Skip to content

service: added ability to configure dovecot master accounts#2535

Merged
polarathene merged 12 commits intodocker-mailserver:masterfrom
groupmsl:dovecot-master-accounts
May 7, 2022
Merged

service: added ability to configure dovecot master accounts#2535
polarathene merged 12 commits intodocker-mailserver:masterfrom
groupmsl:dovecot-master-accounts

Conversation

@groupmsl
Copy link
Copy Markdown
Contributor

@groupmsl groupmsl commented Apr 6, 2022

Added ability to configure dovecot master accounts

Dovecot master accounts can now be configured directly in dms setup.sh. A master account is useful for administration purposes, or (my use case) to perform mailbox backups of very user over IMAP.

Fixes #2529

Type of change

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Improvement (non-breaking change that does improve existing functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • This change requires a documentation update

Checklist:

  • My code follows the style guidelines of this project
  • I have performed a self-review of my own code
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation (README.md or the documentation under docs/)
  • If necessary I have added tests that prove my fix is effective or that my feature works
  • New and existing unit tests pass locally with my changes

@georglauterbach georglauterbach requested review from a team and georglauterbach April 6, 2022 14:49
@georglauterbach georglauterbach added area/features kind/new feature A new feature is requested in this issue or implemeted with this PR service/dovecot labels Apr 6, 2022
@georglauterbach georglauterbach added this to the v11.1.0 milestone Apr 6, 2022
@georglauterbach
Copy link
Copy Markdown
Member

I will review this PR ASAP, but it's going into v11.1.0 and not in the upcoming v11.0.0 release as there already are plenty of changes for v11. Hope that this is okay, you will be able to immediate get with the :edge tag.

@georglauterbach georglauterbach added the meta/feature freeze On hold due to upcoming release process label Apr 6, 2022
@casperklein
Copy link
Copy Markdown
Member

Not a strict requirement, but it would be nice, if you could also add a test for this, to ensure it's working. This can also prevent accidentally regressions done in future PRs.

You might take a look at the current IMAP tests.

@groupmsl
Copy link
Copy Markdown
Contributor Author

groupmsl commented Apr 6, 2022

I've fixed master accounts not being created on container start-up; previously they were only created while container was running when setup.sh.

I've also added a test to check a master user can log in. I will investigate more tests around setup.sh functionality, and checking the master user can actually read another users email once logged in when I have time.

@groupmsl
Copy link
Copy Markdown
Contributor Author

groupmsl commented Apr 7, 2022

I think I have worked out why my new test is failing - I added a new function "generate-masters" to the makefile, and added it to "all". When you follow the documentation for running the tests, this function gets run and the test passes.

I think the command used to run the tests on github only runs "generate-accounts" and "tests", which means my "generate-masters" does not get run - so there isn't a master account...so the test fails.

@georglauterbach, would you prefer I move the contents of "generate-masters" into "generate-accounts" or do you want to change the command used to run the tests in github (to include "generate-masters")?

@georglauterbach
Copy link
Copy Markdown
Member

@georglauterbach, would you prefer I move the contents of "generate-masters" into "generate-accounts" or do you want to change the command used to run the tests in github (to include "generate-masters")?

Definitely. I'd go as far as to say that this is a requirement :) It should definitely go into the generate-accounts target.

Comment thread docs/content/config/advanced/dovecot-master-accounts.md Outdated
Comment thread docs/content/config/advanced/dovecot-master-accounts.md Outdated
Comment thread target/scripts/check-for-changes.sh Outdated
casperklein
casperklein previously approved these changes Apr 9, 2022
Copy link
Copy Markdown
Member

@polarathene polarathene left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍

Just a few changes:

  • DATABASE variable also checks for an ENV that may conflict with the original *mailuser functions if that fallback is ever used, I'd suggest adjusting this like you have with other variables. DOVECOT_DB_MASTER, DATABASE_MASTER, CONFIG_MASTER or similar should be fine.
  • The command master is too generic/vague, at the very least a bit more context such as dovecot-master would be better.
  • I would like justification for * as the choice of separator configured.
  • A query about LDAP check not being relevant for _create_masters.
  • _create_masters could also be _create_dovecot_master_accounts, no one is going to manually invoke that, but it would provide a bit more context that would be appreciated when maintaining.
  • Minor change suggestions.

