IMAP/POP Authentication issue

jjulian · 2010-12-19 22:20:10

In Authentication Setup for IMAP/POP authentication, if the hostname is entered for the "host" field, users should be able to be authenticated by entering their username into the login screen. The imap authentication should authenticate against username@host but it's not and is silently ignoring the host parameter.

This patch fixes that:

=== modified file 'inc/authmail.class.php'
--- inc/authmail.class.php    2010-10-29 11:47:05 +0000
+++ inc/authmail.class.php    2010-12-19 19:37:51 +0000
@@ -260,7 +260,8 @@
    static function testAuth($connect_string, $login, $password) {
 
       $auth = new Auth();
-      return $auth->connection_imap($connect_string, decodeFromUtf8($login),
+      $auth->user->getFromIMAP($mail_method,decodeFromUtf8($login));
+      return $auth->connection_imap($connect_string,$auth->user->fields["email"],
                                     decodeFromUtf8($password));
    }
 
@@ -277,13 +278,13 @@
    static function mailAuth($auth, $login, $password, $mail_method) {
 
       if (isset($mail_method["connect_string"]) && !empty ($mail_method["connect_string"])) {
+         $auth->user->getFromIMAP($mail_method, decodeFromUtf8($login));
          $auth->auth_succeded = $auth->connection_imap($mail_method["connect_string"],
-                                                       decodeFromUtf8($login),
+                                                       $auth->user->fields["email"],
                                                        decodeFromUtf8($password));
          if ($auth->auth_succeded) {
             $auth->extauth = 1;
             $auth->user_present = $auth->user->getFromDBbyName(addslashes($login));
-            $auth->user->getFromIMAP($mail_method, decodeFromUtf8($login));
             //Update the authentication method for the current user
             $auth->user->fields["authtype"] = Auth::MAIL;
             $auth->user->fields["auths_id"] = $mail_method["id"];

MoYo · 2010-12-20 09:55:54

I do not really understand that you patch do. And which case cause troubles.

Could you explain more ? (with example ?)

jjulian · 2010-12-23 10:54:31

For this bug, the IMAP server authentication requires full email address: jaques@thebeanstalk.com
GLPI should only require the username: jaques

In Setup, Authentication, IMAP/POP Add:
Name: thebeanstalk.com
IMAP/POP Host Name (users email will be login@thishost) : thebeanstalk.com
Server: imap.thebeanstalk.com
(the rest of the options are irrelevant)

Now try logging in as jaques

It won't work. It doesn't work because the imap request sends "jaques" as the username instead of "jaquest@thebeanstalk.com".

This patch retrieves the correct user email identifier using the getFromIMAP method. If host is empty, $auth->user->fields["email"] will be filled with just the username, "jaques". If host is not empty, it fills with the entire email address, "jaques@thebeanstalk.com".

Last edited by jjulian (2010-12-23 10:55:07)

jjulian · 2011-10-13 19:17:05

I've been putting off upgrading since I filed this bug but last night I upgraded to 0.80.4 and this feature is still broken. Users still cannot login with only their name even though "Email domain Name" is set for the email server under email authentication.

madpd97 · 2011-10-18 16:49:27

We had a similar issue with authenticating through Google Apps. Google requires the whole e-mail address when authenticating rather than just the standard GLPI Username. My fix to that was going into the SQL database and changing every user's username to their actual e-mail address. This resolved our issue. From what I'm reading, yours seems to be the same. This may or may not help you out.

jjulian · 2011-10-18 16:56:15

Thanks for the work around. The patch I submitted is still the correct fix, it no longer applies cleanly, though, since the context line have been broken up.

MoYo · 2011-10-25 08:34:26

Patch not applied because we do not understand why we need to integrate it.
Imap auth is based on a login.
If it login is an email users need to enter the email but several IMAP auth are only based on standard login not email. So your patch is not working for them.

jjulian · 2011-10-25 08:39:07

Hmm, good point, I'll double check that.

The way it should work is that people who authenticate without domain name should be leaving "IMAP/POP Host Name (users email will be login@thishost) :" empty, which should provide a username with no domain attached for imap authentication.

Forum GLPI-Project

Announcement

#1 2010-12-19 22:20:10

IMAP/POP Authentication issue

#2 2010-12-20 09:55:54

Re: IMAP/POP Authentication issue

#3 2010-12-23 10:54:31

Re: IMAP/POP Authentication issue

#4 2011-10-13 19:17:05

Re: IMAP/POP Authentication issue

#5 2011-10-18 16:49:27

Re: IMAP/POP Authentication issue

#6 2011-10-18 16:56:15

Re: IMAP/POP Authentication issue

#7 2011-10-25 08:34:26

Re: IMAP/POP Authentication issue

#8 2011-10-25 08:39:07

Re: IMAP/POP Authentication issue

Board footer