You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@james.apache.org by rc...@apache.org on 2021/12/16 08:19:18 UTC
[james-project] branch master updated (0d861c2 -> 4d84f03)
This is an automated email from the ASF dual-hosted git repository.
rcordier pushed a change to branch master
in repository https://gitbox.apache.org/repos/asf/james-project.git.
from 0d861c2 JAMES-3680 Remove empty JmapRfc8621ConfigurationTest.scala file
new d25af66 JAMES-3680 IMAP Allow disabling plain authentication
new 8039509 JAMES-3680 Add TestIMAPClient::authenticatePlain
new 4d84f03 JAMES-3680 IMAP fix PlainAuthDisallowedSSL tests name
The 3 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.../apache/james/imap/api/process/ImapSession.java | 17 ++++-
.../apache/james/imap/encode/FakeImapSession.java | 7 +-
.../imap/processor/AuthenticateProcessor.java | 4 +-
.../james/imap/processor/LoginProcessor.java | 16 ++--
.../sample-configuration/imapserver.xml | 6 ++
.../docs/modules/ROOT/pages/configure/imap.adoc | 3 +
.../sample-configuration/imapserver.xml | 6 ++
.../jpa-app/sample-configuration/imapserver.xml | 6 ++
.../memory-app/sample-configuration/imapserver.xml | 6 ++
.../spring-app/src/main/resources/imapserver.xml | 3 +
.../apache/james/imapserver/netty/IMAPServer.java | 6 +-
.../netty/ImapChannelUpstreamHandler.java | 16 ++--
.../james/imapserver/netty/NettyImapSession.java | 17 +++--
.../james/imapserver/netty/IMAPServerTest.java | 88 +++++++++++++++++++++-
...Allowed.xml => imapServerPlainAuthDisabled.xml} | 4 +-
...mapServerPlainAuthEnabledWithoutRequireSSL.xml} | 3 +
.../org/apache/james/utils/TestIMAPClient.java | 28 ++++---
.../org/apache/james/utils/TestIMAPClientTest.java | 4 +-
src/site/xdoc/server/config-imap4.xml | 2 +
19 files changed, 199 insertions(+), 43 deletions(-)
copy server/protocols/protocols-imap4/src/test/resources/{imapServerPlainAuthAllowed.xml => imapServerPlainAuthDisabled.xml} (80%)
copy server/protocols/protocols-imap4/src/test/resources/{imapServerPlainAuthAllowed.xml => imapServerPlainAuthEnabledWithoutRequireSSL.xml} (82%)
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@james.apache.org
For additional commands, e-mail: notifications-help@james.apache.org
[james-project] 01/03: JAMES-3680 IMAP Allow disabling plain authentication
Posted by rc...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
rcordier pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/james-project.git
commit d25af669bdc6ee24fbd9a258d57fb8a30d84e353
Author: Quan Tran <hq...@linagora.com>
AuthorDate: Thu Dec 9 15:48:03 2021 +0700
JAMES-3680 IMAP Allow disabling plain authentication
---
.../apache/james/imap/api/process/ImapSession.java | 17 ++++-
.../apache/james/imap/encode/FakeImapSession.java | 7 +-
.../imap/processor/AuthenticateProcessor.java | 4 +-
.../james/imap/processor/LoginProcessor.java | 16 ++---
.../sample-configuration/imapserver.xml | 6 ++
.../docs/modules/ROOT/pages/configure/imap.adoc | 3 +
.../sample-configuration/imapserver.xml | 6 ++
.../jpa-app/sample-configuration/imapserver.xml | 6 ++
.../memory-app/sample-configuration/imapserver.xml | 6 ++
.../spring-app/src/main/resources/imapserver.xml | 3 +
.../apache/james/imapserver/netty/IMAPServer.java | 6 +-
.../netty/ImapChannelUpstreamHandler.java | 16 +++--
.../james/imapserver/netty/NettyImapSession.java | 17 +++--
