auth: Don't include LIBSODIUM_LIBS in dependencies Put it into AUTH_LIBS among other libraries that are used by auth.

auth: Install stats plugin to old-stats/ Fixes using auth_stats=yes

global: Renamed stats plugin and service to old-stats

configure: Fix Lua conditionals

auth: Add lua passdb/userdb support

auth: Remove userdb nss Its original purpose was because getpwnam() couldn't differentiate between "user doesn't exist" and "temporary error", but this was solved by using getpwnam_r() instead. So all userdb nss users should be able to safely switch to userdb passwd.

libpassword: Add unit tests

libpassword: Add BLF-CRYPT support independent of crypt

libpassword: Add support for ARGON2 scheme

global: Use check-local in Makefile.am instead of overriding check directly This helps with dependency problems, like running "make check" in lib-storage without "make" first would try to compile the test programs too early and fail.

auth: Organize code into two unit tests auth-cache needs special setup

auth: Add test suite for username filter

auth: Refactor auth to use libauth.la This makes writing new unit tests easier, as you can link to libauth.la.

auth: Add oauth2 passdb

auth: Add xoauth2 and oauthbearer mechanisms

auth-policy: Enable SSL connections

Add PIE and RELRO to binaries

auth: Finish policy.[ch] renaming..

auth-policy: Add policy implementation

auth: Makefile dependency fix Hopefully fixes: mv: cannot stat '.deps/auth-stats.Tpo': No such file or directory

auth: Add PBKDF2 password scheme

Makefile: Added missing auth-request-stats.h

auth: If auth_stats=yes, send statistics to stats process.

auth: Added %{passdb:field} and %{userdb:field} variables The field expands to either the passdb or userdb extra field. You can also use %{passdb:field:defaultvalue} where if field doesn't exist, it's expanded to defaultvalue. Note that an empty value means that the field still exists and it's not expanded to defaultvalue.

auth: Added unit test for auth %variable expansion.

auth: Moved var_expand() related code to its own file.

auth: passdb/userdb dict rewrite to support more complex configuration. See the new doc/example-config/dovecot-dict-auth.conf.ext for explanation how it works. The old configuration format will also stay functional.

MODULE_LIBS is now part of LIBDOVECOT. No need to explicitly link it everywhere.

auth: Code cleanup: Renamed auth-stream to auth-fields.

lib-ssl-iostream now dynamically loads openssl library instead of linking to it. This allowed removing the separate libdovecot-ssl library. In future if GnuTLS/NSS support is added it would also allow switching between them dynamically.

auth: Add and use SCRAM-SHA-1 password scheme

Makefile: Fixed test program dependencies Explicit dependencies on .o or .lo files didn't seem to work properly and with high enough make -j value the build failed. Depending on the entire library guarantees that all the individual .o files have been built.

Added support to perform token-based service process authentication. Creates hidden SASL method DOVECOT-TOKEN. This method is not available on the normal auth login socket and thus never presented to clients. Creates new auth socket type 'tokenlogin'. This otherwise normal login socket only offers authentication using the DOVECOT-TOKEN mechanism. Creates new token-login directory in base_dir to separate token logins from normal logins. This directory is otherwise completely identical to the normal login dir, i.e. it contains sockets for the service backends, used to chroot login processes to, etc. Makes default login socket configurable. Performs some minor changes to src/login-common to build very sparse protocols, e.g. avoid the need to implement methods that are not needed.

auth: Added "dict" passdb/userdb.

auth: Fixed auth cache key generation to support %{long} variables

Makefile: Link with SSL_LIBS whenever linking libssl_iostream.la

auth: Handle proxy_maybe=yes with host=hostname properly.

auth: Handle proxy_maybe=yes with host=hostname properly.

auth: Implemented support for Postfix's "TCP map" sockets for user existence lookups.

auth: Fixed loading authdb_imap plugin when Dovecot is configured --without-shared-libs

auth: Implement the SCRAM-SHA-1 SASL mechanism

auth: Renamed passdb_imap plugin to authdb_imap.

auth: Added passdb imap plugin.

auth: Added default_fields and override_fields settings to all passdbs and userdbs.

