[enhancement]:LDAP Authentication for Multiple Subdomains in Stalwart Mail Server

[Schnelle02]

What happened?

Issue: LDAP Authentication for Multiple Subdomains in Stalwart Mail ServerA bug happened!

How can we reproduce the problem?

I’m trying to configure my Stalwart Mail Server to authenticate users against an OpenLDAP Directory Server. My LDAP directory is structured as follows:

dc=domain,dc=tech
|---dc=subdomain1,dc=domain,dc=tech
| |---ou=User
| | |[email protected]
|
|---dc=subdomain2,dc=domain,dc=tech
|---ou=User
|[email protected]

Goal: I want users from both subdomains (subdomain1.domain.tech and subdomain2.domain.tech) to authenticate via LDAP on the Stalwart Mail Server and send emails using their respective domains.

Problem: I can't figure out how to configure Stalwart in a way that it properly queries the LDAP directory and allows authentication for both subdomains. Only one subdomain works at a time with my current attempts.

I also attempted to configure two separate LDAP entries within the Stalwart configuration, one for each subdomain. For example:

[auth.ldap.subdomain1]
url = "ldap://ldap.domain.tech"
base_dn = "dc=subdomain1,dc=domain,dc=tech"
search_filter = "(&(objectClass=inetOrgPerson)(mail=%u))"

[auth.ldap.subdomain2]
url = "ldap://ldap.domain.tech"
base_dn = "dc=subdomain2,dc=domain,dc=tech"
search_filter = "(&(objectClass=inetOrgPerson)(mail=%u))"

However, this also didn’t work as expected—again, only one subdomain would authenticate successfully, while the other would fail.

Version

v0.11.x

What database are you using?

RocksDB

What blob storage are you using?

RocksDB

Where is your directory located?

LDAP

What operating system are you using?

Linux

Relevant log output

Code of Conduct

• I agree to follow this project's Code of Conduct

[mdecimus]

It looks like a configuration issue with your filters and/or DN. I recommended that you use ldapsearch (or similar) to test your filters from the command line and once you get them to work then configure Stalwart to use them.

[Schnelle02]

Thank you for the quick response and suggestion to use ldapsearch for testing! I've conducted some additional tests and would like to share the details of my setup, the results, and the current issues I’m still facing.

LDAP Directory Structure:
dc=hellstern,dc=tech
├── dc=subdomain1,dc=hellstern,dc=tech
│ └── ou=User
│ └── uid=alex.taylor
└── dc=subdomain2,dc=hellstern,dc=tech
└── ou=User
└── uid=taylor.lee

Stalwart Configuration:

Here is the current configuration I am using:

[directory.ldap]
type = "ldap"
url = "ldaps://ldap.hellstern.tech:636"
base-dn = "dc=hellstern,dc=tech"
timeout = "15s"

[directory.ldap.bind]
dn = "cn=readonly,dc=hellstern,dc=tech"
secret = "Secret"

[directory.ldap.bind.auth]
enable = true
dn = "uid=?,ou=User,dc=hellstern,dc=tech"
search = true

[directory.ldap.filter]
name = "(&(objectClass=inetOrgPerson)(uid=?))"
email = "(&(objectClass=inetOrgPerson)(mail=?))"

Problem Details:

Issue with Bind DN:
When a user logs in, Stalwart seems to incorrectly attempt a bind operation at the top-level domain, for example:
uid=alex.taylor,ou=User,dc=hellstern,dc=tech.

However, the user is actually located in the subdomain:
uid=alex.taylor,ou=User,dc=subdomain1,dc=hellstern,dc=tech.

Log Output: Here is an excerpt from the Stalwart logs during an authentication attempt:

TRACE LDAP bind operation
details = "uid=alex.taylor,ou=User,dc=hellstern,dc=tech"
DEBUG Authentication failed
listenerId = "imaptls", accountName = "alex.taylor"

This indicates that Stalwart is not considering the subdomain (dc=subdomain1 or dc=subdomain2) when constructing the Bind DN.

[mdecimus]

Stalwart does not support splitting the email address in its local and domain part to format the bind DN request. You can check if your LDAP server allows returning the secrets when authenticating using an administrator account.