Dovecot auth timeouts caused by LDAP referrals from Samba DC (NS7 to NS8 migration)

Bug
,
1

I have been experiencing similar issues after migrating mail and samba DC from NS 7 to NS 8. Login attempts from dovecot via ldap time out, no user is able to log in:

2026-07-07T04:59:58+02:00 [1:mail3:dovecot] auth: Error: auth-worker: Aborted PASSV request for oliver: Lookup timed out
2026-07-07T04:59:58+02:00 [1:mail3:dovecot] auth-worker(3795): conn unix:auth-worker (pid=507,uid=90): auth-worker<1>: ldap(oliver,5.149.18.5,<xxxxxxxxx>): Shutting down
2026-07-07T04:59:58+02:00 [1:mail3:dovecot] auth-worker(3795): Warning: conn unix:auth-worker (pid=507,uid=90): Auth master disconnected us while handling request for oliver for 60 secs (result=FAIL)

Digging into this, I found that this is related to ldap referrals being returned from Samba:

ldapsearch ... "(objectClass=referral)"
# extended LDIF
#
# LDAPv3
# base <dc=directory,dc=mydomain,dc=com> with scope subtree
# filter: (objectClass=referral)
# requesting: ALL
#


# search reference
ref: ldaps://directory.mydomain.com/CN=Configuration,DC=directory,DC=mydomain,DC=c
om


# search reference
ref: ldaps://directory.mydomain.com/DC=DomainDnsZones,DC=directory,DC=mydomain,DC=
com


# search reference
ref: ldaps://directory.mydomain.com/DC=ForestDnsZones,DC=directory,DC=mydomain,DC=
com


# search result
search: 2
result: 0 Success


# numResponses: 4
# numReferences: 3

Dovecot works if I

  • Bypass ldapproxy and contact samba directly in /etc/dovecot/userdb.conf.ext or
  • Limit the search base to “CN=users,DC=directory,DC=mydomain,DC=com” in /etc/dovecot/userdb.conf.ext

However, both of these solutions are temporary and wouldn’t survive a container restart.

Changing the port as suggested above is also not an option since the internal samba in NS doesn’t allow this.

The solution that works for me is adding a custom configuration file in /etc/dovecot/local.conf.d/ with this content:

import_environment = $import_environment LDAPREFERRALS=:false

Since the ldapproxy documentation on GitHub - NethServer/ns8-ldapproxy: LDAP proxy based on nginx for NS8 · GitHub explicitly states that ldap referrals will fail to work, I think that nethserver should make sure that dovecot doesn’t follow them.

1 Like
NS8 Mail AD Auth failing
2

Thanks for the detailed analysis — the reasoning is sound, and disabling referral chasing in Dovecot makes sense given that ldapproxy explicitly doesn’t support referrals.

Still, I don’t grasp why other NS7 → NS8 migrations didn’t hit this issue: referrals for Configuration and the DNS zone partitions are standard AD behavior, so I’d expect the timeout to be widespread — yet this is the first report.

What’s the history behind this AD? Was it a plain NS7-created domain, or was it modified at some point with external tools (RSAT, samba-tool, LDAP editors)? That could help us understand whether something specific in this directory triggers the referral chase.

Run also this command

runagent -m mail3 podman exec dovecot getent hosts directory.mydomain.com

What is the IP that name resolves to? Is it the DC one, or 127.0.0.1?