Fixed compiling ldap/sql/gssapi plugins. I couldn't figure out any way to disable NOPLUGIN_FLAGS only for those plugins, so those flags are now always disabled for lib-sql library and auth binaries.

auth: Added passdb static. --HG-- branch : HEAD

auth: added new password scheme names {BLF,SHA256,SHA512}-CRYPT. Their availability depends on the used libc. doveadm pw: added '-r rounds' option for the password schemes mentioned above. --HG-- branch : HEAD

configure: Removed --enable-header-install. It's now always enabled. There didn't seem to be much point in keeping it optional anymore. They're now more useful than before because shared libraries are also installed. --HG-- branch : HEAD

auth: Added auth failure penalty tracking based on remote IP address. --HG-- branch : HEAD

dovecot-auth binary renamed to auth. --HG-- branch : HEAD

Redesigned how login process passes connections to mail processes and changed related APIs. Master process is no longer in the middle. --HG-- branch : HEAD

Makefiles: Separated LIBDOVECOT and LIBDOVECOT_DEPS. --HG-- branch : HEAD

Removed unnecessary macro definitions from Makefiles. --HG-- branch : HEAD

auth: Added support for EXTERNAL SASL mechanism. --HG-- branch : HEAD

Flattened header namespace on install. --HG-- branch : HEAD

Renamed headers to prevent collision if they were flattened on an install. --HG-- branch : HEAD

Moved auth-client-interface.h to lib-auth/. --HG-- branch : HEAD

Initial commit for v2.0 master rewrite. Several features are still missing. --HG-- branch : HEAD

Some binaries were missing list of library dependencies. --HG-- branch : HEAD

Added configure --without-shared-libs to link built binaries against static libraries. The libraries are still built and installed, so this is mainly useful for making life easier for developers. --HG-- branch : HEAD

Link -liconv to libdovecot.so if necessary. --HG-- branch : HEAD

Build libdovecot.so and libdovecot-storage.so. Based on patch by Stephan Bosch. --HG-- branch : HEAD

Fixed --with-ldap=plugin and --with-gssapi=plugin --HG-- branch : HEAD

Initial commit for config rewrite. --HG-- branch : HEAD

Added support for userdb checkpassword. Patch by Sascha Wilde. --HG-- branch : HEAD

If we need -lcrypto for randomness, put it to $LIBS instead of $RAND_LIBS since it needs to be linked to all binaries anyway. --HG-- branch : HEAD

Added missing userdb-static.h --HG-- branch : HEAD

Added --with-gssapi=plugin --HG-- branch : HEAD

--with-ldap=plugin builds LDAP passdb and userdb support as a plugin. --HG-- branch : HEAD

Changed plugin handling. We'll just load and call _init() functions for all plugins in $moduledir/auth/. --HG-- branch : HEAD

Added support for Samba's ntlm_auth helper. It's used for GSS-SPNEGO mechanism. If auth_ntlm_use_winbind=yes it's also used for NTLM mechanism. Patch by Dmitry Butskoy. --HG-- branch : HEAD

Added userdb nss which currently supports glibc-compatible NSS modules. --HG-- branch : HEAD

Factor out duplicated verify_callback() function. --HG-- branch : HEAD

All password schemes can now be encoded with base64 or hex. The encoding is ".b64", ".base64" or ".hex" suffix in the scheme, eg. {plain.b64}. Password scheme verification function can now be set to NULL, in which case the verification is done by generating a new crypted password from given plaintext password and comparing it. --HG-- branch : HEAD

Added --with-headers configure option to install .h files. --HG-- branch : HEAD

Added OTP and S/KEY authentication mechanisms. Patch by Andrey Panin. --HG-- branch : HEAD

Tru64 SIA authentication support. Patch by Simon L Jackson (simon jackson carringbush net) --HG-- branch : HEAD

Added -export-dynamic. --HG-- branch : HEAD

Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by pod@herald.ox.ac.uk --HG-- branch : HEAD

Renamed userdb passdb to prefetch. --HG-- branch : HEAD

s/occured/occurred/ --HG-- branch : HEAD

Allow multiple master connections for a single listener. --HG-- branch : HEAD

Restructuring of auth code. Balancer auth processes were a bad idea. Usually the balancer itself took as much CPU as the actual workers because it acted as a proxy. Now auth worker means different thing: they're used to execute blocking passdb and userdb queries. Currently just MySQL (PAM and checkpassword in TODO). --HG-- branch : HEAD

Changed the way multiple auth processes are handled. It no longer uses a pid appended to socket name but instead there's a balancer process which proxies the requests to worker processes. --HG-- branch : HEAD

Moving code around. --HG-- branch : HEAD

Reorganized the code to have less global/static variables. --HG-- branch : HEAD

Split auth_request* functions from mech.c to auth-request.c --HG-- branch : HEAD

Added "passdb" userdb. It works only if passdb gives all the information needed for userdb. For example with SQL you can use ".. uid AS userdb_uid, gid AS userdb_gid, home AS userdb_home .." in password_query. --HG-- branch : HEAD

