auth: The mechanisms configured using the auth_mechanisms setting were not enforced. The login service would check whether the mechanism is supported by auth, but auth performed no such check of its own. This means that any implemented mechanism was accessible from a login, even though was presumably disabled.

Added support to perform token-based service process authentication. Creates hidden SASL method DOVECOT-TOKEN. This method is not available on the normal auth login socket and thus never presented to clients. Creates new auth socket type 'tokenlogin'. This otherwise normal login socket only offers authentication using the DOVECOT-TOKEN mechanism. Creates new token-login directory in base_dir to separate token logins from normal logins. This directory is otherwise completely identical to the normal login dir, i.e. it contains sockets for the service backends, used to chroot login processes to, etc. Makes default login socket configurable. Performs some minor changes to src/login-common to build very sparse protocols, e.g. avoid the need to implement methods that are not needed.

auth: Removed unnecessary auth_request callback and context uses. --HG-- branch : HEAD

auth: Moved mechanism list out of struct auth. It could have been good there, except mechanism list is sent before there's any knowledge of what type of client is on the other side. Maybe in future different mechanism list could be given based on the unix socket name. --HG-- branch : HEAD

auth: Added auth failure penalty tracking based on remote IP address. --HG-- branch : HEAD

Initial commit for config rewrite. --HG-- branch : HEAD

auth: Code cleanup for specifying what passdb features auth mechanisms need. --HG-- branch : HEAD

Changed .h ifdef/defines to use <NAME>_H format. --HG-- branch : HEAD

Further const'ification of struct mech_module. --HG-- branch : HEAD

Constify struct mech_module. --HG-- branch : HEAD

Added auth_request_set_credentials() to modify credentials in passdb and implemented it for SQL passdb. Added passdb_need_set_credentials boolean to mechanisms to indicate that it's required (OTP will need it). Patch by Andrey Panin. --HG-- branch : HEAD

Added mech_generic_auth_internal() and mech_generic_auth_free() functions and used them wherever possible to reduce code duplication. Patch by Andrey Panin. --HG-- branch : HEAD

Removed need_passdb from mechanism definitions. passdb_need_plain/credentials is enough to know that. Also give a better error message if no passdbs are set and a mechanism requires passdb. --HG-- branch : HEAD

Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by pod@herald.ox.ac.uk --HG-- branch : HEAD

Changed the way multiple auth processes are handled. It no longer uses a pid appended to socket name but instead there's a balancer process which proxies the requests to worker processes. --HG-- branch : HEAD

Another try with API cleanup. --HG-- branch : HEAD

API cleanup --HG-- branch : HEAD

Reorganized the code to have less global/static variables. --HG-- branch : HEAD

Split auth_request* functions from mech.c to auth-request.c --HG-- branch : HEAD

Make FAIL reply contain "temp" parameter if the authentication failed because of temporary internal error. Also cleaned up the auth code a bit. --HG-- branch : HEAD

When master looked for auth request, it didn't check if the authentication was yet finished, so auth client could have fooled master by beginning authentication without finishing it. Login processes didn't allow users to do this though, so no real problem. --HG-- branch : HEAD

Requests in failed response queue could still be found from request queue and destroyed again. This made it possible to crash dovecot-auth by sending more authentication data than was expected. --HG-- branch : HEAD

Added simple LRU cache for auth requests. Currently only for sql passdb. --HG-- branch : HEAD

s/protocol/service/ in authentication --HG-- branch : HEAD

Added IMAP and POP3 proxying support. --HG-- branch : HEAD

Authentication OK and FAIL replies can now contain extra fields from passdb. Implemented this for sql passdb. Special fields are "nologin" (user can't actually login) and "nodelay" (don't delay failure replies). --HG-- branch : HEAD

Changed dovecot-auth protocol to ASCII based. Should be easier now to write replacement server if needed by someone. Also cleaned up/made more consistent auth code. The new code could still use some cleaning though.. --HG-- branch : HEAD

Removed Cyrus SASL code completely. It hasn't worked for ages (if ever?) and there's not much point in having it anyway. --HG-- branch : HEAD

Changed "invalid username" error message. --HG-- branch : HEAD

Added auth_username_translation setting. --HG-- branch : HEAD

Delay reporting failed authentications --HG-- branch : HEAD

Logging changes. Make sure we don't write control characters to log and also log IP address. --HG-- branch : HEAD

Added %l, %r and %P variables and mail_log_prefix setting. --HG-- branch : HEAD

Removed hardcoded mechanism lists. It's now possible to add them dynamically. Added support for SASL initial response. --HG-- branch : HEAD

Don't use hardcoded protocol list for auth process, string is just fine. --HG-- branch : HEAD

Fixed var_expand() to take a table of variables rather than a few predefined ones. Added support for modifiers. --HG-- branch : HEAD

Added ssl_require_client_cert auth-specific setting. Hide ssl_verify_client_cert from default config file as it's automatically set if needed and there's not much point in forcing it. --HG-- branch : HEAD

fixes --HG-- branch : HEAD

Fixed crash if login process connection died while there were some auth requests. --HG-- branch : HEAD

Moved client side code for auth process handling to lib-auth. Some other login process cleanups. --HG-- branch : HEAD

Added support for ANONYMOUS SASL mechanism. --HG-- branch : HEAD

Moved auth_username_chars from db-pgsql to generic for all. Some other auth code cleanups. --HG-- branch : HEAD

Added auth_default_realm (based on patch by Kristian Hoffmann) --HG-- branch : HEAD

Added default_pass_scheme to LDAP. Support for more password schemes. Merged password checking code with LDAP and passwd-file, so both support the same schemes now. --HG-- branch : HEAD

auth: kill login connection if it leaves requests hanging too long. --HG-- branch : HEAD

more fixes --HG-- branch : HEAD

auth process fixes, LDAP seems to be working (with the kludge define or fixed libldap) --HG-- branch : HEAD

Async userdb and passdb interface. --HG-- branch : HEAD

We have now separate "userdb" and "passdb". They aren't tied to each others in any way, so it's possible to use whatever user database with whatever password database. Added "static" userdb, which uses same uid/gid for everyone and generates home directory from given template. This could be useful with PAM, although insecure since everyone uses same uid. Not too well tested, and userdb/passdb API still needs to be changed to asynchronous for sql/ldap/etc lookups. --HG-- branch : HEAD