.../james/imapserver/netty/IMAPServerTest.java | 84 ++++++++++++++++++++++
.../test/resources/imapServerPlainAuthDisabled.xml | 13 ++++
...imapServerPlainAuthEnabledWithoutRequireSSL.xml | 14 ++++
src/site/xdoc/server/config-imap4.xml | 2 +
17 files changed, 199 insertions(+), 27 deletions(-)
diff --git a/protocols/imap/src/main/java/org/apache/james/imap/api/process/ImapSession.java b/protocols/imap/src/main/java/org/apache/james/imap/api/process/ImapSession.java
index 84db088..31293bc 100644
--- a/protocols/imap/src/main/java/org/apache/james/imap/api/process/ImapSession.java
+++ b/protocols/imap/src/main/java/org/apache/james/imap/api/process/ImapSession.java
@@ -209,10 +209,15 @@ public interface ImapSession extends CommandDetectionSession {
boolean supportMultipleNamespaces();
/**
+ * Return true if SSL is required when Authenticating
+ */
+ boolean isSSLRequired();
+
+ /**
* Return true if the login / authentication via plain username / password is
- * disallowed
+ * enabled
*/
- boolean isPlainAuthDisallowed();
+ boolean isPlainAuthEnabled();
default void setMailboxSession(MailboxSession mailboxSession) {
setAttribute(MAILBOX_SESSION_ATTRIBUTE_SESSION_KEY, mailboxSession);
@@ -227,4 +232,12 @@ public interface ImapSession extends CommandDetectionSession {
.map(MailboxSession::getUser)
.orElse(null);
}
+
+ default boolean isPlainAuthDisallowed() {
+ return !isPlainAuthEnabled() || isAuthenticatingNonEncryptedWhenRequiredSSL();
+ }
+
+ default boolean isAuthenticatingNonEncryptedWhenRequiredSSL() {
+ return isSSLRequired() && !isTLSActive();
+ }
}
diff --git a/protocols/imap/src/main/java/org/apache/james/imap/encode/FakeImapSession.java b/protocols/imap/src/main/java/org/apache/james/imap/encode/FakeImapSession.java
index cbf6447..83c2c67 100644
--- a/protocols/imap/src/main/java/org/apache/james/imap/encode/FakeImapSession.java
+++ b/protocols/imap/src/main/java/org/apache/james/imap/encode/FakeImapSession.java
@@ -145,11 +145,16 @@ public class FakeImapSession implements ImapSession {
}
@Override
- public boolean isPlainAuthDisallowed() {
+ public boolean isSSLRequired() {
return false;
}
@Override
+ public boolean isPlainAuthEnabled() {
+ return true;
+ }
+
+ @Override
public boolean isTLSActive() {
return false;
}
diff --git a/protocols/imap/src/main/java/org/apache/james/imap/processor/AuthenticateProcessor.java b/protocols/imap/src/main/java/org/apache/james/imap/processor/AuthenticateProcessor.java
index 96d88a5..6ce9764 100644
--- a/protocols/imap/src/main/java/org/apache/james/imap/processor/AuthenticateProcessor.java
+++ b/protocols/imap/src/main/java/org/apache/james/imap/processor/AuthenticateProcessor.java
@@ -61,7 +61,7 @@ public class AuthenticateProcessor extends AbstractAuthProcessor<AuthenticateReq
final String authType = request.getAuthType();
if (authType.equalsIgnoreCase(PLAIN)) {
// See if AUTH=PLAIN is allowed. See IMAP-304
- if (session.isPlainAuthDisallowed() && session.isTLSActive() == false) {
+ if (session.isPlainAuthDisallowed()) {
no(request, responder, HumanReadableText.DISABLED_LOGIN);
} else {
if (request instanceof IRAuthenticateRequest) {
@@ -140,7 +140,7 @@ public class AuthenticateProcessor extends AbstractAuthProcessor<AuthenticateReq
List<Capability> caps = new ArrayList<>();
// Only ounce AUTH=PLAIN if the session does allow plain auth or TLS is active.