Comment thread target/bin/addmasteruser Outdated
Comment thread target/bin/addmasteruser Outdated
Comment thread target/bin/setup Outdated
Comment thread target/bin/updatemasteruser
Comment thread target/dovecot/auth-master.inc
Comment thread target/bin/addmasteruser Outdated
Comment thread target/scripts/helpers/accounts.sh
Comment thread Makefile Outdated
* setup.sh "master" command changed to "dovecot-master"
* Usage information corrections
* Removed comments and indented comments from dovecot masters test user DB
@groupmsl
Copy link
Copy Markdown
Contributor Author

Sorry for the slow response - I have been away on holiday. I think I have addressed all your comments above, with one still waiting on input from you.

Assuming you're happy with my changes, would we now be ready to merge?

@georglauterbach georglauterbach removed the meta/feature freeze On hold due to upcoming release process label Apr 28, 2022
@georglauterbach
Copy link
Copy Markdown
Member

georglauterbach commented Apr 28, 2022

Sorry for the slow response - I have been away on holiday. I think I have addressed all your comments above, with one still waiting on input from you.

Assuming you're happy with my changes, would we now be ready to merge?

The feature freeze for v11.0.0 is over, but I'd like to see #2535 (comment) being resolved first :) Then we will again review the PR and merge it afterwards :) You will in the meantime need to resolve the one merge conflict in setup-stack.sh.

polarathene
polarathene previously approved these changes May 4, 2022
Copy link
Copy Markdown
Member

@polarathene polarathene left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍

Just depends on minor additions for LDAP user support discussed in #2535 (comment)

If #2565 is merged before this PR, you might want to update your commands output to use the colour vars instead too.

@wernerfred wernerfred enabled auto-merge (squash) May 4, 2022 05:38
@georglauterbach
Copy link
Copy Markdown
Member

LGTM but tests are still failing. If they are resolved, we can merge this :)

@groupmsl
Copy link
Copy Markdown
Contributor Author

groupmsl commented May 4, 2022

To be honest I'm struggling to work out where to start with the failed tests. I'll keep trying but if anyone has any pointers I'd be very grateful!

@georglauterbach
Copy link
Copy Markdown
Member

To be honest I'm struggling to work out where to start with the failed tests. I'll keep trying but if anyone has any pointers I'd be very grateful!

I'd start by going through the commits that did not show success first, i.e. 177220c, then 50e45b0, etc.

It seems as if the test users are not created (no such file or directory).

@polarathene
Copy link
Copy Markdown
Member

  • mail_ssl_letsencrypt.bats should be an easy fix, your PR isn't breaking it with any code, but a side-effect issue that is a common problem with the test. (Fix available)
  • mail_with_ldap.bats is going to be more difficult. We lack LDAP experience, but something about this PR when used with LDAP is breaking the Dovecot IMAP auth and mail delivery, which is unexpected? (Resolved, drop feature support in LDAP)
Outdated

I can assist for the first failure, but for LDAP we may have to choose to revert that support and document that it's only for non-LDAP (_create_masters helper would then probably want to keep the _create_accounts condition check that LDAP is not enabled).

Probably best to wait until another maintainer agrees on dropping the LDAP support for this feature, but I don't think any want to debug it so they'd probably agree. If an LDAP user wants the feature, the required changes here is small but they'll have to investigate how to get the tests passing themselves to contribute it.

LetsEncrypt failure (mail_ssl_letsencrypt.bats)

Investigation process (resolved)

This failure is usually due to our current implementation for change detection and testing that relies on it by assuming enough time has passed.

Generally it means your PR has has added some processing or logs that either made the timing logic for waiting on a change take longer than we sleep for in a test, or more commonly, log output increased that results in us not reading enough logs (fragile).

