Postfix + Cyrus + SASL + Active Directory probléma

Sziasztok,

Kérném a segítségeteket, mert nekem már minden ötletem elfogyott a következőben:

Adott egy Win2012R2 Active Directory pár userrel. Bizonyos okokból kifolyólag a levelező szerver egy Debian Cyrus+Postfix párossal. Az autentikáció ldap-on keresztül menne. Ez a levelezőszerver eredetileg local linux userek mailboxait kezelte és most szeretném, ha ldap-ra menne át. A proxyaddresses mező lenne a filter.
Sikerült felvenni cyradm-el a teszt user mail fiókját, de mikor a levelező kliensbe felakarom venni a mail fiókot, akkor a következő hibaüzenetet látok:

Apr 18 16:09:46 octopus cyrus/master[4264]: about to exec /usr/lib/cyrus/bin/imapd
Apr 18 16:09:46 octopus cyrus/imap[4264]: executed
Apr 18 16:09:46 octopus cyrus/imap[4264]: accepted connection
Apr 18 16:09:46 octopus cyrus/imap[4264]: imapd:Loading hard-coded DH parameters
Apr 18 16:09:46 octopus cyrus/imap[4264]: SSL_accept() incomplete -> wait
Apr 18 16:09:46 octopus cyrus/imap[4264]: SSL_accept() succeeded -> done
Apr 18 16:09:46 octopus cyrus/imap[4264]: starttls: TLSv1.2 with cipher DHE-RSA-AES128-SHA (128/128 bits new) no authentication
Apr 18 16:09:46 octopus cyrus/imap[4264]: badlogin: [192.168.0.52] CRAM-MD5 [SASL(-13): authentication failure: incorrect digest response]
Apr 18 16:09:49 octopus cyrus/master[4265]: about to exec /usr/lib/cyrus/bin/imapd
Apr 18 16:09:49 octopus cyrus/imap[4264]: accepted connection
Apr 18 16:09:49 octopus cyrus/imap[4265]: executed
Apr 18 16:09:49 octopus cyrus/imap[4264]: SSL_accept() incomplete -> wait
Apr 18 16:09:49 octopus cyrus/imap[4264]: SSL_accept() succeeded -> done
Apr 18 16:09:49 octopus cyrus/imap[4264]: starttls: TLSv1.2 with cipher DHE-RSA-AES128-SHA (128/128 bits new) no authentication
Apr 18 16:09:49 octopus cyrus/imap[4264]: badlogin: [192.168.0.52] CRAM-MD5 [SASL(-13): user not found: user: user@kulso.domain.com property: cmusaslsecretCRAM-MD5 not found in sasldb]

Azt sejtem,. hogy még mindig a local userek között keresné, de már az saslauthd-t, a cyrus-t is meg a postfix-et is átállítottam (valószínüleg nem jól) ldap-ra...

root@octopus:~# imtest -a user -l0 -m login 192.168.0.16
S: * OK [CAPABILITY IMAP4rev1 LITERAL+ ID ENABLE STARTTLS AUTH=DIGEST-MD5 AUTH=CRAM-MD5 AUTH=PLAIN AUTH=LOGIN SASL-IR] octopus Cyrus IMAP v2.4.16-Debian-2.4.16-4+deb7u2 server ready
Please enter your password:
C: L01 LOGIN user {8}
S: + go ahead
C:
S: L01 OK [CAPABILITY IMAP4rev1 LITERAL+ ID ENABLE ACL RIGHTS=kxte QUOTA MAILBOX-REFERRALS NAMESPACE UIDPLUS NO_ATOMIC_RENAME UNSELECT CHILDREN MULTIAPPEND BINARY CATENATE CONDSTORE ESEARCH SORT SORT=MODSEQ SORT=DISPLAY THREAD=ORDEREDSUBJECT THREAD=REFERENCES ANNOTATEMORE LIST-EXTENDED WITHIN QRESYNC SCAN XLIST URLAUTH URLAUTH=BINARY LOGINDISABLED COMPRESS=DEFLATE IDLE] User logged in SESSIONID=
Authenticated.
Security strength factor: 0

* BAD Invalid tag
^CC: Q01 LOGOUT
Connection closed.
root@octopus:~# testsaslauthd -u user -p Pass123 -s smtp
0: OK "Success."
root@octopus:~# testsaslauthd -u user -p Pass123 -s imap
0: OK "Success."

