Dovecot splits authentication into two databases:
- passdb — verifies the password ("is this person who they say?").
- userdb — provides user metadata ("where do their messages live, what's their UID, quota?").
Both queries happen on every login. They can come from the same source or different sources (e.g., LDAP for passwords, static template for userdb).
Auth flow:
client → imap-login → auth daemon → passdb lookup → userdb lookup → imap process
If passdb says yes and userdb returns valid metadata, login succeeds. If userdb returns nothing, login fails with "no such user" even if the password was correct.
Enable verbose auth logging when debugging:
auth_verbose = yes
auth_debug = yes
in local.conf. Restart Dovecot. Tail /var/log/dovecot.log and replay the failing login.
Sign in to keep track of what you have read.