# postfix + ldap: dict_ldap_lookup: Search error 32 (detailed)

## adamtheo

Hello, all.

I had successfully set up postfix using LDAP for aliases without much problem a couple of months ago, but that server completely crashed with a hard drive corruption, forcing me to start anew without my old config files for reference.

I have been attempting to get this working for 5 days now on my own (with the help of Google, of course), but little success. I'm hoping someone can help me.

The situation: I have some entries in my LDAP directory already (two user accounts and two groups), and I can view those entries via anonymous ldapsearch on non-TLS port 389 (don't have StartTLS working yet). So I'm sure the LDAP end is working fine. Here's the output of one of these user accounts from ldapsearch:

 *Quote:*   

> 
> 
> # adamtheo, persons, theoretic
> 
> dn: uid=adamtheo,ou=persons,dc=theoretic
> ...

 

 :Exclamation:   However, postfix is not delivering email to the Maildir's of the users. It seems that my machine and postfix are receiving the email from the outside world, but rejecting them everytime. Here's some log output from postfix upon receiving an email for the above user:

 *Quote:*   

> 
> 
> Feb  5 20:16:07 mathaw postfix/smtpd[7774]: connect from ns1.crynwr.com[192.203.178.14]
> 
> Feb  5 20:16:07 mathaw postfix/smtpd[7774]: DEF46181FE: client=ns1.crynwr.com[192.203.178.14]
> ...

 

 :Exclamation:   I am attempting to use LDAP as an alias lookup table. Here is the output from "postconf -n":

 *Quote:*   

> 
> 
> alias_database = hash:/etc/postfix/aliases
> 
> alias_maps = hash:/etc/postfix/aliases, ldap:/etc/postfix/theoretic.conf
> ...

 

 :Exclamation:   And here is the /etc/postfix/theoretic.conf file referred to in the above alias_maps:

 *Quote:*   

> 
> 
> server_host = theoretic.com localhost
> 
> server_port = 389
> ...

 

 :Exclamation:   I have run "newaliases" and "postfix reload". My hostname is "mathaw", and domain name is "theoretic.com".

----------

## adamtheo

And as a followup, here are the permissions of certain files and directories, for more info:

# /home/adamtheo

 *Quote:*   

> 
> 
> drwxr-xr-x     adamtheo administrators
> 
> 

 

# /etc/postfix

 *Quote:*   

> 
> 
> drwxr-xr-x    2 root     root          392 Feb  5 08:55 .
> 
> -rw-r--r--    1 root     root          809 Feb  5 08:49 aliases
> ...

 

I'm hoping this and the previous info can help. This has me baffled and frustrated.   :Sad: 

----------

## Janne Pikkarainen

I guess it doesn't help at all if you replace this 

```
search_base = dc=theoretic
```

 with 

```
search_base = ou=persons,dc=theoretic
```

What if you raise OpenLDAP's debug level to 288 and see how the Postfix's query goes?

----------

## adamtheo

I may have spotted the problem when looking through the below logs. postfix seems to be searching for "uid=adamtheo@theoretic.com" instead of just "uid=adamtheo". I've switched the "result_attribute" to "mail" in main.cf. I'm testing the change now.

As for setting "search_base = ou=persons,dc=theoretic", no, that did not change matters any, although I thought it would when you suggested it since I have "scope = one" in my postfix's ldap config file.

But setting openldap's debug to 288 shows the following:

 *Quote:*   

> 
> 
> Feb  6 17:15:36 mathaw slapd[1313]: do_search
> 
> Feb  6 17:15:36 mathaw slapd[1313]: SRCH "ou=persons,dc=theoretic" 1 0
> ...

 

Still no results, so any other ideas? Thanks.

----------

## Janne Pikkarainen

 *adamtheo wrote:*   

> I may have spotted the problem when looking through the below logs. postfix seems to be searching for "uid=adamtheo@theoretic.com" instead of just "uid=adamtheo". I've switched the "result_attribute" to "mail" in main.cf. I'm testing the change now.

 

Ahh. That may be the cause. But you probably want to has uid as the result_attribute, so maybe this configuration snippet could work? 

```
query_filter = (mail=%s)

result_filter=%u

result_attribute = uid
```

I don't know for sure since I didn't test it and it's getting late here in Finland...  :Smile: 

----------

## adamtheo

I tried my change, then your proposed change to my theoretic.conf file, then ran "newaliases" then restarted postfix. But I'm seeing no change in the LDAP logs. Postfix still seems to be querying openldap using "uid=adamtheo@theoretic.com". I'm baffled.

----------

## Janne Pikkarainen

What? No change at all? If even replacing the query_filter = (mail=%s) with query_filter = (mail=%u) and throwing out the result_filter line doesn't help, then I'm really getting baffled, too. 

Have you restarted slapd? Not that it should affect this in any way but hey, this situation is strange enough already so you never know...

----------

## adamtheo

I have tried all of your suggestions, but none work. I have verified that my Postfix installation understands the ldap file type using "postconf -m", and yes, "ldap" is one of the file types listed (along with hash and mysql and others). I have built the aliases database using "newaliases", and have run "postmap -q postmaster /etc/postfix/aliases" returns the system user of "root", which is correct. But running the same command for 'adamtheo' returns nothing, so it seems newaliases (and all other means of building the aliases database) does not fetch from the LDAP directory, even though it is querying it (as can be seen in the ldap logs).

And no matter what changes I make to my postfix conf's for LDAP, postfix still queries for the 'uid' attribute using the full email addy (usernmame and domain), instead of just the username, or instead using the 'mail' attribute. I'll play with it some other day. For now, I've just ditched using LDAP for postfix, and am putting all the email users in the plaintext aliases file to be used in the database. That is working fine.

Thanks for your help, I'll post here again when I get around to messing with this again.

----------

## maliber

Hi i was reading this thread and noticed the folowing in your config file posted above. 

```
 scope = one 
```

 Are your mail accounts located directly under your searchbase? If this isn't the case, it may be the origin of your troubles.

----------

