🐛: Stalwart doesn't assign users to groups with LDAP directory

[DodoLeDev]

What happened?

When connecting to Stalwart through an account stored in an LDAP directory, here is what Stalwart is doing right:

• It creates a user entry with correct name, email, type
• It creates the group objects it belongs to

But

• It doesn't assign the user to that group! We need to manually add it by ourselves

How can we reproduce the problem?

I can reproduce the problem by doing the following steps:

• Setup LDAP directory (in my case FreeIPA) with the following attribute bindings:
  • Name -> uid
  • type -> objectClass
  • Description -> displayName
  • Secret and Secret changed -> krbLastPwdChange (without filling the Secret entry it complains)
  • Groups -> memberOf
  • E-mail -> mail
• Login with an account (it at least belongs to the ipausers group)

Version

v0.11.x

What database are you using?

RocksDB

What blob storage are you using?

RocksDB

Where is your directory located?

LDAP

What operating system are you using?

Docker

Relevant log output

Code of Conduct

• I agree to follow this project's Code of Conduct

[mdecimus]

The groups are probably being added but they are not displayed in the webadmin. The account management page of the webadmin only displays information available in the internal directory, it does not query your LDAP server to obtain group information.
Adding users to groups from the webadmin has no effect if you're using an external directory such as LDAP.

[pdf]

I'm confused by this response @mdecimus as the groups are populated in the UI (as mentioned by the OP), but group membership is not resolved - the users in the UI show as being members of zero groups, and groups show as having zero members, even though the logs clearly show that the specified Groups attribute (e.g. memberOf) correctly contains those groups in the LDAP user query response.

[pepa65]

It says the groups are not populated in the Stalwart webinterface. So it seems the state of the LDAP is not reflected in the UI.

[ex0lis]

I am having the same issue concerning group membership: when a user is logged in Stalwart fetches all attributes, including "memberOf" listing their memberships, the groups tab shows those groups but they has no members, is there a way i can retrieve and sync memberships also? it would drastically simplify mailing administration.

Method for authentication is "Bind authentication after lookup" (that is what works at least at my setup)
Filter Name is (&(|(objectClass=user)(objectClass=group))(sAMAccountName=?))
Filter Email is (&(|(objectClass=user)(objectClass=group))(|(mail=?)(mailAlias=?)))

Groups attribute is set to "memberOf"

Is there anything else that could help targeting the issue?

My Stalwart version is 0.15.5