Error: Couldn't drop privileges: User is missing UID (see mail_uid setting)

Question

I have an email system that is setup loosely around the ISPMail guides here - https://workaround.org/ispmail/buster/

I am trying to setup a script for automatic password scheme migration, but I'm running into issues. I've been following guides similiar to this: https://wiki.dovecot.org/HowTo/ConvertPasswordSchemes

Whenever I enable userdb prefetch, the Couldn't drop privileges: User is missing UID (see mail_uid setting) error appears.

My user_query and password_query are as follows:

user_query = SELECT user, \ concat('*:bytes=', quota) AS quota_rule, \ '/var/vmail/%d/%n' AS home, \ 5000 AS uid, 5000 AS gid \ FROM users WHERE user='%u';

password_query = SELECT user, password, \ '%w' AS userdb_plain_pass, \ concat('*:bytes=', quota) AS quota_rule, \ '/var/vmail/%d/%n' AS home, \ 5000 AS uid, 5000 AS gid \ FROM users WHERE user='%u';

I have the following configuration in place: (In this order)

passdb { driver = sql args = /etc/dovecot/dovecot-sql.conf.ext } userdb { driver = prefetch } userdb { driver = sql args = /etc/dovecot/dovecot-sql.conf.ext }

Looking at the debug logs, when I remove the prefetch and everything works as expected:

Jan 5 15:21:38 m1 dovecot: auth: Debug: master userdb out: USER#0114090494977#011aaron@example.com#011plain_pass=Password1234#011quota_rule=*:bytes=0#011home=/var/vmail/example.com/aaron#011uid=5000#011gid=5000#011auth_token=bdxxxxx

However, when prefetch is enabled, it's not getting the uid and gid in the passdb out:

Jan 5 15:18:36 m1 dovecot: auth: Debug: master userdb out: USER#0113382444033#011aaron@example.com#011plain_pass=Password1234#011auth_token=bdxxxx

Any suggestions on how to resolve this issue when using prefetch?

Thanks!

score 1 · Accepted Answer · edited Jan 11 '20 at 15:22

Turns out my passdb query was missing the userdb_ prefixes. Adjusting it as follows solved the problem.

password_query = SELECT user, password, \
  '%w' AS userdb_plain_pass, \
   concat('*:bytes=', quota) AS quota_rule, \
   '/var/vmail/%d/%n' AS home, \
   5000 AS userdb_uid, 5000 AS userdb_gid \
   FROM users WHERE user='%u';

Dovecot Documentation on Prefetch User Database:

Prefetch basically works by requiring that the passdb returns the userdb information in extra fields with userdb_ prefixes. For example if a userdb typically returns uid, gid and home fields, the passdb would have to return userdb_uid, userdb_gid and userdb_home fields.

Error: Couldn't drop privileges: User is missing UID (see mail_uid setting)

1 Answers1