Is it possible to override the value of Postfix' LDAP related parameters like "result_attribute"?

[kraghuprasad]

I could not find a way to replace "result_attribute = mail" in ldap-users.cf with "result_attribute = mailbox" via my mailserver.env file. The mailbox-name currently being served by my existing LDAP server for a user "Ravi Prakash" is "ravip", while the email address is of the form [email protected]. I tried adding "POSTFIX_RESULT_ATTRIBUTE=mailbox" in mailserver.env file before running docker compose up. But still the above-mentioned file takes the result attribute as "mail" only.

I want to know whether there is a neat way to change such parameters of underlying services like Postfix, Dovecot, Fetchmail etc. via the mailserver.env file, even if it is not explicitly mentioned in the sample file distributed with docker-mailserver.

Thanks in advance.

[polarathene]

I have not looked at LDAP support for a while, but if the ENV override support presently does not support this, you can manually override a config file. I do have a PR for LDAP that improves this support (both file and ENV) but have higher priorities at present unfortunately so I am not sure when that'll land.

In our test suite for LDAP we provide both config files and ENV:

docker-mailserver/test/config/ldap/overrides/ldap-users.cf

Line 6 in 2bcc5cf

result_attribute = mail

In the test file for LDAP, there are plenty of notes you may be interested in referencing, it notes that you should be able to override result_attribute but that it will apply to all configs, thus my PR would add ENV support to selectively apply per file I think:

docker-mailserver/test/tests/serial/mail_with_ldap.bats

Lines 41 to 44 in 2bcc5cf

	# LDAP filter queries explained.
	# NOTE: All LDAP configs for Postfix (with the exception of `ldap-senders.cf`), return the `mail` attribute value of matched results.
	# This is through the config key `result_attribute`, which the ENV substitution feature can only replace across all configs, not selectively like `query_filter`.
	# NOTE: The queries below rely specifically upon attributes and classes defined by the schema `postfix-book.ldif`. These are not compatible with all LDAP setups.

[kraghuprasad]

Thanks @polarathene. I'll try with the suggested solutions. The problem for me is that the LDAP schema I am using has been in place for over a decade. I am just trying to replace the existing host based email ecosystem with a dockerized one. The software stack of Postfix, Dovecot and Fetchmail is already the same. I only need to ensure that the docker-mailserver starts using my existing LDAP schema, instead of its default one. Since LDAP part of docker-mailserver is not fully stable and tested here, I am facing some issues on this. Otherwise the non-LDAP based account management works flawlessly in docker-mailserver.

Thanks again.

[kraghuprasad]

I would like to inform anyone who might be interested that I was able to fix the LDAP based user lookup issue without changing the Postfix' attribute "result_attribute" in any of its LDAP specific configuration files. I just changed Dovecot's configuration file dovecot-ldap.conf.ext via docker-mailserver's main configuration file mailserver.env.

Following are the main environment variables and their values I changed to fix this issue:

DOVECOT_USER_ATTRS="=user=%{ldap:uid},=home=%{ldap:homeDirectory},=mail_uid=docker,=mail_gid=docker,=quota_rule=%{ldap:quota},mailbox=%{ldap:mailbox}"
DOVECOT_PASS_ATTRS="=user=%{ldap:uid},=password=%{ldap:userPassword},=userdb_home=%{ldap:homeDirectory},=mail_uid=docker,=mail_gid=docker,=userdb_mailbox=%{ldap:mail},=userdb_quota_rule=%{ldap:quota}"
DOVECOT_USER_FILTER="(&(objectClass=posixAccount)(|(mail=%u)(maildrop=%u))(status=TRUE)(mailAllowed=TRUE))"
DOVECOT_PASS_FILTER="(&(objectClass=posixAccount)(mail=%u)(status=TRUE)(mailAllowed=TRUE))"

Please note that my LDAP server uses a custom-built schema, and not the more conventional postfix-book schema. So these changes were required. Based on the schema you use for your LDAP, you may have to change some or whole of the values shown above. Also please note the mail_uid and mail_gid attributes of Dovecot. I had to set it explicitly to "docker" to ensure that all virtual mailboxes are accessible to the dovecot-process which is probably run as "docker" user and "docker" group with uid and gid set to 5000.

Thanks @polarathene, for the assistance you have provided.

Now I would be experimenting further, as I need to integrate my own milter program with postfix. Rough roads ahead, probably. ;)

[polarathene]

I had to set it explicitly to "docker" to ensure that all virtual mailboxes are accessible to the dovecot-process which is probably run as "docker" user and "docker" group with uid and gid set to 5000.

You could probably set to 5000, we may in a future major release change from docker to a more appropriate user/group name like vmail.

This is a known issue for LDAP support with unique UID/GID values from LDAP not being properly supported in DMS. I know we run a chown -R on /var/mail that affects that. So your approach to enforce the same UID and GID for all inboxes is required for the time being, but if I recall correctly, I'm not sure if it is a Dovecot restriction specifically.

Thanks @polarathene, for the assistance you have provided.

You're welcome :)

Sorry about the LDAP support not being as smooth, it was community contributed and no active maintainers use LDAP.

Rough roads ahead, probably. ;)

All the best! 😁

If you do have trouble with DMS and are willing to throw away all the time invested into Postfix/Dovecot config, you might be interested in trying Stalwart. They have LDAP support apparently as well as milter support. Stalwart is built on rust and seems to have nice docs, I haven't had time to try it myself but it seems like it could be promising!

[kraghuprasad]

Thanks for pointing out about Stalwart mail server. I would explore that too.