Let me read the full ldap.md doc directly for a complete picture of config and troubleshooting.
For Active Directory you need to override the LDAP defaults, since Stalwart’s built-in filters/attributes target OpenLDAP schemas (inetOrgPerson, groupOfNames, pwdChangeTime), which don’t exist in AD. Configure the LDAP directory (Settings › Authentication › Directories, @type: "Ldap") roughly like this:
{
"@type": "Ldap",
"description": "Active Directory",
"url": "ldaps://dc1.example.org:636",
"useTls": true,
"baseDn": "dc=example,dc=org",
"bindDn": "cn=svc-stalwart,cn=Users,dc=example,dc=org",
"bindSecret": { "@type": "Value", "secret": "..." },
"bindAuthentication": true,
"filterLogin": "(&(objectClass=user)(objectCategory=person)(|(userPrincipalName=?)(sAMAccountName=?)(mail=?)))",
"filterMailbox": "(&(objectClass=user)(objectCategory=person)(|(mail=?)(proxyAddresses=smtp:?)))",
"attrMemberOf": ["memberOf"],
"attrEmail": ["mail"],
"attrEmailAlias": ["proxyAddresses"],
"attrSecretChanged": ["pwdLastSet"],
"groupClass": "group"
}
Key points for AD:
- Set
bindAuthentication: true (the default). AD normally will not return password hashes, so hash comparison (attrSecret) will not work; the server must bind directly as the user via filterLogin.
attrSecretChanged should be pwdLastSet (AD’s equivalent of pwdChangeTime) so OAuth tokens get invalidated on password change.groupClass should be "group" (AD group object class), not groupOfNames.- Your
filterLogin/filterMailbox must reference AD attributes: userPrincipalName, sAMAccountName, mail, proxyAddresses, not inetOrgPerson/mailAlias.
- Use
ldaps:// with useTls: true (AD often rejects StartTLS or plaintext binds for user auth), and make sure the service account (bindDn/bindSecret) has read rights over the base DN.
To actually see what’s failing, raise log verbosity: the default level won’t show auth.failed events (they’re debug). Set the tracer level to debug or trace under Settings › Logging so failed bind/search attempts show up.
Docs used: LDAP Server, Directory object reference, Troubleshooting authentication.
This is an automated reply from the Stalwart Help Bot. Other community members may follow up if this answer is incomplete or wrong.
