You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@james.apache.org by bt...@apache.org on 2023/01/09 09:22:12 UTC
[james-project] 01/02: SMTP AuthCmdHandler support doDelegation method
This is an automated email from the ASF dual-hosted git repository.
btellier pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/james-project.git
commit 1c218529cafccd9393cc6490e77ef4b6ad594d99
Author: Tung Van TRAN <vt...@linagora.com>
AuthorDate: Wed Dec 21 21:58:14 2022 +0700
SMTP AuthCmdHandler support doDelegation method
---
.../protocols/smtp/core/esmtp/AuthCmdHandler.java | 38 +++++++++++++++++++---
.../apache/james/protocols/smtp/hook/AuthHook.java | 4 +++
.../apache/james/smtpserver/SMTPServerTest.java | 2 +-
3 files changed, 38 insertions(+), 6 deletions(-)
diff --git a/protocols/smtp/src/main/java/org/apache/james/protocols/smtp/core/esmtp/AuthCmdHandler.java b/protocols/smtp/src/main/java/org/apache/james/protocols/smtp/core/esmtp/AuthCmdHandler.java
index 0a39893cbe..5f4cdddbbd 100644
--- a/protocols/smtp/src/main/java/org/apache/james/protocols/smtp/core/esmtp/AuthCmdHandler.java
+++ b/protocols/smtp/src/main/java/org/apache/james/protocols/smtp/core/esmtp/AuthCmdHandler.java
@@ -170,13 +170,13 @@ public class AuthCmdHandler
session.pushLineHandler(new AbstractSMTPLineHandler() {
@Override
protected Response onCommand(SMTPSession session, String l) {
- return doPlainAuthPass(session, l);
+ return doPlainAuth(session, l);
}
});
return AUTH_READY_PLAIN;
} else {
userpass = initialResponse.trim();
- return doPlainAuthPass(session, userpass);
+ return doPlainAuth(session, userpass);
}
} else if (authType.equals(AUTH_TYPE_LOGIN) && session.getConfiguration().isPlainAuthEnabled()) {
@@ -242,16 +242,19 @@ public class AuthCmdHandler
* @param session SMTP session object
* @param line the initial response line passed in with the AUTH command
*/
- private Response doPlainAuthPass(SMTPSession session, String line) {
+ private Response doPlainAuth(SMTPSession session, String line) {
try {
List<String> tokens = Optional.ofNullable(decodeBase64(line))
.map(userpass1 -> Arrays.stream(userpass1.split("\0"))
.filter(token -> !token.isBlank())
.collect(Collectors.toList()))
.orElse(List.of());
- Preconditions.checkArgument(tokens.size() == 2 || tokens.size() == 3);
+ Preconditions.checkArgument(tokens.size() == 1 || tokens.size() == 2 || tokens.size() == 3);
Response response = null;
- if (tokens.size() == 2) {
+
+ if (tokens.size() == 1) {
+ response = doDelegation(session, Username.of(tokens.get(0)));
+ } else if (tokens.size() == 2) {
// If we got here, this is what happened. RFC 2595
// says that "the client may leave the authorization
// identity empty to indicate that it is the same as
@@ -339,6 +342,31 @@ public class AuthCmdHandler
return doAuthTest(session, username, pass, "LOGIN");
}
+ protected Response doDelegation(SMTPSession session, Username username) {
+ Response res = null;
+
+ List<AuthHook> hooks = Optional.ofNullable(getHooks())
+ .orElse(List.of());
+
+ for (AuthHook rawHook : hooks) {
+ rawHook.doDelegation(session, username);
+ res = executeHook(session, rawHook, hook -> rawHook.doDelegation(session, username));
+
+ if (res != null) {
+ if (SMTPRetCode.AUTH_FAILED.equals(res.getRetCode())) {
+ LOGGER.warn("{} was not authorized to connect as {}", session.getUsername(), username);
+ } else if (SMTPRetCode.AUTH_OK.equals(res.getRetCode())) {
+ LOGGER.info("{} was authorized to connect as {}", session.getUsername(), username);
+ }
+ return res;
+ }
+ }
+
+ res = AUTH_FAILED;
+ LOGGER.error("DELEGATE failed from {}@{}", username, session.getRemoteAddress().getAddress().getHostAddress());
+ return res;
+ }
+
protected Response doAuthTest(SMTPSession session, Username username, String pass, String authType) {
if ((username == null) || (pass == null)) {
return new SMTPResponse(SMTPRetCode.SYNTAX_ERROR_ARGUMENTS,"Could not decode parameters for AUTH " + authType);
diff --git a/protocols/smtp/src/main/java/org/apache/james/protocols/smtp/hook/AuthHook.java b/protocols/smtp/src/main/java/org/apache/james/protocols/smtp/hook/AuthHook.java
index f9e7f76f87..8351eb2367 100644
--- a/protocols/smtp/src/main/java/org/apache/james/protocols/smtp/hook/AuthHook.java
+++ b/protocols/smtp/src/main/java/org/apache/james/protocols/smtp/hook/AuthHook.java
@@ -38,4 +38,8 @@ public interface AuthHook extends Hook {
HookResult doAuth(SMTPSession session, Username username, String password);
HookResult doSasl(SMTPSession session, OidcSASLConfiguration saslConfiguration, String initialResponse);
+
+ default HookResult doDelegation(SMTPSession session, Username target) {
+ return HookResult.DECLINED;
+ }
}
diff --git a/server/protocols/protocols-smtp/src/test/java/org/apache/james/smtpserver/SMTPServerTest.java b/server/protocols/protocols-smtp/src/test/java/org/apache/james/smtpserver/SMTPServerTest.java
index fbde0a3f89..8356b9d16a 100644
--- a/server/protocols/protocols-smtp/src/test/java/org/apache/james/smtpserver/SMTPServerTest.java
+++ b/server/protocols/protocols-smtp/src/test/java/org/apache/james/smtpserver/SMTPServerTest.java
@@ -1420,7 +1420,7 @@ public class SMTPServerTest {
smtpProtocol.sendCommand("AUTH PLAIN");
smtpProtocol.sendCommand("canNotDecode");
assertThat(smtpProtocol.getReplyString())
- .contains("501 Could not decode parameters for AUTH PLAIN");
+ .contains("535 Authentication Failed");
}
@Test
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@james.apache.org
For additional commands, e-mail: notifications-help@james.apache.org