A következők lennének a confi fájlok:

root@octopus:/# cat /etc/postfix/main.cf
# See /usr/share/postfix/main.cf.dist for a commented, more complete version

# Debian specific: Specifying a file name will cause the first
# line of that file to be used as the name. The Debian default
# is /etc/mailname.
#myorigin = /etc/mailname

smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
biff = no

# appending .domain is the MUA's job.
append_dot_mydomain = no

# Uncomment the next line to generate "delayed mail" warnings
#delay_warning_time = 4h

readme_directory = no

# TLS Information
smtpd_use_tls = yes
smtpd_tls_key_file = /etc/ssl/certs/newkey.pem
smtpd_tls_cert_file = /etc/ssl/certs/newcert.pem
smtpd_tls_CAfile = /etc/ssl/certs/cacert.pem
smtpd_tls_loglevel = 3
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom

# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
# information on enabling SSL in the smtp client.

myhostname = kulso.domain.com
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination = kulso.domain.com, octopus, localhost.localdomain, localhost
relayhost = mail.t-online.hu
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all

# SASL Auth Settings
smtpd_sasl_local_domain =
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
broken_sasl_auth_clients = yes
#smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination

# Authentication on smarthost
smtp_sasl_auth_enable = yes
smtp_sasl_security_options =
smtp_sasl_password_maps = hash:/etc/postfix/client_passwords

#mailbox_transport = lmtp:unix:/var/run/cyrus/socket/lmtp
mailbox_transport = cyrus

alias_maps = ldap:/etc/postfix/ldap_aliases.cf
virtual_alias_maps = ldap:/etc/postfix/ldap_aliases.cf
local_recipient_maps = ldap:/etc/postfix/ldap_aliases.cf
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination

root@octopus:/# cat /etc/postfix/ldap_aliases.cf
server_host = neptunus
search_base = ou=home,dc=belsodomain,dc=com
bind=yes
bind_dn=CN=Rendszergazda,CN=Users,DC=belsodomain,DC=com
bind_pw=Pass123
scope=sub
query_filter = (proxyAddresses=%s)
result_attribute = sAMAccountName

root@octopus:/# grep -v '^$\|^\s*\#' /etc/default/saslauthd
START=yes
DESC="SASL Authentication Daemon"
NAME="saslauthd"
MECHANISMS="ldap"
MECH_OPTIONS=""
THREADS=5
PARAMS="-m /var/spool/postfix/var/run/saslauthd -r"
OPTIONS="-c -m /var/run/saslauthd"

root@octopus:~# grep -v '^$\|^\s*\#' /etc/imapd.conf
configdirectory: /var/lib/cyrus
proc_path: /run/cyrus/proc
mboxname_lockpath: /run/cyrus/lock
defaultpartition: default
partition-default: /var/spool/cyrus/mail
partition-news: /var/spool/cyrus/news
newsspool: /var/spool/news
altnamespace: no
unixhierarchysep: no
lmtp_downcase_rcpt: yes
admins: cyrus kronosz
sieve_admins: cyrus
allowanonymouslogin: no
popminpoll: 1
autocreatequota: 0
umask: 077
sieveusehomedir: false
sievedir: /var/spool/sieve
hashimapspool: true
allowplaintext: yes
sasl_mech_list: DIGEST-MD5 CRAM-MD5 PLAIN LOGIN
loginrealms: belso.domain.com
sasl_pwcheck_method: saslauthd
sasl_auto_transition: no
tls_ca_path: /etc/ssl/certs
tls_session_timeout: 1440
tls_cipher_list: TLSv1+HIGH:!aNULL:@STRENGTH
lmtpsocket: /var/run/cyrus/socket/lmtp
idlesocket: /var/run/cyrus/socket/idle
notifysocket: /var/run/cyrus/socket/notify
syslog_prefix: cyrus
tls_cert_file: /etc/ssl/certs/newcert.pem
tls_key_file: /etc/ssl/certs/newkey.pem
tls_ca_file: /etc/ssl/certs/cacert.pem

Van valamilyen tippetek, hogy mit néztem be? Szét túrtam a guglit, de semmi használhatót nem találtam, hátha majd most!

Köszi szépen!