The next item to work at is the ldap aliases lookup as I allow users to send using a group email address if they belong to that group. Using postmap -q to test the filter returns the expected results against both the mail and proxyAddresses attributes. Any other email addresses are to use a lowercase smtp. The mail attribute is supposed to be duplicated here but using and uppercase SMTP. Supposedly Microsoft Exchange uses this attribute with special meaning regarding the CASE. In this case if the account has been locked out then the query will return no results for our lookup.ДЄltering the query_filter to: (&(objectclass=user)(!(userAccountControl:1.2.840.113556.1.4.903:=2))(|(mail=%s)(proxyAddresses=smtp:%s)))ДЄllows the server to lookup not only the main email address in the AD-DC but also the proxyAddresses that start with вЂњsmtp:вЂќ. The вЂњ(!(userAccountControl:1.2.840.113556.1.4.903:=2))вЂќ was taken from the samba wiki and is supposed to indicate the account is locked. This configuration is supposed to return the user account that matches the email address supplied. So it proxies IMAP and uses Postfix for submission. The server is used to support mobile phones and tablets, allowing them access to the internal email systems. Search_base=cn=users,dc=samdom,dc=example,dc=netД«ind_dn=cn=postfix-connect,cn=users,dc=samdom,dc=example,dc=net I came up with the following config file and it seems to work. I used information from the postfix web site for LDAP lookups and LDAP tables. Query_filter=(&(objectclass=inetOrgPerson)(|(mail=%s)(mailLocalAddress=%s))) This file is used in PostfixвЂ™s main.cf file in the parameter smtpd_sender_login_maps The old file is: server_host=192.168.0.16 So the ldap_sender_login_maps_people.cf file needs to be updated. To fit into MicrosoftвЂ™s LDAP attributes I need to use proxyAddresses rather than the mailLocalAddress attribute I have been using for more than a decade with other LDAP servers. Names have been changed to protect the guilty.Д«ased on the setup for the squid proxy server I have managed to get ldapsearch to work on the email submission server using: ldapsearch -D 'CN=postfix-connect,CN=Users,DC=samdom,DC=example,dc=net' -w 'password' -s sub -x -ZZ -LLL -v '(&(objectClass=user)(!(objectClass=computer))(!(userAccountControl:1.2.840.113556.1.4.903:=2))(cn=username))' I am using Postfix 3.3.2 and OpenLDAP 2.4 on Debian 9.6.

This post will only cover the changes needed in the LDAP configuration. It will also cover a smart host that uses LDAP to lookup the mailHost for each user as well as dereference group emails. This post covers changes to an email submission server that uses Postfix to receive messages from authenticated users and relays them to a smart host. As part of a migration project where I moved from an old Samba 3 PDC to a Samba 4 AD-DC I have to also migrate any system that uses the old LDAP lookups.

Migratge samba pdc to 4