How to use the CLI with ldap authentication

[johansmitsnl]

Initially started with a issue #43

I have added a the admin account to the superuser group (also created the group).

When I run the command stalwart-cli --url https://mail.domain.net -c [email protected]:passwd queue list I get an error: Failed to deserialize response: data did not match any variant of untagged enum Response.

I don't know how I can enable debug to see that might be wrong?

I have looked at the reverse proxy and I can see it got a 401:

[email protected] [16/Aug/2023:19:48:26 +0200] "GET /admin/queue/list? HTTP/2.0" 401 101 "-" "-"

When I do the search query the user with the results show:

ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:/// -b dc=domain,dc=net "(&(|(objectClass=mailAlias)(objectClass=mailAccount))(|([email protected])([email protected])))" objectClass mail givenname userPassword diskQuota memberOf otherGroups groupOfUniqueNames groupOfNames
dn: cn=Mail Admin,ou=people,dc=domain,dc=net
givenName: Mail
cn: Mail Admin
userPassword:: <REDACTED>
mail: [email protected]
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: top
objectClass: mailAccount
memberOf: cn=superusers,ou=groups,dc=domain,dc=net

If I try the command account list (from the documentation) I get this error: error: unrecognized subcommand 'account'.

Even with trace debug enabled I don't see any obvious error. I only see this in the output: Aug 16 19:48:26 h01-01 stalwart-mail[861954]: 2023-08-16T17:48:26.206178Z DEBUG session{instance="jmap" protocol=Jmap remote.ip="127.0.0.1" remote.port=53836}: jmap::api::http: event="request" uri="/admin/queue/list?"

[mdecimus]

When I run the command stalwart-cli --url https://mail.domain.net -c [email protected]:passwd queue list I get an error: Failed to deserialize response: data did not match any variant of untagged enum Response.

The error message needs to be fixed, but you are seeing that error because the authentication failed. Are you able to login using IMAP or JMAP?
If the problem is only the CLI, then you have to make sure that the account belongs to the superusers group.

If I try the command account list (from the documentation) I get this error: error: unrecognized subcommand 'account'.

I'll have that fixed in the documentation, it is a command from an older version that no longer works. Use database purge or any other command instead.

[mdecimus]

I think the problem is that the super user group has an email address as its name. You are using the 'mail' attribute as the user/group name and for the super user group this attribute has an email address rather than "superusers". You can fix this by adding another name field that contains the group name or simply changing the mail attribute to superusers.

[mdecimus]

If it doesn't work I'll run some tests tomorrow as I am currently travelling.

[johansmitsnl]

Changing the e-mail field to superusers worked. But the e-mail field is not the name of the group, why is this used as a group name?

This needs more documentation though. Maybe some ldap examples on how it should be set-up.

[mdecimus]

But the e-mail field is not the name of the group, why is this used as a group name?

This is because you have configured both the account name and the e-mail address attributes to be mail:

[directory."ldap".attributes]
name = "mail"
email = "mail"

You may want to use a different attribute for the account name. Or, if you don't want to change your LDAP schema, a quick fix would be setting the current mail field of the superuser group as the superuser group name:

[directory."ldap".options]
catch-all = true
#catch-all = { map = "(.+)@(.+)$", to = "info@${2}" }
subaddressing = true
#subaddressing = { map = "^([^.]+)\.([^.]+)@(.+)$", to = "${2}@${3}" }
superuser-group = "[email protected]"

[johansmitsnl]

That makes sense. Thanks for the explanation!