dovecot - Jun 2014 - Dovecot authentication against active directory

Hello,

i?ve got a problem with the dovecot authentication against active directory.
I?m using dovecot 2.0.19 and windows server 2008 R2.

When I try to login via telnet I get the following error message:
a NO [AUTHENTICATIONFAILED] Authentication failed.

My dovecot configuration:

# 2.0.19: /etc/dovecot/dovecot.conf
# OS: Linux 3.2.0-60-generic x86_64 Ubuntu 12.04.4 LTS ext4
auth_mechanisms = plain login
auth_username_format = %Lu
disable_plaintext_auth = no
first_valid_gid = 1001
first_valid_uid = 1001
last_valid_gid = 1001
last_valid_uid = 1001
log_path = /var/log/dovecot.log
mail_location = maildir:/srv/mail/%u
passdb {
  args = /etc/dovecot/dovecot-ldap.conf
  driver = ldap
}
protocols = imap
ssl = no
syslog_facility = local7
userdb {
  args = /etc/dovecot/dovecot-ldap.conf
  driver = ldap
}
valid_chroot_dirs = /srv/mail




My dovecot-ldap.conf:


hosts = **************
dn = CN=*****,OU=*****,OU=*****,OU=*****,DC=******,DC=*****,DC=de
dnpass = ****************
tls = no
debug_level = -1
ldap_version = 2
base = OU=*****,DC=*****,DC=*****,DC=de
deref = never
scope = subtree
user_attrs = sAMAccountName=home
user_filter = (&(ObjectClass=user)(|(mail=%u)(sAMAccountName=%u)))
pass_filter = (&(ObjectClass=user)(sAMAccountName=%u))
default_pass_scheme = plain

could anybody help me with this problem?
Thanks in advance!


Regards,

Tobias Dummert

Hi ,
> My dovecot-ldap.conf:
> 
> 
> hosts = **************
> dn = CN=*****,OU=*****,OU=*****,OU=*****,DC=******,DC=*****,DC=de
> dnpass = ****************
> tls = no
> debug_level = -1
> ldap_version = 2
> base = OU=*****,DC=*****,DC=*****,DC=de
> deref = never
> scope = subtree
> user_attrs = sAMAccountName=home
> user_filter = (&(ObjectClass=user)(|(mail=%u)(sAMAccountName=%u)))
> pass_filter = (&(ObjectClass=user)(sAMAccountName=%u))
> default_pass_scheme = plain
I could be wrong, but I think you must have TLS to connect to AD.  

sAMAccountName, at least in cases I am familiar with, does not match a
full email address, try %n instead of %u, or filter on userPrincipal
instead.  do you have a mail attribute in your active directory?  I
would suggest start by getting it working with just the sAMAccountName
in your user/pass_filter lines, then flesh out your filters after you
have that working...
> 
> could anybody help me with this problem?
> Thanks in advance!
> 
> 
> Regards,
> 
> Tobias Dummert