使用 FreeIPA 和 Roundcube 在 Docker 中设置邮件服务器

Question

我尝试设置自己的邮件服务器，并使用 Ldap（FreeIPA）进行身份验证。它们都必须在 docker 容器中运行。我不知道我做错了什么。也许是我的 ldap 配置。

version: '3.9'

services:
  freeipa:
    image: freeipa/freeipa-server:centos-9-stream-4.10.0
    container_name: ipa
    restart: unless-stopped
    tty: true
    stdin_open: true
    hostname: ipa
    domainname: ipa.example.local
    #read_only: true
    networks:
      priv_network:
        ipv4_address: 172.16.1.10
    extra_hosts:
      - "ipa.example.local:172.16.1.10"
    environment:
      - IPA_SERVER_HOSTNAME=ipa.example.local
      - IPA_SERVER_IP=172.16.1.10
      - TZ=Europe/Berlin
    command:
      - --realm=example.local
      - --domain=example.local
      - --ds-password=secret123
      - --admin-password=secret123
      - --no-host-dns
      - --setup-dns
      - --auto-forwarders
      - --allow-zone-overlap
      - --no-dnssec-validation
      - --unattended
      - --skip-mem-check
      - --auto-forwarders
      - --auto-reverse
    sysctls:
      - net.ipv6.conf.all.disable_ipv6=0
      - net.ipv6.conf.lo.disable_ipv6=0
    volumes:
      - ./vol/freeipa/data:/data
      - ./vol/freeipa/logs:/var/logs
      - ./vol/freeipa/config:/root/pw-portal/config
      - /sys/fs/cgroup:/sys/fs/cgroup:ro
    tmpfs:
      - /run
      - /var/cache
      - /tmp
    cap_add:
      - SYS_TIME
      - NET_ADMIN
    ports:
      - 443:443
      - 389:389

  roundcubemail:
    image: roundcube/roundcubemail:latest
    container_name: roundcubemail
    volumes:
      - ./vol/roundcube/www:/var/www/html
      - ./vol/roundcube/db/sqlite:/var/roundcube/db
    ports:
      - 9002:80
    environment:
      - ROUNDCUBEMAIL_DB_TYPE=sqlite
      - ROUNDCUBEMAIL_SKIN=elastic
      - ROUNDCUBEMAIL_DEFAULT_HOST=tls://172.16.1.11
      - ROUNDCUBEMAIL_SMTP_SERVER=tls://172.16.1.11
    networks:
      priv_network:

  mailserver:
    image: docker.io/mailserver/docker-mailserver:latest
    container_name: mailserver
    hostname: mail
    domainname: mail.example.local
    restart: unless-stopped
    volumes:
      - ./vol/mailserver/data/:/var/mail/
      - ./vol/mailserver/state/:/var/mail-state/
      - ./vol/mailserver/logs/:/var/log/mail/
      - ./vol/mailserver/config/:/tmp/docker-mailserver/
      - /etc/localtime:/etc/localtime:ro

    environment:
      - ENABLE_SPAMASSASSIN=0
      - ENABLE_CLAMAV=0
      - ENABLE_FAIL2BAN=0
      - ENABLE_POSTGREY=0
      - ACCOUNT_PROVISIONER=LDAP
      - LDAP_SERVER_HOST=ldap://ipa
      - LDAP_BIND_DN=uid=admin,cn=users,cn=accounts,dc=example,dc=local
      - LDAP_BIND_PW=secret123
      - LDAP_SEARCH_BASE=cn=users,cn=accounts,dc=example,dc=local
      - LDAP_QUERY_FILTER_DOMAIN=(mail=*@%s)
      - LDAP_QUERY_FILTER_USER=(mail=%U@%s)
      - LDAP_QUERY_FILTER_ALIAS=(|) # doesn't match anything
      - LDAP_QUERY_FILTER_GROUP=(|) # doesn't match anything
      - LDAP_QUERY_FILTER_SENDERS=(mail=%s)      
      - SPOOF_PROTECTION=1
      - ENABLE_SASLAUTHD=1
      - SASLAUTHD_MECHANISMS=ldap
      - SASLAUTHD_LDAP_FILTER=(&(mail=%[email protected])(objectClass=inetOrgPerson))
      - ONE_DIR=1
      - PERMIT_DOCKER=host
      - DOVECOT_USER_FILTER=(&(objectClass=inetOrgPerson)(mail=%u))
      - DOVECOT_PASS_ATTRS==password=%{ldap:userPassword},=user=%{ldap:uid}
      - DOVECOT_USER_ATTRS==home=/var/mail/%{ldap:uid},=mail=maildir:~/Maildir,uidNumber=uid,gidNumber=gid
    cap_add:
      - NET_ADMIN
    networks:
      priv_network:
        ipv4_address: 172.16.1.11

networks:
  priv_network:
    name: ext_priv_network
    driver: bridge
    ipam:
      driver: default
      config:
        - subnet: 172.16.1.0/24
          gateway: 172.16.1.1

我创建了一个用户并首次登录 IPA 来设置密码。如果我尝试登录 Roundcube，则只会登录失败。邮件服务器打印了以下消息。

Dec 25 08:59:52 mail dovecot: auth: ldap(test.user,172.16.1.2,<m+/uPaPw4pasEAEC>): unknown user (SHA1 of given password: f2b14f)
Dec 25 08:59:54 mail dovecot: imap-login: Disconnected (auth failed, 1 attempts in 2 secs): user=<test.user>, method=PLAIN, rip=172.16.1.2, lip=172.16.1.11, session=<m+/uPaPw4pasEAEC>
Dec 25 09:00:39 mail postfix/pickup[1906]: 517F864B0E: uid=101 from=<root>
Dec 25 09:00:39 mail postfix/cleanup[1910]: 517F864B0E: message-id=<[email protected]>
Dec 25 09:00:39 mail postfix/cleanup[1910]: warning: dict_ldap_lookup: Search error 2: Protocol error 
Dec 25 09:00:39 mail postfix/cleanup[1910]: warning: ldap:/etc/postfix/ldap-aliases.cf lookup error for "[email protected]"
Dec 25 09:00:39 mail postfix/cleanup[1910]: warning: 517F864B0E: virtual_alias_maps map lookup problem for [email protected] -- message not accepted, try again later
Dec 25 09:00:39 mail postfix/pickup[1906]: 5228D64B0E: uid=0 from=<root>
Dec 25 09:00:39 mail postfix/cleanup[1923]: 5228D64B0E: message-id=<[email protected]>
Dec 25 09:00:39 mail postfix/cleanup[1923]: warning: dict_ldap_lookup: Search error 2: Protocol error 
Dec 25 09:00:39 mail postfix/cleanup[1923]: warning: ldap:/etc/postfix/ldap-aliases.cf lookup error for "[email protected]"

Dovecot DOVECOT_USER_FILTER、DOVECOT_PASS_ATTRS 和 DOVECOT_USER_ATTRS 的正确 LDAP 语法是什么？