// See IMAP-304
- if (session.isPlainAuthDisallowed() == false || session.isTLSActive()) {
+ if (!session.isPlainAuthDisallowed()) {
caps.add(Capability.of("AUTH=PLAIN"));
}
// Support for SASL-IR. See RFC4959
diff --git a/protocols/imap/src/main/java/org/apache/james/imap/processor/LoginProcessor.java b/protocols/imap/src/main/java/org/apache/james/imap/processor/LoginProcessor.java
index a75bdab..e7e7f29 100644
--- a/protocols/imap/src/main/java/org/apache/james/imap/processor/LoginProcessor.java
+++ b/protocols/imap/src/main/java/org/apache/james/imap/processor/LoginProcessor.java
@@ -49,20 +49,20 @@ public class LoginProcessor extends AbstractAuthProcessor<LoginRequest> implemen
@Override
protected void processRequest(LoginRequest request, ImapSession session, Responder responder) {
- // check if the login is allowed with LOGIN command. See IMAP-304
- if (session.isPlainAuthDisallowed() && session.isTLSActive() == false) {
- no(request, responder, HumanReadableText.DISABLED_LOGIN);
- } else {
- doAuth(noDelegation(request.getUserid(), request.getPassword()),
- session, request, responder, HumanReadableText.INVALID_LOGIN);
- }
+ // check if the login is allowed with LOGIN command. See IMAP-304
+ if (session.isPlainAuthDisallowed()) {
+ no(request, responder, HumanReadableText.DISABLED_LOGIN);
+ } else {
+ doAuth(noDelegation(request.getUserid(), request.getPassword()),
+ session, request, responder, HumanReadableText.INVALID_LOGIN);
+ }
}
@Override
public List<Capability> getImplementedCapabilities(ImapSession session) {
// Announce LOGINDISABLED if plain auth / login is deactivated and the session is not using
// TLS. See IMAP-304
- if (session.isPlainAuthDisallowed() && session.isTLSActive() == false) {
+ if (session.isPlainAuthDisallowed()) {
return LOGINDISABLED_CAPS;
}
return Collections.emptyList();
diff --git a/server/apps/cassandra-app/sample-configuration/imapserver.xml b/server/apps/cassandra-app/sample-configuration/imapserver.xml
index a91eb4f..8c7eaa6 100644
--- a/server/apps/cassandra-app/sample-configuration/imapserver.xml
+++ b/server/apps/cassandra-app/sample-configuration/imapserver.xml
@@ -47,6 +47,9 @@ under the License.
<idleTimeIntervalUnit>SECONDS</idleTimeIntervalUnit>
<enableIdle>true</enableIdle>
<plainAuthDisallowed>true</plainAuthDisallowed>
+ <auth>
+ <plainAuthEnabled>true</plainAuthEnabled>
+ </auth>
</imapserver>
<imapserver enabled="true">
<jmxName>imapserver-ssl</jmxName>
@@ -72,5 +75,8 @@ under the License.
<idleTimeInterval>120</idleTimeInterval>
<idleTimeIntervalUnit>SECONDS</idleTimeIntervalUnit>
<enableIdle>true</enableIdle>
+ <auth>
+ <plainAuthEnabled>true</plainAuthEnabled>
+ </auth>
</imapserver>
</imapservers>
diff --git a/server/apps/distributed-app/docs/modules/ROOT/pages/configure/imap.adoc b/server/apps/distributed-app/docs/modules/ROOT/pages/configure/imap.adoc
index 01ba320..627e095 100644
--- a/server/apps/distributed-app/docs/modules/ROOT/pages/configure/imap.adoc
+++ b/server/apps/distributed-app/docs/modules/ROOT/pages/configure/imap.adoc
@@ -46,6 +46,9 @@ Defaults to 0 (unlimited). Must be a positive integer, optionally with a unit: B
| plainAuthDisallowed
| Whether to enable Authentication PLAIN if the connection is not encrypted via SSL or STARTTLS. Defaults to `true`.
+| auth.plainAuthEnabled
+| Whether to enable Authentication PLAIN/ LOGIN command. Defaults to `true`.
+
| timeout
| Default to 30 minutes. After this time, inactive channels that have not performed read, write, or both operation for a while
will be closed. Negative value disable this behaviour.
diff --git a/server/apps/distributed-app/sample-configuration/imapserver.xml b/server/apps/distributed-app/sample-configuration/imapserver.xml
index a91eb4f..8c7eaa6 100644
--- a/server/apps/distributed-app/sample-configuration/imapserver.xml
+++ b/server/apps/distributed-app/sample-configuration/imapserver.xml
@@ -47,6 +47,9 @@ under the License.
<idleTimeIntervalUnit>SECONDS</idleTimeIntervalUnit>
<enableIdle>true</enableIdle>
<plainAuthDisallowed>true</plainAuthDisallowed>
+ <auth>
+ <plainAuthEnabled>true</plainAuthEnabled>
+ </auth>
</imapserver>
<imapserver enabled="true">
<jmxName>imapserver-ssl</jmxName>
@@ -72,5 +75,8 @@ under the License.
<idleTimeInterval>120</idleTimeInterval>
<idleTimeIntervalUnit>SECONDS</idleTimeIntervalUnit>
<enableIdle>true</enableIdle>
+ <auth>
+ <plainAuthEnabled>true</plainAuthEnabled>
+ </auth>
</imapserver>
</imapservers>
diff --git a/server/apps/jpa-app/sample-configuration/imapserver.xml b/server/apps/jpa-app/sample-configuration/imapserver.xml
index 1ee0e13..0d38de0 100644
--- a/server/apps/jpa-app/sample-configuration/imapserver.xml
+++ b/server/apps/jpa-app/sample-configuration/imapserver.xml
@@ -48,6 +48,9 @@ under the License.
