dovecot - Nov 2010 - dovecot with Active Directory problem

Hello,

I am using dovecot-2.0.6 with NetBSD amd64.
Active Directory is used as an authentication server.
(Windows Server 2008 R2)

However, the message of "Operations error" was displayed first and it
did
not move.
It solved it by understanding that this is because the authority of the user
who used it for bind was insufficient, and adding to "Account
Operators"
group.
# Though it is not the best.

The error "Error: re_encode_request new request is" occurs,
and it doesn't operate still as follows.

Postfix operates though connects with LDAP.
The following are samples.

------------------------
# Active Directory Server settings
domain = example.com
server_host = ldap://xxx.xxx.xxx.xxx:389
search_base = dc=example, dc=com
version = 3
timeout = 30

# Active Directory Searcher settings
bind = yes
bind_dn = cn=Mail Administrator, cn=Users, dc=example, dc=com
bind_pw = *********

# Filter Query
query_filter
(&(&(objectCategory=person)(|(mail=%s)(userPrincipalName=%s)))(!(userAccountControl:1.2.840.113556.1.4.803:=2)))
result_attribute = userPrincipalName
result_filter = %s/
chase_referrals = no
------------------------

The packet was done with wireshark by using this definition and a capture
doing and a similar test were done to dovecot.

It is a setting of dovecot.

------------------------
hosts = xxx.xxx.xxx.xxx:389
dn = cn=Mail Administrator, cn=Users, dc=example, dc=com
dnpass = *********

auth_bind = no
ldap_version = 3
base = dc=example, dc=com
user_attrs = unixHomeDirectory=home,uidNumber=uid,gidNumber=gid
user_filter
(&(&(objectCategory=person)(userPrincipalName=%u))(!(userAccountControl:1.2.840.113556.1.4.803:=2)))

pass_attrs = userPrincipalName=user,unixUserPassword=password
pass_filter
(&(&(objectCategory=person)(userPrincipalName=%u))(!(userAccountControl:1.2.840.113556.1.4.803:=2)))
iterate_attrs = userPrincipalName=user
iterate_filter
(&(objectCategory=person)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))
 default_pass_scheme = MD5
------------------------

# Schema of LDAP is matched to Windows Services for UNIX,
# and the password is made a hush with MD5.

Both dovecot and postfix the first "bindRequest" was quite
the same demand and the results.

Next, dovecot demanded query of "userPrincipalName" and
"unixUserPassword".
It seems to be ok for the result.
# This fails if it doesn't add to "Account Operators" group.

However, "name" and "simple" were issued by the blank
(anonymously?)
as for the following next demand (bindRequest).
In addition, query of "userPrincipalName" and
"unixUserPassword" is issued
to
"cn=Configuration, dc=example, dc=com" afterwards.
And, "Operations Error" is returned because of this.

Error description in LDAP packet:
 ------------------------
errorMessage: 000004DC: LdapErr: DSID-0C0906DC, comment: In order to perform
this operation a successful bind must be completed on the connection., data
0, v1db0
 ------------------------

Because LDAP is unprofessional, it has not understood though
the source code was seen.

Do you serve as a reference?

Thanks powerful codes.

On Sun, 2010-11-14 at 21:31 +0900, marie ot wrote:
> I am using dovecot-2.0.6 with NetBSD amd64.
..
> hosts = xxx.xxx.xxx.xxx:389
> dn = cn=Mail Administrator, cn=Users, dc=example, dc=com
> dnpass = *********
dn is set, so Dovecot does a bind before doing anything else.
> Both dovecot and postfix the first "bindRequest" was quite
> the same demand and the results.
> 
> Next, dovecot demanded query of "userPrincipalName" and
"unixUserPassword".
> It seems to be ok for the result.
> # This fails if it doesn't add to "Account Operators" group.
Looks right.
> However, "name" and "simple" were issued by the blank
(anonymously?)
What do you mean by "name" and "simple"?
> as for the following next demand (bindRequest).
Since you have auth_bind=no, there should be only a single bind request
at the beginning of LDAP connection, nothing afterwards.
> In addition, query of "userPrincipalName" and
"unixUserPassword" is issued
> to
> "cn=Configuration, dc=example, dc=com" afterwards.
Where's that Configuration coming from? It's not in your config file, so
I don't see why Dovecot would go querying it. Unless perhaps it's
OpenLDAP library that goes doing this stuff internally.
> errorMessage: 000004DC: LdapErr: DSID-0C0906DC, comment: In order to
perform
> this operation a successful bind must be completed on the connection., data
> 0, v1db0
I don't see how this could happen, except if the previous LDAP reply
contains some kind of a reference elsewhere and OpenLDAP automatically
goes connecting there.