LDAP authentication using auth. bindings

[foxcpp]

Considerations

Search request params should be configurable, as well as initial bind credentials. "DN template" option as on https://wiki.dovecot.org/AuthDatabase/LDAP/AuthBinds may be used to improve performance at the cost of flexibility.

Authentication status cache would be useful to amortize load since this approach requires a new connection each time.

Possible config example

auth.ldap tls://ldap.rocks.example.org:636 {
  # DN lookup params.
  search_base_dn "dc=example,dc=com"
  search_filter "(&(objectClass=posixAccount)(uid={username}))"
  # ... alternatively, DN template.
  dn_template "uid={username},ou=people,o=org"
 
  # Credentials for initial read-only bind.
  bind_username "mailserver"
  bind_password "secret"
}

References

• https://godoc.org/github.com/go-ldap/ldap UserAuthentication example.
• https://wiki.dovecot.org/AuthDatabase/LDAP/AuthBinds
• https://doc.dovecot.org/configuration_manual/authentication/ldap/