Added simple LRU cache for auth requests. Currently only for sql passdb. --HG-- branch : HEAD

Upgrades to autoconf 2.5 and automake >1.4. --HG-- branch : HEAD

Added VERSION command and checking to authentication protocol. --HG-- branch : HEAD

Created generic asynchronous SQL API and implemented MySQL and PostgreSQL drivers. MySQL is implemented synchronously because it's API doesn't provide async way to do it. Replaced pgsql and mysql userdb/passdb with generic sql userdb/passdb. --HG-- branch : HEAD

Changed dovecot-auth protocol to ASCII based. Should be easier now to write replacement server if needed by someone. Also cleaned up/made more consistent auth code. The new code could still use some cleaning though.. --HG-- branch : HEAD

Removed Cyrus SASL code completely. It hasn't worked for ages (if ever?) and there's not much point in having it anyway. --HG-- branch : HEAD

fix --HG-- branch : HEAD

Added Compuserve RPA authentication. Patch by Andrey Panin. --HG-- branch : HEAD

Added auth/libpassword.a which util/dovecotpw can use rather than using object files directly. --HG-- branch : HEAD

NTLM authentication. Patch by Andrey Panin --HG-- branch : HEAD

Added LOGIN SASL mechanism. Patch by Andrey Panin --HG-- branch : HEAD

Added APOP authentication for POP3. Patch by Andrey Panin. This required some changes in auth APIs. --HG-- branch : HEAD

Added checkpassword passdb. userdb has only beginnings. --HG-- branch : HEAD

Added support for password scheme plugins. auth module dir defaults under module_dir now. --HG-- branch : HEAD

Removed hardcoded mechanism lists. It's now possible to add them dynamically. Added support for SASL initial response. --HG-- branch : HEAD

MySQL authentication patch by Matther Reimer --HG-- branch : HEAD

CRAM-MD5 mechanism by Joshua Goodall, plus some cleanups. --HG-- branch : HEAD

Added bsdauth support, patch by Dan Cross --HG-- branch : HEAD

Moved client side code for auth process handling to lib-auth. Some other login process cleanups. --HG-- branch : HEAD

Added support for dynamically loadable imap/pop3 modules. --HG-- branch : HEAD

Added support for ANONYMOUS SASL mechanism. --HG-- branch : HEAD

Support using OpenSSL's pseudo-random generator instead of /dev/urandom. If neither are found, allow dovecot-auth still to be started because currently only DIGEST-MD5 requires prng. --HG-- branch : HEAD

cleanups --HG-- branch : HEAD

Added PostgreSQL support, patch by Alex Howansky --HG-- branch : HEAD

crypt-password checking was broken. added support for md5crypt passwords. --HG-- branch : HEAD

Fix realm usage with DIGEST-MD5. Support generating other password schemes out of plaintext passwords. --HG-- branch : HEAD

Added default_pass_scheme to LDAP. Support for more password schemes. Merged password checking code with LDAP and passwd-file, so both support the same schemes now. --HG-- branch : HEAD

Support for dynamic authentication modules. --HG-- branch : HEAD

passdb ldap added. fixes to userdb ldap. --HG-- branch : HEAD

missing db-ldap.h --HG-- branch : HEAD

Cleanups, LDAP support compiles again and generally looks ok, even if it doesn't necessarily work :) Works now with new master config. --HG-- branch : HEAD

We have now separate "userdb" and "passdb". They aren't tied to each others in any way, so it's possible to use whatever user database with whatever password database. Added "static" userdb, which uses same uid/gid for everyone and generates home directory from given template. This could be useful with PAM, although insecure since everyone uses same uid. Not too well tested, and userdb/passdb API still needs to be changed to asynchronous for sql/ldap/etc lookups. --HG-- branch : HEAD

missing auth-mech-desc.h --HG-- branch : HEAD

Initial support for Cyrus SASL 2 library. I couldn't get it to work yet though :) --HG-- branch : HEAD

missing master.h --HG-- branch : HEAD

Moved mycrypt() into auth/ dir, so we don't have to link all programs with -lcrypt --HG-- branch : HEAD

Use libexecdir instead of libdir to install the binaries. --HG-- branch : HEAD

vpopmail authentication. compiles, not tested if it really works. --HG-- branch : HEAD

Initial revision --HG-- branch : HEAD