Active Directory Integration

[sniper9191]

Firstly, huge thanks to Mauro for developing this!

I'm using Stalwart as a SMTP relay, and I have a requirement that "authenticated user must match sender".
I've tested this using the internal user database, and it works well.

However, I am having problems using Active Directory (LDAP) as the user database.
The logs show that the authentication failed -
smtp::inbound::auth: context="auth" event="authenticate" result="failed"

1. The SMTP authentication credentials are definitely correct
2. The LDAP Bind DN and Bind Secret are definitely correct
3. Bind Auth DN was not enabled
4. Under "Object Attributes", there is a compulsory field "Secret" holds the user's password - this is not accepted by Active Directory

Has anyone successfully configured Stalwart with Active Directory, and could guide me on the correct steps?

• Do I need to enable Bind Auth DN? What should I specify for this value? (the Bind DN is in a different OU than the users who will authenticate via SMTP Auth)
• What should I do about the "Object Attribute>Secret" field that Active Directory doesn't support?

[mdecimus]

Hi,

I am not familiar with Active Directory but if it does not support returning the Secret field you will have to use bind auth. When configuring the directory settings you can leave the default value for the Secret field, what's important is that you enable bind auth otherwise it won't be possible to authenticate accounts.

[sniper9191]

I was able to get Active Directory authentication working - somewhat.
The problem was, some accounts would simply fail to authenticate at all, but unfortunately there isn't much in the logs to help with troubleshooting (the credentials are 100% correct).
There are a few accounts which were able to authenticate successfully - and I proceeded with my testing using these accounts.

However, there seems to be a problem.
For the accounts that successfully authenticated, they are added to the list of users within Stalwart.
But the mail property is empty (which means "authenticated user must match sender" would fail); within Active Directory their mail property contains a valid email address.
Within the Stalwart settings for LDAP, I have configured E-mail to use the mail attribute that is returned by the server - but yet in Stalwart, it still shows the user's email address is empty.

Might I have hit a bug?

[mdecimus]

The problem was, some accounts would simply fail to authenticate at all, but unfortunately there isn't much in the logs to help with troubleshooting (the credentials are 100% correct).

Perhaps those accounts have a different DN that does not match the configured DN template?

For the accounts that successfully authenticated, they are added to the list of users within Stalwart.

The Directory section of the webadmin only works with the Internal Directory, you should ignore what is listed there when using LDAP or any external directory.

[sniper9191]

That is the problem with using a DN "template" - it assumes all accounts would fit into this template.
For example -
CN=user1,OU=IT,DC=company,DC=com
CN=user2,OU=HR,DC=company,DC=com

In this case, using the template CN=?,OU=IT,DC=company,DC=com would prevent user2 (OU=HR) from logging in.
As I workaround, I simply used DN=? as the template - this allowed at least some users to authenticate successfully.
It's worth noting that, even user accounts within the same OU, some could login, some couldn't (i.e. it doesn't seem to be a DN template issue). I couldn't find any useful information even with debug+trace logs, but if you could point me somewhere to check, I'd be glad to look further.

About the mail attribute, even if we ignore the webUI, it still doesn't seem to work for me.
I authenticated via LDAP as a user with mail == [email protected]
When I tried to send emails as [email protected], it says I am not authorized.
If I disable the "authenticated user must match sender" setting, it works.
So it would appear that somehow, the mail attribute is not being read correctly via LDAP.
I couldn't find any useful information within the logs, and since the webUI doesn't actually show LDAP attributes that were synced, is there some place else I could check to troubleshoot this? Perhaps a CLI command that would output the LDAP attributes that I can use to verify?

Thanks again for your time in responding!

[sniper9191]

I was able to resolve the issue.
This is what I did -

1. Object Attribute "Name" == (ldap) SamAccountName
2. Bind Auth DN == ?@Domain

This way, if the user authenticates using their SamAccountName, the Bind Auth DN will resolve the username as [email protected]; using this username format (basically it's the UPN) the LDAP authentication works perfectly.

[shortstack]

@sniper9191 i am also fighting with stalwart and active directory. i'm not sure i'm interpreting your fix right. are those the literal values in your settings (besides redacting the actual domain name)? could you provide your example with real names redacted?

[shortstack]

disregard! got it working after a few iterations. thank you thank you :)

[shortstack]

@sniper9191 ldap is working, and outgoing email is working minus getting dkim set up (later, testing locally with domain accounts for now), but i'm unable to receive mail with thunderbird or the windows mail app, despite seeing successful sends in the logs. did you run into this issue by any chance?

[flover97]

Hi, can you show your full settings for active directory in stalwart? screen please if you can