not ok 93 ssl(letsencrypt): Traefik 'acme.json' (*.example.test) in 28763ms
# (from function `assert_output' in file test/test_helper/bats-assert/src/assert.bash, line 231,
#  from function `_should_extract_on_changes' in file test/mail_ssl_letsencrypt.bats, line 240,
#  from function `_acme_rsa' in file test/mail_ssl_letsencrypt.bats, line 141,
#  in test file test/mail_ssl_letsencrypt.bats, line 179)
#   `_acme_rsa' failed
# [   INF   ]  mail.example.test is up and running
# [  DEBUG  ]  2022-05-04 09:58:31  Chagedetector is ready
# 
# -- output does not contain substring --
# substring (1 lines):
#   Change detected
# output (30 lines):
#   ]  2022-05-04 09:58:33  '/etc/letsencrypt/acme.json' has changed - extracting certificates
#   [  DEBUG  ]  Setting up SSL
#   [  DEBUG  ]  TLS configured with 'modern' ciphers
#   [  DEBUG  ]  Configuring SSL using 'letsencrypt'
#   [ WARNING ]  _extract_certs_from_acme | Unable to find key and/or cert for '*.example.test' in '/etc/letsencrypt/acme.json'
#   [  TRACE  ]  _extract_certs_from_acme | Certificate successfully extracted for 'mail.example.test'
#   [  TRACE  ]  letsencrypt (acme.json) extracted certificate using HOSTNAME: 'mail.example.test'
#   [  TRACE  ]  Adding mail.example.test SSL certificate to the postfix and dovecot configuration
#   [  TRACE  ]  SSL configured with 'letsencrypt' certificates
#   [  TRACE  ]  Checking file line endings
#   [  TRACE  ]  Regenerating postfix user list
#   [  DEBUG  ]  Creating user 'user1' for domain 'localhost.localdomain'
#   [  DEBUG  ]  Creating user 'user2' for domain 'otherdomain.tld'
#   [  DEBUG  ]  Creating user 'user3' for domain 'localhost.localdomain' with attributes 'userdb_mail=mbox:~/mail:INBOX=~/inbox'
#   [  DEBUG  ]  Adding alias '[email protected]' for user '[email protected]' to Dovecot's userdb
#   [  DEBUG  ]  Alias '[email protected]' is non-local (or mapped to a non-existing account) and will not be added to Dovecot's userdb
#   [  DEBUG  ]  Adding alias '@localdomain2.com' for user '[email protected]' to Dovecot's userdb
#   [  TRACE  ]  Checking file line endings
#   [  TRACE  ]  Regenerating dovecot masters list
#   [  DEBUG  ]  Creating master user 'masterusername'
#   [  TRACE  ]  Adding regexp alias file postfix-regexp.cf
#   virtual_alias_maps = texthash:/etc/postfix/virtual pcre:/etc/postfix/regexp
#   [  TRACE  ]  Configuring root alias
#   [  DEBUG  ]  2022-05-04 09:58:36  Restarting services due to detected changes
#   postfix: stopped
#   postfix: started
#   dovecot: stopped
#   dovecot: started
#   [  TRACE  ]  Removed lock '/tmp/docker-mailserver/check-for-changes.sh.lock'
#   [  DEBUG  ]  2022-05-04 09:58:41  Completed handling of detected change
# --
# 
# mail_ssl_letsencrypt

Fixing it, last log captured was in the earlier prepare() method that waits until the change detector service is ready:

repeat_until_success_or_timeout 20 sh -c "$(_get_service_logs 'changedetector') | grep 'Chagedetector is ready'"

After prepare(), acme_ecdsa() ran and passed, but the next sub-test acme_rsa() which runs the same change detection check failed:

_should_extract_on_changes 'mail.example.test' "${LOCAL_BASE_PATH}/rsa.acme.json"

Which runs the following and failed with the longer output log above not having one of the expected log lines:

# Replace the mounted `acme.json` and wait to see if changes were detected.
function _should_extract_on_changes() {
local EXPECTED_DOMAIN=${1}
local ACME_JSON=${2}
cp "${ACME_JSON}" "${TEST_TMP_CONFIG}/letsencrypt/acme.json"
# Change detection takes a little over 5 seconds to complete (restart services)
sleep 10
# Expected log lines from the changedetector service:
run $(_get_service_logs 'changedetector')
assert_output --partial 'Change detected'
assert_output --partial "'/etc/letsencrypt/acme.json' has changed - extracting certificates"
assert_output --partial "_extract_certs_from_acme | Certificate successfully extracted for '${EXPECTED_DOMAIN}'"
assert_output --partial 'Restarting services due to detected changes'
assert_output --partial 'postfix: stopped'
assert_output --partial 'postfix: started'
assert_output --partial 'dovecot: stopped'
assert_output --partial 'dovecot: started'
}

This line failed:

assert_output --partial 'Change detected'

We only got a match for the line directly after that, and the warning line in our log above is nothing to worry about, that's expected for what we're testing.

