06T22:10:47Z TRACE Write batch operation (store.data-write) elapsed = 0ms, total = 2
2025-01-06T22:10:47Z TRACE HTTP request body (http.request-body) listenerId = "https", localPort = 443, remoteIp = 192.168.111.70, remotePort = 55804, contents = "", size = 0
2025-01-06T22:10:47Z TRACE Data store iteration operation (store.data-iterate) elapsed = 0ms
2025-01-06T22:10:47Z TRACE HTTP response body (http.response-body) listenerId = "https", localPort = 443, remoteIp = 192.168.111.70, remotePort = 55804, contents = "{"data":{"total":24,"items":{"attributes.class":"sAMAccountType","attributes.description":"description","attributes.email":"mail","attributes.email-alias":"mailAlias","attributes.groups":"memberOf","attributes.name":"displayName","attributes.quota":"diskQuota","attributes.secret":"unicodePwd","base-dn":"DC=see,DC=dornfeld,DC=at","bind.auth.dn":"CN=?,OU=see_user,DC=see,DC=dornfeld,DC=at","bind.auth.enable":"true","bind.auth.search":"true","bind.dn":"CN=bind,OU=see_user,DC=see,DC=dornfeld,DC=at","bind.secret":"4J.LgQmnZJu.fD5S","cache.entries":"500","cache.ttl.negative":"10m","cache.ttl.positive":"1h","filter.email":"(&(|(objectClass=sAMAccountName)(objectClass=sAMAccountType))(|(mail=?)(mailAlias=?)(mailList=?)))","filter.name":"(&(|(objectClass=sAMAccountName)(objectClass=sAMAccountType))(uid=?))","timeout":"15s","tls.allow-invalid-certs":"true","tls.enable":"false","type":"ldap","url":"ldap://192.168.111.100:389"}}}", code = 200, size = 930

so i can see that stalwart definitely talks with my samba server and sees my OU and my user group but it cannot resolve the password?

is my Object filter wrong? sAMAccountName and sAMAccountType?

i have to add that i did not get me a valid letsencrypt certificate so far, as i am only testing on this machine.

Thanks for any hint leading me in the direction.

Anyhow - really great work! I really like this fast and easy mailserver!
Richy

[mdecimus]

On the logs you provided I only see HTTP traces but if the password does not appear in the LDAP response then you'll probably have to enable LDAP auth bind. Check the documentation for details on how to configure this.