fix!: Allow protocol in SASLAUTHD_LDAP_SERVER & adjust SASLAUTHD_LDAP_ default values (#1989)

* fix: make sure the SASLAUTHD_LDAP_HOST/PROTO logic makes sense and use LDAP_SERVER_HOST as a fallback (#1983)

* chore(docs): document changes to LDAP/SASLAUTHD as of #1983

* fix!: apply default value modifications suggested in #1983

https://github.com/docker-mailserver/docker-mailserver/issues/1983#issuecomment-844848224

* chore(test): Test SASLAUTHD_LDAP_SERVER with protocol and ..._SSL=0, as well as with default bind credentials

Note that there are currently no regression tests for this as there's only one setup_file, so that would require big changes to the testing methodology.

* refactor!: completely remove SASLAUTHD_LDAP_SSL and SASLAUTHD_LDAP_PROTO

Co-authored-by: Georg Lauterbach <44545919+aendeavor@users.noreply.github.com>
Co-authored-by: Frederic Werner <20406381+wernerfred@users.noreply.github.com>

docs/content/config/advanced/auth-ldap.md

@@ -226,11 +226,6 @@ To enable LDAP over StartTLS (on port 389), you need to set the following enviro
 
           # >>> SASL Authentication
           - ENABLE_SASLAUTHD=1
-          - SASLAUTHD_LDAP_SERVER=<yourLdapContainer/yourLdapServer>
-          - SASLAUTHD_LDAP_PROTO=
-          - SASLAUTHD_LDAP_BIND_DN=cn=Administrator,cn=Users,dc=mydomain,dc=loc
-          - SASLAUTHD_LDAP_PASSWORD=mypassword
-          - SASLAUTHD_LDAP_SEARCH_BASE=dc=mydomain,dc=loc
           - SASLAUTHD_LDAP_FILTER=(&(sAMAccountName=%U)(objectClass=person))
           - SASLAUTHD_MECHANISMS=ldap
           # <<< SASL Authentication

docs/content/config/environment.md

@@ -479,7 +479,6 @@ The following variables overwrite the default values for ```/etc/dovecot/dovecot
 - => Bind dn for LDAP connection. (e.g. `cn=admin,dc=domain,dc=com`)
 
 ##### DOVECOT_DNPASS
-
 - **empty** => same as `LDAP_BIND_PW`
 - => Password for LDAP dn sepecifified in `DOVECOT_DN`.
 
@@ -566,7 +565,7 @@ Note: This postgrey setting needs `ENABLE_POSTGREY=1`
 
 ##### SASLAUTHD_MECHANISMS
 
-- empty => pam
+- **empty** => pam
 - `ldap` => authenticate against ldap server
 - `shadow` => authenticate against local user db
 - `mysql` => authenticate against mysql db
@@ -575,17 +574,13 @@ Note: This postgrey setting needs `ENABLE_POSTGREY=1`
 
 ##### SASLAUTHD_MECH_OPTIONS
 
-- empty => None
+- **empty** => None
 - e.g. with SASLAUTHD_MECHANISMS rimap you need to specify the ip-address/servername of the imap server  ==> xxx.xxx.xxx.xxx
 
 ##### SASLAUTHD_LDAP_SERVER
 
-- empty => localhost
-
-##### SASLAUTHD_LDAP_SSL
-
-- empty or 0 => `ldap://` will be used
-- 1 => `ldaps://` will be used
+- **empty** => same as `LDAP_SERVER_HOST`
+- Note: since version 10.0.0, you can specify a protocol here (like ldaps://); this deprecates SASLAUTHD_LDAP_SSL.
 
 ##### SASLAUTHD_LDAP_START_TLS
 
@@ -613,23 +608,23 @@ File containing CA (Certificate Authority) certificate(s).
 
 ##### SASLAUTHD_LDAP_BIND_DN
 
-- empty => anonymous bind
+- **empty** => same as `LDAP_BIND_DN`
 - specify an object with privileges to search the directory tree
 - e.g. active directory: SASLAUTHD_LDAP_BIND_DN=cn=Administrator,cn=Users,dc=mydomain,dc=net
 - e.g. openldap: SASLAUTHD_LDAP_BIND_DN=cn=admin,dc=mydomain,dc=net
 
 ##### SASLAUTHD_LDAP_PASSWORD
 
-- empty => anonymous bind
+- **empty** => same as `LDAP_BIND_PW`
 
 ##### SASLAUTHD_LDAP_SEARCH_BASE
 
-- empty => Reverting to SASLAUTHD_MECHANISMS pam
+- **empty** => same as `LDAP_SEARCH_BASE`
 - specify the search base
 
 ##### SASLAUTHD_LDAP_FILTER
 
-- empty => default filter `(&(uniqueIdentifier=%u)(mailEnabled=TRUE))`
+- **empty** => default filter `(&(uniqueIdentifier=%u)(mailEnabled=TRUE))`
 - e.g. for active directory: `(&(sAMAccountName=%U)(objectClass=person))`
 - e.g. for openldap: `(&(uid=%U)(objectClass=person))`
 

docs/content/examples/uses-cases/forward-only-mailserver-with-ldap-authentication.md

@@ -40,7 +40,6 @@ LDAP_BIND_PW=pass1234
 ENABLE_SASLAUTHD=1
 SASLAUTHD_MECHANISMS=ldap
 SASLAUTHD_LDAP_SERVER=ldap.example.org
-SASLAUTHD_LDAP_SSL=0
 SASLAUTHD_LDAP_START_TLS=yes
 SASLAUTHD_LDAP_BIND_DN=cn=mailserver,dc=example,dc=org
 SASLAUTHD_LDAP_PASSWORD=pass1234