Hello,
I believe there is a bug in logic. The following code snippet from
db_ldap_connect() function:
if (conn->set.sasl_bind) {
#ifdef HAVE_LDAP_SASL
struct db_ldap_sasl_bind_context context;
memset(&context, 0, sizeof(context));
context.authcid = conn->set.dn;
context.passwd = conn->set.dnpass;
context.realm = conn->set.sasl_realm;
context.authzid = conn->set.sasl_authz_id;
/* There doesn't seem to be a way to do SASL binding
asynchronously.. */
ret = ldap_sasl_interactive_bind_s(conn->ld, NULL,
conn->set.sasl_mech,
NULL, NULL,
LDAP_SASL_QUIET,
sasl_interact, &context);
if (db_ldap_connect_finish(conn, ret) < 0)
return -1;
#else
i_unreached(); /* already checked at init */
#endif
conn->conn_state = LDAP_CONN_STATE_BOUND_DEFAULT;
} else {
if (db_ldap_bind(conn) < 0)
return -1;
}
has to be inside db_ldap_bind() function.
Because db_ldap_bind() is used to return the connection to the initial
state which is sasl bounded as required in config file.
17.09.2016 20:22, Matwey V. Kornilov ?????:> Hello,
>
> I am using
>
> # dovecot --version
> 2.2.18
>
> # dovecot -n
> # 2.2.18: /etc/dovecot/dovecot.conf
> # Pigeonhole version 0.4.8 (0c4ae064f307+)
> doveconf: Warning: NOTE: You can get a new clean config file with:
> doveconf -n > dovecot-new.conf
> doveconf: Warning: Obsolete setting in /etc/dovecot/dovecot.conf:24:
> 'imaps' protocol can no longer be specified (use protocols=imap).
to
> disable non-ssl imap, use service imap-login { inet_listener imap {
> port=0 } }
> doveconf: Warning: NOTE: You can get a new clean config file with:
> doveconf -n > dovecot-new.conf
> doveconf: Warning: Obsolete setting in /etc/dovecot/dovecot.conf:24:
> 'imaps' protocol can no longer be specified (use protocols=imap).
to
> disable non-ssl imap, use service imap-login { inet_listener imap {
> port=0 } }
> # OS: Linux 4.1.27-27-default x86_64 openSUSE 42.1 (x86_64)
> first_valid_uid = 1
> mail_location = maildir:~/Maildir
> managesieve_notify_capability = mailto
> managesieve_sieve_capability = fileinto reject envelope
> encoded-character vacation subaddress comparator-i;ascii-numeric
> relational regex imap4flags copy include variables body enotify
> environment mailbox date index ihave duplicate
> namespace inbox {
> inbox = yes
> location > mailbox Drafts {
> special_use = \Drafts
> }
> mailbox Junk {
> special_use = \Junk
> }
> mailbox Sent {
> special_use = \Sent
> }
> mailbox "Sent Messages" {
> special_use = \Sent
> }
> mailbox Trash {
> special_use = \Trash
> }
> prefix > }
> passdb {
> args = /etc/dovecot/dovecot-ldap.conf.ext
> driver = ldap
> }
> plugin {
> sieve = file:~/sieve;active=~/.dovecot.sieve
> }
> protocols = lmtp imap
> service imap-login {
> inet_listener imap {
> port = 0
> }
> }
> ssl = required
> ssl_ca = /etc/pki/trust/anchors/rootCA.pem
> ssl_cert = </etc/openldap/openldap.crt
> ssl_dh_parameters_length = 2048
> ssl_key = </etc/openldap/openldap.key
> ssl_options = no_compression
> ssl_prefer_server_ciphers = yes
> userdb {
> args = /etc/dovecot/dovecot-ldap.conf.ext
> driver = ldap
> override_fields = uid=vmail gid=vmail home=/var/spool/mail/%d/%n
> }
>
> I use LDAP for user and passwd databases as the following:
>
> uris = ldapi:///
> sasl_bind = yes
> sasl_mech = EXTERNAL
> auth_bind = yes
>
> And I found that only first authentication after dovecot restart is
> successful, the others always fail with temp.
> The reason is that dovecot rebinds to anonymous bind after succesful
> auth bind instead of rebinding to external sasl bind.
>