<idleTimeIntervalUnit>SECONDS</idleTimeIntervalUnit>
<enableIdle>true</enableIdle>
<plainAuthDisallowed>true</plainAuthDisallowed>
+ <auth>
+ <plainAuthEnabled>true</plainAuthEnabled>
+ </auth>
</imapserver>
<imapserver enabled="true">
<jmxName>imapserver-ssl</jmxName>
@@ -73,5 +76,8 @@ under the License.
<idleTimeInterval>120</idleTimeInterval>
<idleTimeIntervalUnit>SECONDS</idleTimeIntervalUnit>
<enableIdle>true</enableIdle>
+ <auth>
+ <plainAuthEnabled>true</plainAuthEnabled>
+ </auth>
</imapserver>
</imapservers>
diff --git a/server/apps/memory-app/sample-configuration/imapserver.xml b/server/apps/memory-app/sample-configuration/imapserver.xml
index 03a6c7f..d618e3c 100644
--- a/server/apps/memory-app/sample-configuration/imapserver.xml
+++ b/server/apps/memory-app/sample-configuration/imapserver.xml
@@ -48,6 +48,9 @@ under the License.
<idleTimeIntervalUnit>SECONDS</idleTimeIntervalUnit>
<enableIdle>true</enableIdle>
<plainAuthDisallowed>true</plainAuthDisallowed>
+ <auth>
+ <plainAuthEnabled>true</plainAuthEnabled>
+ </auth>
</imapserver>
<imapserver enabled="true">
<jmxName>imapserver-ssl</jmxName>
@@ -73,5 +76,8 @@ under the License.
<idleTimeInterval>120</idleTimeInterval>
<idleTimeIntervalUnit>SECONDS</idleTimeIntervalUnit>
<enableIdle>true</enableIdle>
+ <auth>
+ <plainAuthEnabled>true</plainAuthEnabled>
+ </auth>
</imapserver>
</imapservers>
diff --git a/server/apps/spring-app/src/main/resources/imapserver.xml b/server/apps/spring-app/src/main/resources/imapserver.xml
index c02ce76..5e9fe28 100644
--- a/server/apps/spring-app/src/main/resources/imapserver.xml
+++ b/server/apps/spring-app/src/main/resources/imapserver.xml
@@ -80,6 +80,9 @@
<connectionLimitPerIP>0</connectionLimitPerIP>
<plainAuthDisallowed>true</plainAuthDisallowed>
+ <auth>
+ <plainAuthEnabled>true</plainAuthEnabled>
+ </auth>
</imapserver>
</imapservers>
diff --git a/server/protocols/protocols-imap4/src/main/java/org/apache/james/imapserver/netty/IMAPServer.java b/server/protocols/protocols-imap4/src/main/java/org/apache/james/imapserver/netty/IMAPServer.java
index dd8a4e5..967623c 100644
--- a/server/protocols/protocols-imap4/src/main/java/org/apache/james/imapserver/netty/IMAPServer.java
+++ b/server/protocols/protocols-imap4/src/main/java/org/apache/james/imapserver/netty/IMAPServer.java
@@ -78,6 +78,7 @@ public class IMAPServer extends AbstractConfigurableAsyncServer implements ImapC
private boolean plainAuthDisallowed;
private int timeout;
private int literalSizeLimit;
+ private boolean plainAuthEnabled;
public static final int DEFAULT_MAX_LINE_LENGTH = 65536; // Use a big default
public static final Size DEFAULT_IN_MEMORY_SIZE_LIMIT = Size.of(10L, Size.Unit.M); // Use 10MB as default
@@ -114,6 +115,7 @@ public class IMAPServer extends AbstractConfigurableAsyncServer implements ImapC
if (timeout < DEFAULT_TIMEOUT) {
throw new ConfigurationException("Minimum timeout of 30 minutes required. See rfc2060 5.4 for details");
}
+ plainAuthEnabled = configuration.getBoolean("auth.plainAuthEnabled", true);
processor.configure(getImapConfiguration(configuration));
}
@@ -210,9 +212,9 @@ public class IMAPServer extends AbstractConfigurableAsyncServer implements ImapC
ImapChannelUpstreamHandler coreHandler;
Encryption secure = getEncryption();
if (secure != null && secure.isStartTLS()) {
- coreHandler = new ImapChannelUpstreamHandler(hello, processor, encoder, compress, plainAuthDisallowed, secure, imapMetrics);
+ coreHandler = new ImapChannelUpstreamHandler(hello, processor, encoder, compress, plainAuthDisallowed, secure, plainAuthEnabled, imapMetrics);
} else {
- coreHandler = new ImapChannelUpstreamHandler(hello, processor, encoder, compress, plainAuthDisallowed, imapMetrics);
+ coreHandler = new ImapChannelUpstreamHandler(hello, processor, encoder, compress, plainAuthDisallowed, imapMetrics, plainAuthEnabled);