Ok, earlier lines prior to it is due to us recently merging a refactor and fix that runs the SSL setup logic each time, and starts from here:

_log_with_date 'debug' "'/etc/letsencrypt/acme.json' has changed - extracting certificates"
_setup_ssl

Your PR has just slightly pushed the log line we wanted out of scope due to adding these:

#   [  TRACE  ]  Regenerating dovecot masters list
#   [  DEBUG  ]  Creating master user 'masterusername'

To fix this, increase the amount of bytes we fetch from logs here to... 2200 perhaps? (we don't want this too high, so that we don't accidentally get duplicate logs from acme_ecdsa test, that would be a false-positive):

local CMD_LOGS=(docker exec "${TEST_NAME}" "supervisorctl tail -2000 ${SERVICE}")

LDAP failures (mail_with_ldap.bats )

Resolved

IMAP connection and auth is broken for some reason 😕

not ok 114 checking dovecot: ldap imap connection and authentication works in 141ms
# (from function `assert_success' in file test/test_helper/bats-assert/src/assert.bash, line 114,
#  in test file test/mail_with_ldap.bats, line 144)
#   `assert_success' failed
# 
# -- command failed --
# status : 1
# output : 
# --
# 

The test failed for Dovecot mail delivery, the expected user account being checked does not exist?

not ok 115 checking dovecot: ldap mail delivery works in 10333ms
# (from function `assert_output' in file test/test_helper/bats-assert/src/assert.bash, line 239,
#  in test file test/mail_with_ldap.bats, line 152)
#   `assert_output 1' failed
# 
# -- output differs --
# expected (1 lines):
#   1
# actual (2 lines):
#   ls: cannot access '/var/mail/localhost.localdomain/some.user/new': No such file or directory
#   0
# --
# 

Same for this one, just different user:

not ok 116 checking dovecot: ldap mail delivery works for a different domain then the mailserver in 10289ms
# (from function `assert_output' in file test/test_helper/bats-assert/src/assert.bash, line 239,
#  in test file test/mail_with_ldap.bats, line 160)
#   `assert_output 1' failed
# 
# -- output differs --
# expected (1 lines):
#   1
# actual (2 lines):
#   ls: cannot access '/var/mail/localhost.localdomain/some.other.user/new': No such file or directory
#   0
# --
# 

These are all here:

# dovecot
@test "checking dovecot: ldap imap connection and authentication works" {
run docker exec mail_with_ldap /bin/sh -c "nc -w 1 0.0.0.0 143 < /tmp/docker-mailserver-test/auth/imap-ldap-auth.txt"
assert_success
}
@test "checking dovecot: ldap mail delivery works" {
run docker exec mail_with_ldap /bin/sh -c "sendmail -f [email protected] some.user@${FQDN_LOCALHOST_A} < /tmp/docker-mailserver-test/email-templates/test-email.txt"
sleep 10
run docker exec mail_with_ldap /bin/sh -c "ls -A /var/mail/${FQDN_LOCALHOST_A}/some.user/new | wc -l"
assert_success
assert_output 1
}
@test "checking dovecot: ldap mail delivery works for a different domain then the mailserver" {
run docker exec mail_with_ldap /bin/sh -c "sendmail -f [email protected] some.other.user@${FQDN_LOCALHOST_B} < /tmp/docker-mailserver-test/email-templates/test-email.txt"
sleep 10
run docker exec mail_with_ldap /bin/sh -c "ls -A /var/mail/${FQDN_LOCALHOST_A}/some.other.user/new | wc -l"
assert_success
assert_output 1
}

After more careful inspection, it seems LDAP support might not meant to be using the passdb block that you're including with this PR into 10-auth.conf, we were aware of auth_bind = yes, but it seems for LDAP it includes an ldap config with no block scoping and just has a top-level auth_bind that's explicitly disabled (no is the default though):

We have some docs regarding LDAP and auth_bind:

I don't have time to read through all that, but the last link does have this to say:

NOTE: SASL binds are currently incompatible with authentication binds.

So it doesn't seem like this will work, as from what I understand, our LDAP support is only documented/tested with SASL config.

Let's revert the support for LDAP and document that this feature is not supported with LDAP.


