Remap login before authentication

Aki Tuomi
Mon, 11 Jan 2021 16:32:02 -0000

Not sure if you read my mail wrong, but

if

user.name works

and

user.name at domain.com does not work,

then why not just write

auth_bind_userdn = uid=%d,dc=domain,dc=tld

note the %d, which means, expand to local part (user.name) instead of user.name
at domain.com.

Aki


> On 11/01/2021 18:28 Miloslav H?la <miloslav.hula at gmail.com> wrote:
>
>
> Would be possible following scenario?
>
> 1. do the SQL passdb lookup, do the remap & return password = NULL
> without nopassword
> 2. do the LDAP bind
>
> I think it works, but I'm not sure if there are some security/other
flaws.
>
> Milo
>
>
> Dne 11.01.2021 v 17:11 Miloslav H?la napsal(a):
> > Probably not way for me. I forgot to write, then I cannot change LDAP
> > schema, so bindDN is fixed for me.
> >
> > Milo
> >
> > Dne 11.01.2021 v 17:00 Aki Tuomi napsal(a):
> >> auth_bind_userdn = uid=%d,dc=domain,dc=tld, also see
> >>
> >> %D - return ?sub.domain.org? as ?sub,dc=domain,dc=org? (for LDAP
queries)
> >>
> >> from
> >>
https://doc.dovecot.org/configuration_manual/config_file/config_variables/
> >>
> >>
> >> Aki
> >>
> >>> On 11/01/2021 17:58 Miloslav H?la <miloslav.hula at
gmail.com> wrote:
> >>>
> >>> Hi,
> >>>
> >>> with Dovecot 2.3.4 I would like to allow user to login with
two
> >>> different usernames:
> >>>
> >>> - USERNAME (no domain) - now works
> >>> - name.surname at domain.tld - would like to add
> >>>
> >>> Problem is, that the only authentication method I have is LDAP
bind by
> >>> USERNAME. Now I use:
> >>>
> >>> ===========> >>> passdb {
> >>> ??? driver = ldap
> >>> ??? args = /etc/dovecot/dovecot-ldap.conf.ext
> >>> }
> >>>
> >>> # Args
> >>> uris = ldaps://ldap.domain.tld
> >>> auth_bind = yes
> >>> auth_bind_userdn = uid=%u,dc=domain,dc=tld
> >>> base > >>> ===========> >>>
> >>> I know passdb can remap user&domain, but I have no
password hash at all.
> >>> And for example '{SASL}' is not supported password
scheme to return e.g.
> >>> from SQL passdb.
> >>>
> >>>
> >>> Is there any way how to achive this? Maybe somehow remap
username in
> >>> first passdb and then continue to LDAP bind?
> >>>
> >>> 1. login as name.surname at domain.tld
> >>> 2. remap to USERNAME
> >>> 3. do the LDAP bind
> >>>
> >>>
> >>> Milo