Собираюсь перевешиваю почтовик, собрал тестовую площадку и вот затык
дано
AD (Windows server 2008)
Dovecot

Собственно если АД не использует SASL то все работает .т.е.
>dovecot-ldap.conf

hosts = 192.168.0.2:389
dn = CN=dovecot,CN=Users,DC=domain,DC=local
dnpass=password
debug_level = 1
auth_bind = yes
ldap_version = 3
base = DC=domain,DC=local
user_attrs = mail=user, uid=Debina-exim, gid-Debian-exim
user_filter = (&(objectClass=person)(mail=%n@kobaltd.local))
pass_attrs = mail=user
pass_filter = (&(objectClass=person)(sAMAccountName=%u))

все замечательно работает
но
включаем в 2008 в AD sasl опции GPO (LDAP server signing requirements = require signing, LDAP client signing requirements = require signing)

и меняем конфиг на

>dovecot-ldap.conf

hosts = 192.168.0.2:389
dn = CN=dovecot,CN=Users,DC=domain,DC=local
dnpass=password
sasl_bind = yes
sasl_mech = DIGEST-MD5
sasl_realm =
sasl_authz_id =
debug_level = 1
auth_bind = no
ldap_version = 3
base = DC=domain,DC=local
user_attrs = mail=user, uid=Debina-exim, gid-Debian-exim
user_filter = (&(objectClass=person)(mail=%n@kobaltd.local))
pass_attrs = mail=user
pass_filter = (&(objectClass=person)(sAMAccountName=%u))

не работает

>/var/log/mail.info

....
Jun 29 15:18:20 mail dovecot: auth(default): res_errno: 49, res_error: <8009030C: LdapErr: DSID-0C0904D1, comment: AcceptSecurityContext error, data 52e, v1772>, res_matched: <>
Jun 29 15:18:20 mail dovecot: auth(default): ldap_free_request (origid 4, msgid 4)
Jun 29 15:18:20 mail dovecot: auth(default): ldap_parse_sasl_bind_result
Jun 29 15:18:20 mail dovecot: auth(default): ldap_parse_result
Jun 29 15:18:20 mail dovecot: auth(default): ldap_msgfree
Jun 29 15:18:20 mail dovecot: auth(default): ldap_err2string
Jun 29 15:18:20 mail dovecot: auth(default): LDAP: binding failed (dn CN=dovecot,CN=Users,DC=domain,DC=local): Invalid credentials, 8009030C: LdapErr: DSID-0C0904D1, comment: AcceptSecurityContext error, data 52e, v1772

если поменять
dn = CN=dovecot,CN=Users,DC=domain,DC=local
на
dn = dovecot

во привязка (saslbind) срабатывает

>/var/log/mail.info

....
Jun 29 15:21:12 mail dovecot: auth(default): res_errno: 0, res_error: <>, res_matched: <>
Jun 29 15:21:12 mail dovecot: auth(default): ldap_free_request (origid 2, msgid 2)
Jun 29 15:21:12 mail dovecot: auth(default): ldap_parse_sasl_bind_result
Jun 29 15:21:12 mail dovecot: auth(default): ldap_parse_result
Jun 29 15:21:12 mail dovecot: auth(default): ldap_msgfree
Jun 29 15:21:12 mail dovecot: auth(default): sasl_client_step: 0
Jun 29 15:21:12 mail dovecot: auth(default): ldap_pvt_sasl_generic_install

