LDAP and Authentik

[kbekus]

hi all, just wondering if anyone else using using Authentik's LDAP outpost as an identity provider for Stalwart? I'm using it for a few different services but I cannot for the life of me get Stalwart mail to successfully let me log in.

I've changed the authentication directory to the LDAP one I've created, set the bind DN and secret (and tested them using ldapsearch), enabled bind auth DN since Authentik doesn't have a hashed password attribute.

Could anyone give me some pointers please toward config I could try?

[mdecimus]

Hi,

You can try setting Stalwart's logging level to trace and check the logs on both Stalwart and Authentik.

[kbekus]

Just checking the trace logging on the Stalwart mail server I see this entry:

2024-05-07T03:18:41.395128Z DEBUG directory::backend::ldap::lookup: LDAP entry context="ldap" event="fetch_principal" entry=SearchEntry { dn: "cn=user,ou=users,dc=domain,dc=com", attrs: {"memberOf": ["cn=authentik Admins, "cn=query,ou=groups,dc=domain,dc=com"], "objectClass": ["top", "person", "organizationalPerson", "inetOrgPerson", "user", "posixAccount", "goauthentik.io/ldap/user"], "mail": ["[email protected]"], "cn": ["user"]}, bin_attrs: {} }
2024-05-07T03:18:41.395292Z ERROR jmap::auth::oauth::token: Failed to generate OAuth token: Failed to obtain password hash

Might this have something to do with the password attribute?

[mdecimus]

According to the logs, Stalwart is being able to fetch the LDAP object. However, the error you see below is because you're trying to use OAuth (perhaps through the webadmin?) which is not supported when using auth bind.

[kbekus]

Yes, so it looks like it's pulling the my user account across through LDAP but it's also creating a bunch of other user accounts that are actually the groups that my account belong to. I'm guessing a filter is not working properly?

In terms of OAuth, I'm not deliberately using it. This is a clean slate docker install. All settings are default other than setting the authentication directory to the LDAP one I've created. Is there a switch to disable OAuth?

[LeifAndersen]

@kbekus I had the same issue.

You're probably seeing this error because you are trying to log into the config portal using an ldap account (using ldapauth). This does not seem to be supported.

However the account likely still exists in the database and you can still sign into it from an email client.

Again, conjecture, as I didn't write this, I would trust @mdecimus 's opinion more here. This is just based on my experience. ;)

[kbekus]

Ah, you are right, thankyou! I can indeed log in with an IMAP client. I just need to sort out my group and domain filters now.

[mdecimus]

Yes, so it looks like it's pulling the my user account across through LDAP but it's also creating a bunch of other user accounts that are actually the groups that my account belong to. I'm guessing a filter is not working properly?

The Directory section of the webadmin works only with the Internal directory. You can safely ignore what is listed under the Accounts section when using LDAP as those are LDAP CN to id mappings.

[kbekus]

Awesome. Again thanks for everyone's help.
Just a suggestion, it might be good to add a column to the 'accounts', 'groups', 'lists', and 'domains' areas with a source - showing my entries as derived from LDAP will indicate that they're read only.