You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@james.apache.org by rc...@apache.org on 2023/10/06 02:06:39 UTC
[james-project] 16/23: JAMES-3942 Audit trail upon IMAP authentication failure
This is an automated email from the ASF dual-hosted git repository.
rcordier pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/james-project.git
commit 220437dd7aa70f1daa977f71095d91f54f1e7e09
Author: Quan Tran <hq...@linagora.com>
AuthorDate: Thu Sep 28 11:52:18 2023 +0700
JAMES-3942 Audit trail upon IMAP authentication failure
---
.../imap/processor/AbstractAuthProcessor.java | 23 ++++++++++++++++++++--
.../imap/processor/AuthenticateProcessor.java | 2 +-
2 files changed, 22 insertions(+), 3 deletions(-)
diff --git a/protocols/imap/src/main/java/org/apache/james/imap/processor/AbstractAuthProcessor.java b/protocols/imap/src/main/java/org/apache/james/imap/processor/AbstractAuthProcessor.java
index b570694870..5920c53dc3 100644
--- a/protocols/imap/src/main/java/org/apache/james/imap/processor/AbstractAuthProcessor.java
+++ b/protocols/imap/src/main/java/org/apache/james/imap/processor/AbstractAuthProcessor.java
@@ -100,6 +100,11 @@ public abstract class AbstractAuthProcessor<R extends ImapRequest> extends Abstr
session.stopDetectingCommandInjection();
} catch (BadCredentialsException e) {
authFailure = true;
+ AuditTrail.entry()
+ .username(authenticationAttempt.getAuthenticationId().asString())
+ .protocol("IMAP")
+ .action("AUTH")
+ .log("IMAP Authentication failed because of bad credentials.");
}
}
if (authFailure) {
@@ -124,11 +129,13 @@ public abstract class AbstractAuthProcessor<R extends ImapRequest> extends Abstr
.authenticate(givenUser, authenticationAttempt.getPassword())
.as(otherUser),
session,
- request, responder);
+ request, responder,
+ givenUser, otherUser);
}
protected void doAuthWithDelegation(MailboxSessionAuthWithDelegationSupplier mailboxSessionSupplier,
- ImapSession session, ImapRequest request, Responder responder) {
+ ImapSession session, ImapRequest request, Responder responder,
+ Username authenticateUser, Username delegatorUser) {
try {
final MailboxManager mailboxManager = getMailboxManager();
final MailboxSession mailboxSession = mailboxSessionSupplier.get();
@@ -146,12 +153,24 @@ public abstract class AbstractAuthProcessor<R extends ImapRequest> extends Abstr
okComplete(request, responder);
provisionInbox(session, mailboxManager, mailboxSession);
} catch (BadCredentialsException e) {
+ AuditTrail.entry()
+ .username(authenticateUser.asString())
+ .protocol("IMAP")
+ .action("AUTH")
+ .parameters(ImmutableMap.of("delegatorUser", delegatorUser.asString()))
+ .log("IMAP Authentication with delegation failed because of bad credentials.");
manageFailureCount(session, request, responder);
} catch (UserDoesNotExistException e) {
LOGGER.info("User does not exist", e);
no(request, responder, HumanReadableText.USER_DOES_NOT_EXIST);
} catch (ForbiddenDelegationException e) {
LOGGER.info("Delegate forbidden", e);
+ AuditTrail.entry()
+ .username(authenticateUser.asString())
+ .protocol("IMAP")
+ .action("AUTH")
+ .parameters(ImmutableMap.of("delegatorUser", delegatorUser.asString()))
+ .log("IMAP Authentication with delegation failed because of non existing delegation.");
no(request, responder, HumanReadableText.DELEGATION_FORBIDDEN);
} catch (MailboxException e) {
LOGGER.info("Login failed", e);
diff --git a/protocols/imap/src/main/java/org/apache/james/imap/processor/AuthenticateProcessor.java b/protocols/imap/src/main/java/org/apache/james/imap/processor/AuthenticateProcessor.java
index 40de07069c..8e5e2b3f9e 100644
--- a/protocols/imap/src/main/java/org/apache/james/imap/processor/AuthenticateProcessor.java
+++ b/protocols/imap/src/main/java/org/apache/james/imap/processor/AuthenticateProcessor.java
@@ -217,7 +217,7 @@ public class AuthenticateProcessor extends AbstractAuthProcessor<AuthenticateReq
doAuthWithDelegation(() -> getMailboxManager()
.authenticate(authenticatedUser)
.as(associatedUser),
- session, request, responder);
+ session, request, responder, authenticatedUser, associatedUser);
} else {
authSuccess(authenticatedUser, session, request, responder);
}
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@james.apache.org
For additional commands, e-mail: notifications-help@james.apache.org