Dovecot: virtual and local users homonyms: Mail access for users with UID 1000 not permitted

Question

Well, the case seems simple but I can’t find a satisfactory answer.

I have a Postfix/Dovecot installation with the later configured to work with virtual emails which works like a charm... for virtual users who do not have an account on the server.

To make things clearer, let’s pick an example: virtualuser is registered in the virtual users’ database (/etc/dovecot/users) and is able to receive and send mails through IMAP and SMTP without any problems. On the other hand, localuser is a regular system user on the server. Now, if I add a new user in the Dovecot’s virtual users database named localuser and try to connect as this virtual-user-with-a-local-alias in IMAP, I get the following error in my logs:

imap: Error: user localuser: Mail access for users with UID 1000 not permitted ([etc]).

It is clear that since Postfix finds a user named localuser in the system users, it tries to authenticates with that user and doesn’t even looks at the virtual users.

So here is the question: how do I have Postfix lookup virtual users before local users?

Is this even possible or am I stuck with a messy configuration mixing local and virtual users?

This log message `imap: Error: XXXX` was part of dovecot error message. Postfix only do SMTP not IMAP nor POP3 — masegaloeh, Aug 20 '15 at 02:37
Thanks for the precision! Same question replacing postfix with dovecot then! — Arcturus B, Aug 20 '15 at 04:56
Have you considered keeping OS users IMAP/SMTP logins "domain less" and make virtusers IMAP/SMTP logins "domanized"? — AnFi, Aug 20 '15 at 07:00
@Andrzej: given the small size of the server (few tens of users at most), this is not an option for me. — Arcturus B, Aug 20 '15 at 09:25
Please don't include the solution in the question. Instead, you need put the solution in the answer section below. — masegaloeh, Aug 21 '15 at 11:05
@masegaloeh: totally right, don't know what I had in mind when doing that. — Arcturus B, Aug 21 '15 at 12:35

score 2 · Accepted Answer · answered Aug 21 '15 at 12:33

As I expected, the solution to this was tremendously simple: /etc/dovecot/conf.d/10-auth.conf includes two files: auth-system.conf.ext for system users, and auth-mydomain.conf.ext for virtual users. The order these files are included is important important, system users lookup after virtual users is easily performed by swapping both lines:

[...]
!include auth-mydomain.conf.ext
!include auth-system.conf.ext

Dovecot: virtual and local users homonyms: Mail access for users with UID 1000 not permitted

1 Answers1