}
return coreHandler;
}
diff --git a/server/protocols/protocols-imap4/src/main/java/org/apache/james/imapserver/netty/ImapChannelUpstreamHandler.java b/server/protocols/protocols-imap4/src/main/java/org/apache/james/imapserver/netty/ImapChannelUpstreamHandler.java
index 16cb3fc..6161578 100644
--- a/server/protocols/protocols-imap4/src/main/java/org/apache/james/imapserver/netty/ImapChannelUpstreamHandler.java
+++ b/server/protocols/protocols-imap4/src/main/java/org/apache/james/imapserver/netty/ImapChannelUpstreamHandler.java
@@ -69,32 +69,34 @@ public class ImapChannelUpstreamHandler extends SimpleChannelUpstreamHandler imp
private final ImapHeartbeatHandler heartbeatHandler = new ImapHeartbeatHandler();
- private final boolean plainAuthDisallowed;
+ private final boolean requiredSSL;
+ private final boolean plainAuthEnabled;
private final Metric imapConnectionsMetric;
private final Metric imapCommandsMetric;
public ImapChannelUpstreamHandler(String hello, ImapProcessor processor, ImapEncoder encoder, boolean compress,
- boolean plainAuthDisallowed, ImapMetrics imapMetrics) {
- this(hello, processor, encoder, compress, plainAuthDisallowed, null, imapMetrics);
+ boolean requiredSSL, ImapMetrics imapMetrics, boolean plainAuthEnabled) {
+ this(hello, processor, encoder, compress, requiredSSL, null, plainAuthEnabled, imapMetrics);
}
public ImapChannelUpstreamHandler(String hello, ImapProcessor processor, ImapEncoder encoder, boolean compress,
- boolean plainAuthDisallowed, Encryption secure, ImapMetrics imapMetrics) {
+ boolean requiredSSL, Encryption secure, boolean plainAuthEnabled, ImapMetrics imapMetrics) {
this.hello = hello;
this.processor = processor;
this.encoder = encoder;
this.secure = secure;
this.compress = compress;
- this.plainAuthDisallowed = plainAuthDisallowed;
+ this.requiredSSL = requiredSSL;
+ this.plainAuthEnabled = plainAuthEnabled;
this.imapConnectionsMetric = imapMetrics.getConnectionsMetric();
this.imapCommandsMetric = imapMetrics.getCommandsMetric();
}
@Override
public void channelBound(final ChannelHandlerContext ctx, ChannelStateEvent e) throws Exception {
- ImapSession imapsession = new NettyImapSession(ctx.getChannel(), secure, compress, plainAuthDisallowed,
- SessionId.generate());
+ ImapSession imapsession = new NettyImapSession(ctx.getChannel(), secure, compress, requiredSSL,
+ plainAuthEnabled, SessionId.generate());
MDCBuilder boundMDC = IMAPMDCContext.boundMDC(ctx);
imapsession.setAttribute(MDC_KEY, boundMDC);
attributes.set(ctx.getChannel(), imapsession);
diff --git a/server/protocols/protocols-imap4/src/main/java/org/apache/james/imapserver/netty/NettyImapSession.java b/server/protocols/protocols-imap4/src/main/java/org/apache/james/imapserver/netty/NettyImapSession.java
index 579348c..0148a6c 100644
--- a/server/protocols/protocols-imap4/src/main/java/org/apache/james/imapserver/netty/NettyImapSession.java
+++ b/server/protocols/protocols-imap4/src/main/java/org/apache/james/imapserver/netty/NettyImapSession.java
@@ -40,15 +40,17 @@ public class NettyImapSession implements ImapSession, NettyConstants {
private final boolean compress;
private final Channel channel;
private int handlerCount;
- private final boolean plainAuthDisallowed;
+ private final boolean requiredSSL;
+ private final boolean plainAuthEnabled;
private final SessionId sessionId;
private boolean needsCommandInjectionDetection;
- public NettyImapSession(Channel channel, Encryption secure, boolean compress, boolean plainAuthDisallowed, SessionId sessionId) {
+ public NettyImapSession(Channel channel, Encryption secure, boolean compress, boolean requiredSSL, boolean plainAuthEnabled, SessionId sessionId) {
this.channel = channel;
this.secure = secure;
