Is it possible to configure a different auth per domain?

[jobcespedes]

Is it possible to have a different auth per domain? For instance, primary domain uses auth_ldap_server1 and second domain uses a separate auth_ldap_server2.

[foxcpp]

The closest possible configuration is using https://maddy.email/reference/auth/plain_separate/

auth plain_separate {
  pass ldap { ... }
  pass ldap { ... }
}

maddy will try each provider in order. If both use email addresses and recognize only their respective domains, it will work fine.

[jobcespedes]

Thanks for the pointer. I will take a look at it.

[muellerj]

Would this also work, if the two providers were separate types? My use case would look something like this, tough I haven't gotten it to work so far:

auth.plain_separate local_auth {
    pass external {
        helper /path/to/auth-helper
    }
    pass pass_table {
        table sql_table {
            driver sqlite3
            dsn credentials.db
            table_name passwords
        }
    }
}

The helper is called and returns exit code 0, but the 2nd provider is still run and complains that the passwords don't match (understandably):

submission/sasl: authentication failed	{"reason":"no auth. provider accepted creds, last err: crypto/bcrypt: hashedPassword is not the hash of the given password","src_ip":"<my_local_ip>:54704","username":"foo@expample.com"}

[muellerj]

Nevermind, I figured it out: I was missing the domains setting for auth.external, which causes the auth provider to fail silently. Adding the setting fixes the problem.