однако пользователи перестают проходить авторизацию

.....
Jun 29 15:34:55 mail dovecot: auth(default): client in: AUTH#0111#011PLAIN#011service=pop3#011secured#011lip=192.168.0.92#011rip=192.168.0.60#011lport=110#011rport=43909#011resp=<hidden>
Jun 29 15:34:55 mail dovecot: auth(default): ldap(test,192.168.0.60): pass search: base=DC=domain,DC=local scope=subtree filter=(sAMAccountName=test) fields=mail
Jun 29 15:34:55 mail dovecot: auth(default): ldap_search
Jun 29 15:34:55 mail dovecot: auth(default): put_filter: "(sAMAccountName=test)"
Jun 29 15:34:55 mail dovecot: auth(default): put_filter: simple
Jun 29 15:34:55 mail dovecot: auth(default): put_simple_filter: "sAMAccountName=test"
Jun 29 15:34:55 mail dovecot: auth(default): ldap_send_initial_request
Jun 29 15:34:55 mail dovecot: auth(default): ldap_send_server_request
Jun 29 15:34:55 mail dovecot: auth(default): ldap_result ld 0x7fdb4dd4cff0 msgid -1
Jun 29 15:34:55 mail dovecot: auth(default): wait4msg ld 0x7fdb4dd4cff0 msgid -1 (timeout 0 usec)
Jun 29 15:34:55 mail dovecot: auth(default): wait4msg continue ld 0x7fdb4dd4cff0 msgid -1 all 1
Jun 29 15:34:55 mail dovecot: auth(default): ** ld 0x7fdb4dd4cff0 Connections:
Jun 29 15:34:55 mail dovecot: auth(default): * host: 192.168.0.2  port: 389  (default)
Jun 29 15:34:55 mail dovecot: auth(default):   refcnt: 2  status: Connected
Jun 29 15:34:55 mail dovecot: auth(default):   last used: Tue Jun 29 15:34:55 2010
Jun 29 15:34:55 mail dovecot: auth(default):
Jun 29 15:34:55 mail dovecot: auth(default):
Jun 29 15:34:55 mail dovecot: auth(default): ** ld 0x7fdb4dd4cff0 Outstanding Requests:
Jun 29 15:34:55 mail dovecot: auth(default):  * msgid 3,  origid 3, status InProgress
Jun 29 15:34:55 mail dovecot: auth(default):    outstanding referrals 0, parent count 0
Jun 29 15:34:55 mail dovecot: auth(default):   ld 0x7fdb4dd4cff0 request count 1 (abandoned 0)
Jun 29 15:34:55 mail dovecot: auth(default): ** ld 0x7fdb4dd4cff0 Response Queue:
Jun 29 15:34:55 mail dovecot: auth(default):    Empty
Jun 29 15:34:55 mail dovecot: auth(default):   ld 0x7fdb4dd4cff0 response count 0
Jun 29 15:34:55 mail dovecot: auth(default): ldap_chkResponseList ld 0x7fdb4dd4cff0 msgid -1 all 1
Jun 29 15:34:55 mail dovecot: auth(default): ldap_chkResponseList returns ld 0x7fdb4dd4cff0 NULL
Jun 29 15:34:55 mail dovecot: auth(default): ldap_int_select
Jun 29 15:34:55 mail dovecot: auth(default): read1msg: ld 0x7fdb4dd4cff0 msgid -1 all 1
Jun 29 15:34:55 mail dovecot: auth(default): read1msg: ld 0x7fdb4dd4cff0 msgid 3 message type search-entry
Jun 29 15:34:55 mail dovecot: auth(default): read1msg: ld 0x7fdb4dd4cff0 msgid 3 message type search-result
Jun 29 15:34:55 mail dovecot: auth(default): read1msg: ld 0x7fdb4dd4cff0 0 new referrals
Jun 29 15:34:55 mail dovecot: auth(default): read1msg:  mark request completed, ld 0x7fdb4dd4cff0 msgid 3
Jun 29 15:34:55 mail dovecot: auth(default): request done: ld 0x7fdb4dd4cff0 msgid 3
Jun 29 15:34:55 mail dovecot: auth(default): res_errno: 0, res_error: <>, res_matched: <>
Jun 29 15:34:55 mail dovecot: auth(default): ldap_free_request (origid 3, msgid 3)
Jun 29 15:34:55 mail dovecot: auth(default): adding response ld 0x7fdb4dd4cff0 msgid 3 type 101:
Jun 29 15:34:55 mail dovecot: auth(default): ldap_parse_result
Jun 29 15:34:55 mail dovecot: auth(default): ldap_first_attribute
Jun 29 15:34:55 mail dovecot: auth(default): ldap(test,192.168.0.60): no fields returned by the server
Jun 29 15:34:55 mail dovecot: auth(default): ldap(test,192.168.0.60): No password returned (and no nopassword)
Jun 29 15:34:55 mail dovecot: auth(default): ldap_msgfree
Jun 29 15:34:55 mail dovecot: auth(default): ldap_result ld 0x7fdb4dd4cff0 msgid -1
Jun 29 15:34:55 mail dovecot: auth(default): wait4msg ld 0x7fdb4dd4cff0 msgid -1 (timeout 0 usec)
Jun 29 15:34:55 mail dovecot: auth(default): wait4msg continue ld 0x7fdb4dd4cff0 msgid -1 all 1
Jun 29 15:34:55 mail dovecot: auth(default): ** ld 0x7fdb4dd4cff0 Connections:
Jun 29 15:34:55 mail dovecot: auth(default): * host: 192.168.0.2  port: 389  (default)
Jun 29 15:34:55 mail dovecot: auth(default):   refcnt: 1  status: Connected
Jun 29 15:34:55 mail dovecot: auth(default):   last used: Tue Jun 29 15:34:55 2010
Jun 29 15:34:55 mail dovecot: auth(default):
Jun 29 15:34:55 mail dovecot: auth(default):
Jun 29 15:34:55 mail dovecot: auth(default): ** ld 0x7fdb4dd4cff0 Outstanding Requests:
Jun 29 15:34:55 mail dovecot: auth(default):    Empty
Jun 29 15:34:55 mail dovecot: auth(default):   ld 0x7fdb4dd4cff0 request count 0 (abandoned 0)
Jun 29 15:34:55 mail dovecot: auth(default): ** ld 0x7fdb4dd4cff0 Response Queue:
Jun 29 15:34:55 mail dovecot: auth(default):    Empty
Jun 29 15:34:55 mail dovecot: auth(default):   ld 0x7fdb4dd4cff0 response count 0
Jun 29 15:34:55 mail dovecot: auth(default): ldap_chkResponseList ld 0x7fdb4dd4cff0 msgid -1 all 1
Jun 29 15:34:55 mail dovecot: auth(default): ldap_chkResponseList returns ld 0x7fdb4dd4cff0 NULL
Jun 29 15:34:55 mail dovecot: auth(default): ldap_int_select
Jun 29 15:34:56 mail dovecot: auth(default): new auth connection: pid=26873
Jun 29 15:34:57 mail dovecot: auth(default): client out: FAIL#0111#011user=test
Jun 29 15:35:02 mail dovecot: pop3-login: Aborted login (auth failed, 1 attempts): user=<test>, method=PLAIN, rip=192.168.0.60, lip=192.168.0.92, TLS

Собственно у кого работает такая связка? что я делаю не так?