this.compress = compress;
- this.plainAuthDisallowed = plainAuthDisallowed;
+ this.requiredSSL = requiredSSL;
+ this.plainAuthEnabled = plainAuthEnabled;
this.sessionId = sessionId;
this.needsCommandInjectionDetection = true;
}
@@ -196,8 +198,13 @@ public class NettyImapSession implements ImapSession, NettyConstants {
}
@Override
- public boolean isPlainAuthDisallowed() {
- return plainAuthDisallowed;
+ public boolean isSSLRequired() {
+ return requiredSSL;
+ }
+
+ @Override
+ public boolean isPlainAuthEnabled() {
+ return plainAuthEnabled;
}
@Override
diff --git a/server/protocols/protocols-imap4/src/test/java/org/apache/james/imapserver/netty/IMAPServerTest.java b/server/protocols/protocols-imap4/src/test/java/org/apache/james/imapserver/netty/IMAPServerTest.java
index e988a9b..b52a677 100644
--- a/server/protocols/protocols-imap4/src/test/java/org/apache/james/imapserver/netty/IMAPServerTest.java
+++ b/server/protocols/protocols-imap4/src/test/java/org/apache/james/imapserver/netty/IMAPServerTest.java
@@ -398,6 +398,90 @@ class IMAPServerTest {
}
@Nested
+ class PlainAuthDisabled {
+ IMAPServer imapServer;
+ private int port;
+
+ @BeforeEach
+ void beforeEach() throws Exception {
+ imapServer = createImapServer("imapServerPlainAuthDisabled.xml");
+ port = imapServer.getListenAddresses().get(0).getPort();
+ }
+
+ @AfterEach
+ void tearDown() {
+ imapServer.destroy();
+ }
+
+ @Test
+ void loginShouldFail() {
+ assertThatThrownBy(() ->
+ testIMAPClient.connect("127.0.0.1", port)
+ .login(USER.asString(), USER_PASS))
+ .hasMessage("Login failed");
+ }
+
+ @Test
+ void authenticatePlainShouldFail() {
+ assertThatThrownBy(() ->
+ testIMAPClient.connect("127.0.0.1", port)
+ .authenticatePlain(USER.asString(), USER_PASS))
+ .hasMessage("Login failed");
+ }
+
+ @Test
+ void capabilityShouldNotAdvertiseLoginAndAuthenticationPlain() throws Exception {
+ testIMAPClient.connect("127.0.0.1", port);
+
+ assertThat(testIMAPClient.capability())
+ .contains("LOGINDISABLED")
+ .doesNotContain("AUTH=PLAIN");
+ }
+ }
+
+ @Nested
+ class PlainAuthEnabledWithoutRequireSSL {
+ IMAPServer imapServer;
+ private int port;
+
+ @BeforeEach
+ void beforeEach() throws Exception {
+ imapServer = createImapServer("imapServerPlainAuthEnabledWithoutRequireSSL.xml");
+ port = imapServer.getListenAddresses().get(0).getPort();
+ }
+
+ @AfterEach
+ void tearDown() {
+ imapServer.destroy();
+ }
+
+ @Test
+ void loginShouldSucceed() {
+ assertThatCode(() ->
+ testIMAPClient.connect("127.0.0.1", port)
+ .login(USER.asString(), USER_PASS))
+ .doesNotThrowAnyException();
+ }
+
+ @Test
+ void authenticatePlainShouldSucceed() {
+ assertThatCode(() ->
+ testIMAPClient.connect("127.0.0.1", port)
+ .authenticatePlain(USER.asString(), USER_PASS))
+ .doesNotThrowAnyException();
+ }
+
+ @Test
+ void capabilityShouldAdvertiseLoginAndAuthenticationPlain() throws Exception {
+ testIMAPClient.connect("127.0.0.1", port);
+
+ assertThat(testIMAPClient.capability())
+ .doesNotContain("LOGINDISABLED")
+ .contains("AUTH=PLAIN");
+ }
+ }
+
+ @Nested
class PlainAuthDisallowed {
IMAPServer imapServer;
private int port;
diff --git a/server/protocols/protocols-imap4/src/test/resources/imapServerPlainAuthDisabled.xml b/server/protocols/protocols-imap4/src/test/resources/imapServerPlainAuthDisabled.xml
new file mode 100644
index 0000000..dbf5184
--- /dev/null
+++ b/server/protocols/protocols-imap4/src/test/resources/imapServerPlainAuthDisabled.xml
@@ -0,0 +1,13 @@
+<imapserver enabled="true">
+ <jmxName>imapserver</jmxName>
+ <bind>0.0.0.0:0</bind>
+ <tls socketTLS="false" startTLS="true">
+ <keystore>classpath://keystore</keystore>
+ <secret>james72laBalle</secret>
+ <provider>org.bouncycastle.jce.provider.BouncyCastleProvider</provider>
+ <algorithm>SunX509</algorithm>
+ </tls>
+ <auth>