Drop feature support in LDAP setups

  1. Revert from _setup_ldap:

      if [[ -f /etc/dovecot/conf.d/auth-master.inc ]]
      then
        # Support Dovecot master user: https://doc.dovecot.org/configuration_manual/authentication/master_users/
        # > `result_success=continue` doesn’t work with PAM or LDAP without `auth_bind=yes`, because both of them require knowing the user’s password.
        sed -i -r '/auth_bind = yes/s/^(\s*)#/\1/' /etc/dovecot/conf.d/auth-master.inc
      fi
  2. Shift _create_masters into _create_accounts method, leveraging the same LDAP guard:

    1. Revert from _setup_dovecot_local_user:

        _log 'debug' 'Setting up Dovecot Master User'
        _create_masters
    2. Revert in check-for-changes.sh:

          # regenerate postfix accounts & dovecot masters
          if [[ ${SMTP_ONLY} -ne 1 ]]
          then
            _create_accounts
            _create_masters
          fi

      back to:

          # regenerate postfix accounts
          [[ ${SMTP_ONLY} -ne 1 ]] && _create_accounts
    3. Refactor the start of _create_accounts to call _create_masters and shift the LDAP guard to apply to both:

      if [[ -f /tmp/docker-mailserver/postfix-accounts.cf ]] && [[ ${ENABLE_LDAP} -ne 1 ]]

      to:

      [[ ${ENABLE_LDAP} -eq 1 ]] && return 0
      
      _create_masters
      if [[ -f /tmp/docker-mailserver/postfix-accounts.cf ]]
  3. Document for maintainers:

    # Support Dovecot master user: https://doc.dovecot.org/configuration_manual/authentication/master_users/
    # Supporting LDAP users requires `auth_bind = yes` in `dovecot-ldap.conf.ext`, see docker-mailserver/docker-mailserver/pull/2535 for details
    function _create_masters
  4. Document for users:

    ## Configuration
    
    It is possible to create, update, delete and list dovecot master accounts using `setup.sh`. See `setup.sh help` for usage.
    
    This feature is presently [not supported with LDAP](https://github.com/docker-mailserver/docker-mailserver/pull/2535).

auto-merge was automatically disabled May 6, 2022 14:03

Head branch was pushed to by a user without write access

@groupmsl
Copy link
Copy Markdown
Contributor Author

groupmsl commented May 6, 2022

Thank you very much for the help - it's helped me to work out what is actually going on a bit more. I've committed those changes (verbose) and the the tests that failed last time now pass on my machine - waiting for the github ones run to be sure.

On the note of dropping LDAP support, that is a shame. If I have time I will try and look into it properly so we can add support back in - if I get anywhere I'll raise another PR.

@polarathene polarathene enabled auto-merge (squash) May 6, 2022 21:08
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 6, 2022

Documentation preview for this PR is ready! 🎉

Built with commit: 2af0c11

@polarathene polarathene requested a review from casperklein May 6, 2022 23:13
@polarathene polarathene merged commit 2f3cbfc into docker-mailserver:master May 7, 2022
@groupmsl groupmsl deleted the dovecot-master-accounts branch May 11, 2022 12:17
@georglauterbach georglauterbach changed the title Added ability to configure dovecot master accounts service: added ability to configure dovecot master accounts May 12, 2022
@MohammedNoureldin
Copy link
Copy Markdown
Contributor

MohammedNoureldin commented Oct 22, 2023

Hey, @groupmsl!

Have you had time to check this functionality with LDAP?

@polarathene
Copy link
Copy Markdown
Member

The concern discussed earlier related to this feature and LDAP was incorrect IIRC. Just neither of us understood LDAP at the time well enough, should be doable.

I need to find time to allocate to wrapping up the open LDAP rework PR of mine first though.

@MohammedNoureldin
Copy link
Copy Markdown
Contributor

@polarathene just maybe a helpful link, here there is a guy implementing this in Nextcloud, maybe his work, especially the configs he mentioned/showed can be helpful.

Should I open an issue to track this?

@polarathene
Copy link
Copy Markdown
Member

maybe his work, especially the configs he mentioned/showed can be helpful.

nextcloud/mail#8917 (comment)

  • There is currently an open PR for Dovecot Lua auth (unofficial, DMS isn't implementing it, it's just a package with community guide in docs, specifically for delegating auth to Nextcloud accounts IIRC which were managed via LDAP).
  • We already have the SASL auth for Postfix to Dovecot by default.
  • We don't support SQL database and I don't think other maintainers will approve such.

