How to debug authentication failure?

[jeanas]

In my etc/config.toml, I've configured an in-memory user "database", as opposed to an SQLite database as I was using previously.

[management]
directory = "memory"

Here is the relevant portion of the config file that defines the memory directory (I've replaced the actual password with my-password-here).

[directory."memory"]
type = "memory"

[directory."memory".options]
catch-all = true
#catch-all = { map = "(.+)@(.+)$", to = "info@${2}" }
subaddressing = true
#subaddressing = { map = "^([^.]+)\.([^.]+)@(.+)$", to = "${2}@${3}" }
superuser-group = "superusers"

[[directory."memory".users]]
name = "admin"
description = "Superuser"
secret = "{PLAIN}my-password-here"
email = ["[email protected]"]
member-of = ["superusers"]

[[directory."memory".users]]
name = "notifications"
description = "Notifications from lilypond.community"
secret = "{PLAIN}my-password-here"
email = ["[email protected]"]

[directory."memory".lookup]
domains = ["notifications.lilypond.community"]

I have not changed other settings after the initial (re)installation using the provided installer script.

In my mail client, I've configured:

• Server: mail-server.notifications.lilypond.community
• Port: 143
• Encryption: STARTTLS
• User name: admin
• Password: my-password-here

Unfortunately, this doesn't work. The server logs say

2023-10-08T19:27:33.482945Z TRACE session{instance="imap" protocol=Imap remote.ip="[my IP]" remote.port=25977}: imap::core::client: event="read" data="K00493 LOGIN admin my-password-here\r\n" size=39
2023-10-08T19:27:33.485818Z TRACE session{instance="imap" protocol=Imap remote.ip="37.170.12.129" remote.port=25977}: imap::core::writer: event="write" data="K00493 NO [AUTHENTICATIONFAILED] Authentication failed\r\n" size=56

How can I understand what is happening?

Thanks!

[mdecimus]

Have you configured the "memory" directory in the [rcpt] section of the config file as well?

[mjac1521]

Hi rabidpug,
I am using mysql as the authentication directory and it is set in the config.toml under the [include]
"%{BASE_PATH}%/etc/directory/sql.toml",
so the issue should be something else.

[mdecimus]

@mjac1521 Please set the logging level to trace to see if some useful information is reported on the logs. Also, have you created the required table schema and adapted the queries in sql.toml for mySQL? Another test you can do is temporarily setting a clear text password to make sure it is not an issue related to password hashing.

[mjac1521]

Hi thank you for following up.

• Yes the logging level is on trace but no relevant information.
• Table schema were created as per stalwart documentation.
• Queries were not adapted I am using as they were installed.

[directory."default".query]
name = "SELECT name, type, secret, description, quota FROM accounts WHERE name = ? AND active = true"
members = "SELECT member_of FROM group_members WHERE name = ?"
recipients = "SELECT name FROM emails WHERE address = ?"
emails = "SELECT address FROM emails WHERE name = ? AND type != 'list' ORDER BY type DESC, address ASC"
verify = "SELECT address FROM emails WHERE address LIKE '%' || ? || '%' AND type = 'primary' ORDER BY address LIMIT 5"
expand = "SELECT p.address FROM emails AS p JOIN emails AS l ON p.name = l.name WHERE p.type = 'primary' AND l.address = ? AND l.type = 'list' ORDER BY p.address LIMIT 50"
domains = "SELECT 1 FROM emails WHERE address LIKE '%@' || ? LIMIT 1"

[directory."default".columns]
name = "name"
description = "description"
secret = "secret"
email = "address"
quota = "quota"
type = "type"

• About setting clear text I did that using MYSQL and in memory but still same issue.

What is curious is that CLI authentication is working perfect it authenticate using the superuser in MYSQL. For example if I run the following command:
/opt/stalwart-mail/bin/stalwart-cli -u https://xxx.xxxxx.xxx:8082 -c xxxxxxxx database purge
It work perfect. The authentication issue happens when using JMAP or IMAP with SMTP.

[mdecimus]

And does it work to authenticate on IMAP using the superuser account? Also make sure you're using the right account name to authenticate and not the email address (unless you're using email addresses as account names).

[mjac1521]

o woooow so many days digging trying to get this right. You just nailed I was using emails as the user instead names.

Thank a looot 🥇