dovecot - Apr 2009 - Multiple use of the same LDAP attribute

Hi,

we've found a weird bug (?) in Dovecot 1.1.11. 

Since day and age we've been running dovecot for our student mailserver,
getting the location of the mailbox from a LDAP directory. We allow
login and LDA with both full mail address and an internal username,
so the mailbox directory is based on a LDAP attribute

user_attrs 
xxxMailbox=mail=maildir:/home/mailstore/%U$/Maildir:INDEX=/home/mailstore/indexes/%1U$/%U$,
	uidNumber=vmail, gidNumber=vmail,
	xxxMailQuota=quota_rule2=*:storage=%$B

this worked just fine until we introduced sieve, which made us realize
we did not have the home directory set at all.

The obvious and easy fix (we thought) was to set the home directory
based on the xxxMailbox variable as well:

user_attrs 
xxxMailbox=mail=maildir:/home/mailstore/%U$/Maildir:INDEX=/home/mailstore/indexes/%1U$/%U$,
	uidNumber=vmail, gidNumber=vmail,
	xxxMailQuota=quota_rule2=*:storage=%$B, xxxMailbox=home=/home/mailstore/%U$

unfortunately, after this trivial change hell froze over, because
suddenly the mail variable was not set at all anymore, and since we had
set

mail_location 
maildir:/home/mailstore/%Uu/Maildir:INDEX=/home/mailstore/indexes/%1Un/%Un

(based on username) it was suddenly delivered into the wrong folder
(based on the supplied username, not on the LDAP attribute).

Debug from after the change:
Apr  8 13:53:39 lxmhs23 dovecot: auth(default): ldap(username at xxx.de): user
search: base=<deleted> scope=onelevel filter=<deleted>
fields=xxxMailbox,uidNumber,gidNumber,xxxMailQuota,xxxMailbox
Apr  8 13:53:39 lxmhs23 dovecot: auth(default): ldap(username at xxx.de):
result: xxxMailQuota(quota_rule2=*:storage=%$B)=*:storage=1073741824B
xxxMailbox(home=/home/mailstore/%U$)=/home/mailstore/1636D8B1D7916DEA/
[...]
Apr  8 13:53:39 lxmhs23 deliver(username at xxx.de): maildir:
data=/home/mailstore/USERNAME at
XXX.DE/Maildir:INDEX=/home/mailstore/indexes/U/USERNAME

As you can see the mail variable wasn't set by LDAP at all.

We did some more tests and found a workaround, when using another LDAP 
(mwnid) attribute that contains the same information it works just fine

user_attrs 
xxxMailbox=mail=maildir:/home/mailstore/%U$/Maildir:INDEX=/home/mailstore/indexes/%1U$/%U$,
	uidNumber=vmail, gidNumber=vmail,
	xxxMailQuota=quota_rule2=*:storage=%$B, mwnid=home=/home/mailstore/%U$

Apr  8 14:18:06 lxmhs23 dovecot: auth(default): ldap(username at xxx.de): user
search: base=<deleted> scope=onelevel filter=<deleted>
fields=xxxMailbox,uidNumber,gidNumber,xxxMailQuota,mwnid
Apr  8 14:18:06 lxmhs23 dovecot: auth(default): ldap(username at xxx.de):
result: xxxMailQuota(quota_rule2=*:storage=%$B)=*:storage=1073741824B
xxxMailbox(mail=maildir:/home/mailstore/%U$/Maildir:INDEX=/home/mailstore/indexes/%1U$/%U$)=maildir:/home/mailstore/1636D8B1D7916DEA//Maildir:INDEX=/home/mailstore/indexes/1/1636D8B1D7916DEA/
mwnid(home=/home/mailstore/%U$)=/home/mailstore/1636D8B1D7916DEA
Apr  8 14:18:06 lxmhs23 deliver(username at xxx.de): maildir:
data=/home/mailstore/1636D8B1D7916DEA//Maildir:INDEX=/home/mailstore/indexes/1/1636D8B1D7916DEA/

So, it looks like there is an issue using the same LDAP attribute
(xxxMailbox in this case) twice in variable expansion.

Is this a known issue? Of course there are several viable workarounds
(base mail location on home directory, use the second attribute), but
this problem was pretty surprising.

Bernhard

On 4/8/2009 9:07 AM, Bernhard Schmidt wrote:
> Hi,
> 
> we've found a weird bug (?) in Dovecot 1.1.11. 
dovecot -n output is usually desired when asking for help, especially
when it is a likely config issue...

-- 

Best regards,

Charles

On Wed, 2009-04-08 at 13:07 +0000, Bernhard Schmidt wrote:
> So, it looks like there is an issue using the same LDAP attribute
> (xxxMailbox in this case) twice in variable expansion.
> 
> Is this a known issue? 
Yes. I was planning on rewriting LDAP configuration and getting it fixed
at the same time, but looks like it didn't happen yet for v1.2.
> Of course there are several viable workarounds
> (base mail location on home directory, 
This is what I would have suggested. Seems like a cleaner solution in
any case.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 197 bytes
Desc: This is a digitally signed message part
URL:
<http://dovecot.org/pipermail/dovecot/attachments/20090408/afdbfe33/attachment-0002.bin>

On Wed, Apr 08, 2009 at 12:41:17PM -0400, Timo Sirainen wrote:
> > So, it looks like there is an issue using the same LDAP attribute
> > (xxxMailbox in this case) twice in variable expansion.
> > Is this a known issue? 
> Yes. I was planning on rewriting LDAP configuration and getting it fixed
> at the same time, but looks like it didn't happen yet for v1.2.
Okay, thanks for the clarification.
> > Of course there are several viable workarounds
> > (base mail location on home directory, 
> This is what I would have suggested. Seems like a cleaner solution in
> any case.
Come to think of it, any hint how I can implement the existing scheme?

user_attrs        
xxxMailbox=mail=maildir:/home/mailstore/%U$/Maildir:INDEX=/home/mailstore/indexes/%1U$/%U$,
	xxxMailbox=home=/home/mailstore/%U$

the maildir location is easy (mail=maildir:~/Maildir), but the index is
hard, as I don't have the userid in any variable.

The only thing I can come up with atm is

user_attrs = 
	xxxMailbox=home=/home/mailstore/%U$,
	xxxMailbox=mail=maildir:~/Maildir:INDEX=/home/mailstore/indexes/%16.1h/%16.99h

but I'm willing to bet that this is going to break at some point, the
latest point being when someone changes the mailstore path and forgets
to update the offset :-\

What happens when the width is larger than the length of the string
anyway?

Bernhard