Question
Authentication failure during Dovecot 2.3 to 2.4 upgrade: LDAP schema validation
Neel Orbit
0 reputation · 06 Sept 2022, 20:59 UTC
21.4K views
Loading…
0 reputation · 06 Sept 2022, 20:59 UTC
Upgrading a Dovecot installation from version 2.3.x to 2.4.x introduces changes to how the LDAP authentication backend validates user entries. In version 2.3.x, the system allowed a fallback to the uid attribute for determining mailbox location if other attributes were missing.
In version 2.4.x, the backend implements stricter schema validation. This change requires the presence of the mail attribute, and entries lacking this specific attribute are rejected during the authentication process.
For environments where the LDAP directory is not managed by the mail administrator, updating the schema may not be feasible, creating a conflict between the required 2.4.x validation and existing directory structures.
mail attribute?Dovecot 2.4 does not provide a configuration switch to re-enable the 2.3.x fallback from mail to uid. The stricter validation is baked into the userdb lookup: if the LDAP entry returned by user_filter lacks a mail attribute, the lookup fails. The only supported way to restore the old behavior is to ensure every user entry has a mail attribute (populated from uid or another source) or to map an existing attribute to mail in user_attrs.
In 2.3 the LDAP userdb treated mail as optional and would synthesize a mailbox path from uid when it was absent. 2.4 refactored the userdb to require a concrete mail value because the attribute is now the canonical identifier for quota, sieve, and replication features. There is no ldap_schema_validation = no or similar knob; the check happens inside the C code path that builds the userdb reply.
dovecotmailIf your directory cannot be altered, add a mapping in dovecot-ldap.conf.ext (or the included LDAP file) so that an attribute you do have—commonly uid or mailRoutingAddress—is presented to Dovecot as mail:
user_attrs = \
=uid=%{ldap:uid}, \
=mail=%{ldap:uid}, \
=home=/var/vmail/%{ldap:uid}, \
=mail=maildir:/var/vmail/%{ldap:uid}The =mail=%{ldap:uid} line tells Dovecot "take the uid value and return it as the mail field." Adjust the template if your mailbox layout differs.
doveadm user -u 'testuser' should return a mail field without error.ldapsearch -x -H ldap://... -b 'ou=people,dc=example,dc=com' '(uid=testuser)' mail uid confirms which attributes actually exist.auth_debug=yes and auth_verbose=yes to dovecot.conf, restart, then watch journalctl -u dovecot -f for lines like ldap: userdb: missing mail attribute.Adding a real mail attribute (e.g., mail: [contact removed]) to each entry is cleaner and future-proofs features like quota clones and dsync replication that rely on a stable, globally unique mail address.
Run doveadm user -u 'failing_user' and paste the exact error line. If it says userdb lookup: user not found the problem is user_filter; if it says missing mail attribute the mapping above will fix it.
Use comments to ask for clarification. Post a solution as an answer.
33,775 reputation · 07 Sept 2022, 08:03 UTC
Dovecot 2.4 added the ldap_schema option. By default it is set to dovecot, which forces every user entry to contain a mail attribute. To drop that requirement, set the option to default:
# /etc/dovecot/conf.d/10-auth.conf
ldap_schema = default
With ldap_schema = default the LDAP backend keeps using ldap_mailbox_attribute (default mail). If a user entry lacks mail, Dovecot falls back to uid, exactly like 2.3.x. If you prefer a hard‑coded fallback, you can explicitly set:
ldap_mailbox_attribute = uid
Remember to test the change in a staging environment and watch /var/log/dovecot.log for the expected authentication messages.