+ <plainAuthEnabled>false</plainAuthEnabled>
+ </auth>
+</imapserver>
\ No newline at end of file
diff --git a/server/protocols/protocols-imap4/src/test/resources/imapServerPlainAuthEnabledWithoutRequireSSL.xml b/server/protocols/protocols-imap4/src/test/resources/imapServerPlainAuthEnabledWithoutRequireSSL.xml
new file mode 100644
index 0000000..e8ce755
--- /dev/null
+++ b/server/protocols/protocols-imap4/src/test/resources/imapServerPlainAuthEnabledWithoutRequireSSL.xml
@@ -0,0 +1,14 @@
+<imapserver enabled="true">
+ <jmxName>imapserver</jmxName>
+ <bind>0.0.0.0:0</bind>
+ <tls socketTLS="false" startTLS="true">
+ <keystore>classpath://keystore</keystore>
+ <secret>james72laBalle</secret>
+ <provider>org.bouncycastle.jce.provider.BouncyCastleProvider</provider>
+ <algorithm>SunX509</algorithm>
+ </tls>
+ <auth>
+ <plainAuthEnabled>true</plainAuthEnabled>
+ </auth>
+ <plainAuthDisallowed>false</plainAuthDisallowed>
+</imapserver>
\ No newline at end of file
diff --git a/src/site/xdoc/server/config-imap4.xml b/src/site/xdoc/server/config-imap4.xml
index d4aacd5..74d2060 100644
--- a/src/site/xdoc/server/config-imap4.xml
+++ b/src/site/xdoc/server/config-imap4.xml
@@ -85,6 +85,8 @@
know what you are doing</dd>
<dt><strong>plainAuthDisallowed</strong></dt>
<dd>Whether to enable Authentication PLAIN if the connection is not encrypted via SSL or STARTTLS. Defaults to true.</dd>
+ <dt><strong>auth.plainAuthEnabled</strong></dt>
+ <dd>Whether to enable Authentication PLAIN/ LOGIN command. Defaults to true.</dd>
</dl>
</section>
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@james.apache.org
For additional commands, e-mail: notifications-help@james.apache.org
[james-project] 03/03: JAMES-3680 IMAP fix PlainAuthDisallowedSSL tests name
Posted by rc...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
rcordier pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/james-project.git
commit 4d84f037fdeb2f6650661efda2e176eead2d214e
Author: Quan Tran <hq...@linagora.com>
AuthorDate: Fri Dec 10 11:54:05 2021 +0700
JAMES-3680 IMAP fix PlainAuthDisallowedSSL tests name
---
.../test/java/org/apache/james/imapserver/netty/IMAPServerTest.java | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/server/protocols/protocols-imap4/src/test/java/org/apache/james/imapserver/netty/IMAPServerTest.java b/server/protocols/protocols-imap4/src/test/java/org/apache/james/imapserver/netty/IMAPServerTest.java
index b52a677..80ed6fd 100644
--- a/server/protocols/protocols-imap4/src/test/java/org/apache/james/imapserver/netty/IMAPServerTest.java
+++ b/server/protocols/protocols-imap4/src/test/java/org/apache/james/imapserver/netty/IMAPServerTest.java
@@ -532,7 +532,7 @@ class IMAPServerTest {
}
@Test
- void loginShouldFailOnUnEncryptedChannel() {
+ void loginShouldSucceedOnUnEncryptedChannel() {
assertThatCode(() ->
testIMAPClient.connect("127.0.0.1", port)
.login(USER.asString(), USER_PASS))
@@ -540,7 +540,7 @@ class IMAPServerTest {
}
@Test
- void capabilityShouldNotAdvertiseLoginOnUnEncryptedChannel() throws Exception {
+ void capabilityShouldAdvertiseLoginOnUnEncryptedChannel() throws Exception {
testIMAPClient.connect("127.0.0.1", port);
assertThat(testIMAPClient.capability())
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@james.apache.org
For additional commands, e-mail: notifications-help@james.apache.org
[james-project] 02/03: JAMES-3680 Add TestIMAPClient::authenticatePlain
Posted by rc...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
rcordier pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/james-project.git
commit 80395095ad65047e8d7bf08d24e282e117385bb2
Author: Quan Tran <hq...@linagora.com>
AuthorDate: Fri Dec 10 11:44:59 2021 +0700
JAMES-3680 Add TestIMAPClient::authenticatePlain
---