I don't think it's particularly wise to use a master account (meant for admin) to grant Nextcloud the ability to login as any user in Dovecot, but I guess that's up to the sysadmin deploying DMS 🤷‍♂️

There is the OIDC WIP PR, which would contribute a Dovecot passdb config to authenticate/login with SSO. AFAIK that would need to rely on one of the existing provisioners for accounts though, so supporting it may require some changes to how DMS currently manages passdb/userdb config setup.

@MohammedNoureldin
Copy link
Copy Markdown
Contributor

If there is another possible approach, I would also recommend it.

I am not sure how Nextcloud will redirect the token to DMS in this case, I mean even if the OIDC PR gets merged, I hope soon, Nextcloud should also be forwarding the token somehow. I am not sure if it supports this at the moment.

@MohammedNoureldin
Copy link
Copy Markdown
Contributor

MohammedNoureldin commented Oct 27, 2023

I have been thinking about using Master Password for Dovecot again. Actually if the password is being rotated frequently, and DMS is configured to accept connections to use Master Password only from a specific IP CIDR (I am not sure if this is possible), then this should be no problem. What do you think?

Do you have any any clue where the issue with LDAP could be located?

UPDATE:

OIDC seems to be supported by Nextcloud particularly. This is mentioned here to be supported by Mailcow. Can this be helpful for the PR with OIDC? Is this the PR you meant? Because it seems kind of inactive to me.

@polarathene
Copy link
Copy Markdown
Member

only from a specific IP CIDR (I am not sure if this is possible)

Dovecot can be restricted to a subnet/IP I think. DMS doesn't have any direct configuration for that at present AFAIK.

Postfix submission ports can use a CIDR table config, something PERMIT_DOCKER option would likely also use in future when that gets reworked.

then this should be no problem. What do you think?

If you trust that Nextcloud won't be compromised with some vulnerability that an attacker could exploit, go for it? It's just another attack vector.

It's just that letting users connect to their account through a master account intended for admins seems like something you should be cautious about. I'm not sure if the feature was intended to be used that way. Dovecot / Postfix LDAP support does similar I think depending on config for LDAP queries but IIRC can be restricted to read-only or via auth that is restricted in scope like a subtree.

Is this the PR you meant? Because it seems kind of inactive to me.

Yes, and correct it's not that active.

As I mentioned, supporting OIDC will likely require some restructuring with how DMS currently approaches Dovecot auth + accounts management. I don't anticipate much movement on that front unless someone has time to dig into that and also convince maintainers to be comfortable with that. I may have input on such at a later date, but my available time is scarce for new features currently.


Do you have any any clue where the issue with LDAP could be located?

Are you asking about the Lua + Nextcloud + LDAP? It's a PR: #3579

@nioc
Copy link
Copy Markdown

nioc commented Aug 18, 2025

Hello,
I seen this post and I'm wondering if 2 years later, is it possible to use master account with LDAP users (my setup is DMS, LLDAP, Authelia and Snappy mail) ?
Sorry for the noise on a closed PR.

@polarathene
Copy link
Copy Markdown
Member

LDAP support is mostly dependent upon community. There is an open PR of mine that seeks to refactor it as an improvement but it's reliant upon me finding time to push it over the finish line.

As for this feature, without sinking some time into refreshing on it and the concerns with LDAP, I can't say. Chances are it's probably possible, someone just needs to look at what we're doing with the feature here and the concerns I raised/documented about LDAP support.

Once you're able to grok that, you should be able to put DMS aside and configure Dovecot directly (we also have dovecot.cf in our override support (see docs) to add extra Dovecot config as a convenience). Once verified, if it works for LDAP and the config necessary is communicated in a manner I can reproduce easily enough, then I can assist with updating any DMS integration.

For the time being though I'm unable to take on more commitments, my backlog is too large.

@nioc
Copy link
Copy Markdown

nioc commented Aug 19, 2025

Thanks a lot @polarathene for your reply ❤️
I will try with my current setup and let you know my feedback (whether it works or not) for possible future support of this feature.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/features kind/new feature A new feature is requested in this issue or implemeted with this PR service/dovecot

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Is it possible to get passwordless IMAP access from a specific host?

6 participants