[bug]: not allowed to send mails as a too new user

[felixlabrot]

What happened?

Hello,

I have noticed an issue where a newly created user in the LDAP directory logs in to the mailbox and can receive mails but is unable to send mails. To the client the error 5.5.4 You are not allowed to send from this address. is shown (doesn't matter if Roundcube, Thunderbird, ...).

The log states: DEBUG MAIL FROM unauthorized (smtp.mail-from-unauthorized) listenerId = "submissions", localPort = 465, remoteIp = 192.168.1.10, remotePort = 61611, from = "[email protected]", details = ["test"]

After waiting for some time (I didn't pay attention to the clock but it must have been around 1 hour, maybe a bit less) it suddenly starts working.
Reloading config doesn't help; restarting the entire Docker stack doesn't either.
The issue can reliably be reproduced every time. As I now know that I just have to wait for an hour it isn't really a problem. But it is weird that it behaves like this.

How can we reproduce the problem?

I can reproduce the problem by doing the following steps:

1. create new user
2. send mail -> fails
3. wait 1hr
4. send mail -> works

Version

v0.10.x

What database are you using?

RocksDB

What blob storage are you using?

RocksDB

Where is your directory located?

LDAP

What operating system are you using?

Docker

Relevant log output

DEBUG MAIL FROM unauthorized (smtp.mail-from-unauthorized) listenerId = "submissions", localPort = 465, remoteIp = 172.16.240.215, remotePort = 61611, from = "[email protected]", details = ["test"]

Code of Conduct

• I agree to follow this project's Code of Conduct

[mdecimus]

This is due to the must-match sender setting. The recipients LDAP filter is not returning the email addresses associated with the account.

[felixlabrot]

This doesn't explain it. As soon as the user is created, it is available via LDAP. Otherwise the IMAP login wouldn't work (and all our other programs which query via LDAP). Also when SMTP does first the login and then this check, it makes no sense that the LDAP query first works and then it doesn't.

[mdecimus]

The LDAP query works indeed, but it is not returning the list of email addresses associated with the account. Make sure the LDAP filters are returning also the e-mail addresses associated with the account and that the e-mail attribute mapping is correct.

[felixlabrot]

The query does return the address and the mapping is also correct. When creating a new AD user I don't create a Stalwart account. It is created automatically on first login to Roundcube or Thunderbird. And the account is created correctly (with correct mail address). This comes from the query and mapping, as our e-mail addresses are not username@domain. What the e-mail address is, is specified in the mail attribute of the user.
Therefore I know exactly that on the point in time of first login the address is filled out correctly and therefore correctly queried from LDAP.

[mdecimus]

This log entry you provided shows the associated email addresses that Stalwart obtained from the LDAP response:

DEBUG MAIL FROM unauthorized (smtp.mail-from-unauthorized) listenerId = "submissions", localPort = 465, remoteIp = 172.16.240.215, remotePort = 61611, from = "[email protected]", details = ["test"]

The details field shows which e-mail addresses were present in the response and only the string test could be found. Try setting the log level to trace and make sure you are correctly mapping the field names.