.../org/apache/james/utils/TestIMAPClient.java | 28 +++++++++++++---------
.../org/apache/james/utils/TestIMAPClientTest.java | 4 ++--
2 files changed, 19 insertions(+), 13 deletions(-)
diff --git a/server/testing/src/main/java/org/apache/james/utils/TestIMAPClient.java b/server/testing/src/main/java/org/apache/james/utils/TestIMAPClient.java
index b3870ee..72f1c79 100644
--- a/server/testing/src/main/java/org/apache/james/utils/TestIMAPClient.java
+++ b/server/testing/src/main/java/org/apache/james/utils/TestIMAPClient.java
@@ -29,7 +29,7 @@ import java.util.regex.Matcher;
import java.util.regex.Pattern;
import java.util.stream.Stream;
-import org.apache.commons.net.imap.IMAPClient;
+import org.apache.commons.net.imap.AuthenticatingIMAPClient;
import org.apache.commons.net.io.CRLFLineReader;
import org.apache.james.core.Username;
import org.assertj.core.api.Assertions;
@@ -43,9 +43,12 @@ import com.google.common.base.Splitter;
import com.google.common.collect.ImmutableList;
public class TestIMAPClient extends ExternalResource implements Closeable, AfterEachCallback {
+ private static final Pattern EXAMINE_EXISTS = Pattern.compile("^\\* (\\d+) EXISTS$");
+ private static final int MESSAGE_NUMBER_MATCHING_GROUP = 1;
+ public static final String INBOX = "INBOX";
- public static class Utf8IMAPClient extends IMAPClient {
- private static String UTF8_ENCODING = "UTF-8";
+ public static class Utf8IMAPSClient extends AuthenticatingIMAPClient {
+ private static final String UTF8_ENCODING = "UTF-8";
@Override
protected void _connectAction_() throws IOException {
@@ -55,20 +58,15 @@ public class TestIMAPClient extends ExternalResource implements Closeable, After
}
}
- private static final Pattern EXAMINE_EXISTS = Pattern.compile("^\\* (\\d+) EXISTS$");
- private static final int MESSAGE_NUMBER_MATCHING_GROUP = 1;
- public static final String INBOX = "INBOX";
-
- private final Utf8IMAPClient imapClient;
-
+ private final Utf8IMAPSClient imapClient;
@VisibleForTesting
- TestIMAPClient(Utf8IMAPClient imapClient) {
+ TestIMAPClient(Utf8IMAPSClient imapClient) {
this.imapClient = imapClient;
}
public TestIMAPClient() {
- this(new Utf8IMAPClient());
+ this(new Utf8IMAPSClient());
}
public TestIMAPClient connect(String host, int port) throws IOException {
@@ -94,6 +92,14 @@ public class TestIMAPClient extends ExternalResource implements Closeable, After
return this;
}
+ public TestIMAPClient authenticatePlain(String user, String password) throws Exception {
+ final boolean authenticatePlain = imapClient.authenticate(AuthenticatingIMAPClient.AUTH_METHOD.PLAIN, user, password);
+ if (!authenticatePlain) {
+ throw new Exception("Login failed");
+ }
+ return this;
+ }
+
public TestIMAPClient rawLogin(String user, String password) throws IOException {
imapClient.sendCommand("LOGIN " + user + " " + password);
diff --git a/server/testing/src/test/java/org/apache/james/utils/TestIMAPClientTest.java b/server/testing/src/test/java/org/apache/james/utils/TestIMAPClientTest.java
index f0926ff..8bf5802 100644
--- a/server/testing/src/test/java/org/apache/james/utils/TestIMAPClientTest.java
+++ b/server/testing/src/test/java/org/apache/james/utils/TestIMAPClientTest.java
@@ -21,11 +21,11 @@ package org.apache.james.utils;
import static org.assertj.core.api.Assertions.assertThat;
-import org.apache.james.utils.TestIMAPClient.Utf8IMAPClient;
+import org.apache.james.utils.TestIMAPClient.Utf8IMAPSClient;
import org.junit.jupiter.api.Test;
class TestIMAPClientTest {
- static final Utf8IMAPClient NULL_IMAP_CLIENT = null;
+ static final Utf8IMAPSClient NULL_IMAP_CLIENT = null;
TestIMAPClient testee = new TestIMAPClient(NULL_IMAP_CLIENT);
@Test
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@james.apache.org
For additional commands, e-mail: notifications-help@james.apache.org