🐛: Inbound emails do not get saved when LDAP server is down

[sw5ciprl]

What happened?

During a service outage on our LDAP server, I noticed that alert emails I was supposed to get were nowhere to be seen. As it later turned out, the emails were not stored at all.

How can we reproduce the problem?

I can reproduce the problem by doing the following steps:

1. Take down the LDAP server on the default directory Stalwart is using
2. Send an email to a mailbox hosted on LDAP
3. Start the LDAP server
4. Check inbox

Version

v0.12.x

What database are you using?

RocksDB

What blob storage are you using?

S3-compatible

Where is your directory located?

LDAP

What operating system are you using?

Docker

Relevant log output

XXXX-XX-XXTXX:XX:XXZ ERROR LDAP error (store.ldap-error) listenerId = "smtp", localPort = 25, remoteIp = XXX.XXX.XXX.XXX, remotePort = XXXXX, reason = "I/O error: Connection refused (os error 111)", causedBy = "crates/directory/src/backend/ldap/lookup.rs:334", causedBy = "crates/directory/src/core/dispatch.rs:89", causedBy = "crates/smtp/src/inbound/rcpt.rs:237", details = "Failed to verify address."

Code of Conduct

• I agree to follow this project's Code of Conduct

[mdecimus]

Your directory needs to be up and running in order to receive emails otherwise Stalwart won't know which email addresses are valid.

[sw5ciprl]

As far as I can tell, when logging in to the LDAP directory, Stalwart already creates a user account with the email and name set from LDAP. It's good practice to have an offline cache in place anyway.

[sw5ciprl]

@mdecimus Any response on this?

[mdecimus]

Your LDAP server is the authoritative source for determining whether an email address is valid. For this reason, it must be reachable at all times for both authentication and message acceptance to function properly.

[sw5ciprl]

Yes, however most directory-enabled systems keep a local credential cache to ensure users are able to log in when the directory is inaccessible (e.g. Windows caches credentials, allowing login when AD DC is unavailable).