Your question
I’m trying to setup a LDAPS connection to Kanidm, but I don’t see connection attempts when trying to login to the webui.
Background
I am running on NixOS 26.05, with Stalwart packages from nixos-unstable, currently 0.16.15. I have two barebones conflicting systemd service definitions. One stalwart.service, and one stalwart-recovery.service with the STALWART_RECOVERY* environment variables set, that I use to configure Stalwart through the webui.
I have setup a Domain object m.filts.net, moved conflicting listening ports (https), set Default Hostname matching reverse DNS, and set Tracer to Systemd Journal, level Trace.
LDAP settings
Next, I added one LDAP directory, with Server URL set to either ldap://id.filts.net:636 or ldaps://id.filts.net:636 with TLS enabled. For the other settings, my plan was to try to follow Stalwart LDAP Directory <-> Kanidm · kanidm/kanidm · Discussion #3516 · GitHub but I don’t seem to get far enough for those settings to matter.
For completeness’ sake, I have Base DN set to dc=id,dc=filts,dc=net, Bind DN to dn=token and set the secret token. With ldapsearch, using the token, I get a result to the Login Filter query set to (&(objectClass=person)(|([email protected]))).
I have one user setup in Kanidm and no Accounts in Stalwart.
What I expect and what happens
To test the setup, I stop stalwart-recovery.service and start stalwart.service and try to login on http://filts.net:8080/account using a SOCKS proxy, just as I am doing in the recovery mode. I follow both stalwart.service and kanidm.service using journalctl.
Upon login attempts with my one user, [email protected], I see nothing happening in the kanidm journal, whereas I can see log entries using ldapsearch -H ldaps://id.filts.net etc.. Nothing related to LDAP shows up in the stalwart journal, even though it looks expectedly verbose.
(I do however see four lines of Configuration build error early on, just after Task manager started. Unfortunately, no further information.
edit: I turned on Trace for a log file as well, which is more informative than the journal. Turned out, I was too lazy with the systemd service and have not added CAP_NET_BIND_SERVICE. The errors were about not being able to bind and are gone now.)
Am I doing something fundamentally wrong? How can I debug this further?
Also, while debugging, do I even need to restart into normal mode, or would settings like LDAP be live immediately in the recovery mode?
I have read LDAP with ver0.16.10 and in particular LDAP with ver0.16.10 - #9 by stalwart which seems relevant, but I don’t see how I don’t meet the prerequisites for the solution.
Thanks,
Michael
I understand that topics in this category are triaged by a bot first but a human reply will follow up. If I’d prefer a human-only reply, I’ll add the no-ai tag to my topic.
on