I would like Mailcow’s LDAP authentication to support logging in with either the user’s samAccountName or their full email address.
For example, an Active Directory user could have:
samAccountName: max.mustermann
mail:max.mustermann@my-domain.com
Both of the following should be accepted as the username:
max.mustermann
max.mustermann@my-domain.com
Both login methods should authenticate against the same LDAP/Active Directory account and therefore use the same password.
Example environment
Active Directory / LDAP:
ad.my-domain.com
Mail domain: my-domain.com
Example user:
dn: CN=Max Mustermann,OU=Users,DC=ad,DC=my-domain,DC=com
samAccountName: max.mustermann
mail: max.mustermann@my-domain.com
Desired behavior
Both of these logins should work:
Login using samAccountName
Username: max.mustermann
Password: <AD password>
Login using email address
Username: max.mustermann@my-domain.com
Password: <AD password>
Both should resolve to the same LDAP user:
samAccountName = max.mustermann
mail= max.mustermann@my-domain.com
and therefore the same Mailcow mailbox.
Suggested implementation
Instead of having a single LDAP attribute that must exactly match the supplied username, the LDAP authentication could support multiple login attributes.
For example:
Login attributes:
Mailbox attribute:
- mail
Conceptually, the LDAP search could be:
(|(samAccountName={username})(mail={username}))
For:
max.mustermann
the samAccountName condition would match.
For:
max.mustermann@my-domain.com
the mail condition would match.
In both cases, the resulting LDAP object would be the same user and the same mailbox.
Why this would be useful
This would allow environments using Active Directory or other LDAP directories to support both common login formats without having to choose between them.
For example:
Applications that use samAccountName can authenticate with max.mustermann.
Mail clients or users that use the email address can authenticate with max.mustermann@my-domain.com.
Both use the same LDAP account and password.
The actual mailbox address remains unchanged.
The important requirement is that both identifiers should be valid login names for the same LDAP account, rather than requiring administrators to choose one format exclusively.
Thank you for your Time and Help!
Regards Shiny