Dovecot chases AD LDAP referrals with unexpected direct connections to port 636

[DavidePrincipi]

Steps to reproduce

• Install Mail on a NS8 cluster with a Samba AD account provider

• Attempt an IMAP/POP3 login, or run an LDAP user lookup through Dovecot

• Observe traffic from the Dovecot container: LDAP searches with subtree scope on the domain base DN receive search references for the CN=Configuration, DC=DomainDnsZones and DC=ForestDnsZones partitions, e.g.

  ref: ldaps://directory.mydomain.com/CN=Configuration,DC=directory,...
  

  Referral generation can be verified with:

  ldapsearch ... "(objectClass=referral)"
  

Expected behavior

Dovecot connects only to the local ldapproxy endpoint. LDAP search references returned by Samba AD are ignored: ldapproxy explicitly does not support referrals (see ns8-ldapproxy README), and chasing them cannot ever succeed in this architecture.

Actual behavior

libldap referral chasing is enabled by default, so Dovecot opens unexpected out-of-band connections to ldaps://directory.<domain>:636, bypassing ldapproxy. Inside the container the AD FQDN resolves to 127.0.0.1 (resolver workaround, see issues below), so the chased connection targets 127.0.0.1:636.

Observed consequences:

• Repeated DNS queries for the AD zone FQDN on every lookup (possible origin of the DNS flood in Dovecot tries to resolve the user domain with DNS #6808 / Samba logs flooded by Decryption Failed #7375)

• In at least one reported case (NS7 → NS8 migration, forum topic below), every PASSV lookup hangs until the 60s timeout, making all logins fail:

  auth: Error: auth-worker: Aborted PASSV request for oliver: Lookup timed out
  

  The exact failure mode of the chased connection (immediate refusal, TLS error on self-signed cert, or hang) seems environment-dependent and is not fully understood yet; the referral chase itself is unexpected in any case.

Confirmed workaround from the reporter: disabling referral chasing at the libldap level (LDAPREFERRALS=false via import_environment) restores logins immediately.

Proposed solution

Ship REFERRALS off in the Dovecot container's /etc/openldap/ldap.conf, so referral chasing is disabled for all libldap consumers in the image, persisting across restarts and updates. This may make the workarounds in #6808 and #7375 obsolete.

Components

mail (Dovecot) 1.7.12

See also

• Forum topic: https://community.nethserver.org/t/dovecot-auth-timeouts-caused-by-ldap-referrals-from-samba-dc-ns7-to-ns8-migration/28031/
• Discussion (PVT): https://mattermost.nethesis.it/nethesis/pl/s4fwu1nob7gybnbgfqjqt4pzmy
• Dovecot tries to resolve the user domain with DNS #6808
• Samba logs flooded by Decryption Failed #7375
• https://github.com/NethServer/ns8-ldapproxy (README: referrals not supported)

---

Thanks to oliver