Dovecot pigeonhole sieve proxy with ldap - proxy

Question

for an upcoming IMAP migration, I need to proxy my users.
I plan to use Nginx for proxying IMAP and POPS traffic and directing them according to a LDAP attribute (mailHost)
But Nginx can't proxy SIEVE.
Dovecot PigeonHole seems to be able to proxy SIEVE protocol.
I try to configure it to avoid LDAP authentication because there's already an authentication on IMAP stores.
That doesn't work for now.
Here's my conf following this doc:
Pasword DB extra fields
Dovecot proxies
/etc/dovecot/dovecot.conf:
protocols sieve
!include conf.d/*.conf
/etc/dovecot/conf.d/90-sieve.conf
plugin {
sieve = file:~/sieve;active=~/.dovecot.sieve
/etc/dovecot/conf.d/10-auth.conf
auth_mechanisms = plain login
!include auth-ldap.conf.ext
/etc/dovecot/conf.d/auth-ldap.conf
passdb {
driver = ldap
args = /etc/dovecot/dovecot-ldap.conf.ext
}
userdb {
driver = ldap
args = /etc/dovecot/dovecot-ldap.conf.ext
}
/etc/dovecot/dovecot-ldap.conf.ext
hosts = xxx.xxx.xxx.xxx
ldap_version = 3
base = ou=myOU, dc=domain, dc=example
pass_attrs = \
=user=%{ldap:user}, \
=password=, \
=proxy=y, \
=host=%{ldap:mailHost}
And here's the error in the log when I try to modify a sieve script using Horde Webmail:
dovecot: managesieve-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=xxx.xxx.xxx.xxx, lip=xxx.xxx.xxx.xxx, session=
I surely missed a setting somewhere.
For now, I haven't found yet.
Any help will be greatly appreciated
Thanks

Answer 1

OK, I've found the problem
To proxy password to IMAP backends:
/etc/dovecot/dovecot-ldap.conf.ext:
hosts = xxx.xxx.xxx.xxx
ldap_version = 3
base = ou=myOU, dc=domain, dc=example
pass_attrs = \
=user=%{ldap:user}, \
=password=, \
=proxy=y, \
=nopassword=y, \
=host=%{ldap:mailHost}
=port=2000
The doc says:
If you don’t want proxy itself to do authentication, you can configure it to succeed with any given password. You can do this by returning an empty password and nopassword field.
And port 2000 is needed because the IMAP backend still in production is running an old version of timsieved (cyrus sieve implementation)
Then, the backends are waiting for PLAIN authentication.
That's disabled by default in Dovecot, so activate it with:
/etc/dovecot/conf.d/10-auth.conf:
disable_plaintext_auth = no
auth_mechanisms = plain login
!include auth-ldap.conf.ext
This degrades the security, so I will limit access to port 2000 to the dovecot pigeon-hole proxy.