auth: Add username_filter for passdb block username_filter lets you specify one or more pattern(s) for including or excluding users. exclusion patterns are denoted with ! prefix. if any exclude matches the username, passdb will be skipped. if any inclusions is specified, and the username does not match one of them, passdb will be skipped.

auth: Add mechanism filter for passdbs

auth: Code cleanup - Return void in passdb.set_credentials() It's an asynchronous function, so the result will be in the callback parameters.

auth: remove #define default_cache_key cache_key

auth: Skip authentication with noauthenticate

[LEN] to [static LEN] on some function parameters Also add STATIC_ARRAY macro to hide it in c++ compilation.

auth: Moved all passdb/userdb template handling to auth_passdb/userdb. This is because passdb_find() and userdb_find() attempts to avoid duplicating passdbs and userdbs when they have identical driver+args. This deduplication is useful when using multiple protocol { .. } blocks that duplicate some passdb/userdb backends. For example we might want to have only a single SQL connection regardless of how the protocol-specific passdbs and userdbs are being set up. All the default/override_fields and result_* settings aren't relevant to the passdb/userdb backends, so removing them will again allow the deduplication to work correctly.

auth: Moved cache_key from passdb_module to auth_passdb. This is in preparation for the next changeset, which moves default/override_fields also to auth_passdb.

auth: Added default_fields and override_fields settings to all passdbs and userdbs.

auth worker: Verify that both client and server see the same passdb/userdb IDs. --HG-- branch : HEAD

auth: Initial support for per-protocol auth settings. Currently the list of services is hard-coded. This should be changed so that config lookup returns the service names. --HG-- branch : HEAD

auth: Store args in passdb/userdb_module, so init() doesn't need it as parameter. --HG-- branch : HEAD

auth: Completely removed struct auth_*db from *db.c --HG-- branch : HEAD

auth: passdb/userdb backends no longer know about struct auth_passdb/auth_userdb. --HG-- branch : HEAD

auth: Cleaned up struct auth_passdb/auth_userdb. --HG-- branch : HEAD

auth: Added auth failure penalty tracking based on remote IP address. --HG-- branch : HEAD

Initial commit for config rewrite. --HG-- branch : HEAD

Changed .h ifdef/defines to use <NAME>_H format. --HG-- branch : HEAD

Changed set_credentials() callback to take a bool success instead of enum passdb_result. --HG-- branch : HEAD

Added pass/userdb_register_module() functions and used them to register the build-in functions instead of having a predefined array. --HG-- branch : HEAD

All password schemes can now be encoded with base64 or hex. The encoding is ".b64", ".base64" or ".hex" suffix in the scheme, eg. {plain.b64}. Password scheme verification function can now be set to NULL, in which case the verification is done by generating a new crypted password from given plaintext password and comparing it. --HG-- branch : HEAD

Removed enum passdb_credentials. Use scheme strings directly instead. This makes it possible to implement new mechanisms in plugins. --HG-- branch : HEAD

Reverted accidental commit. This code isn't ready yet. --HG-- branch : HEAD

Moved all storage destruction code to mail-storage.c and made destroy() optional. Removed set_callbacks(). Made autodetect() optional. --HG-- branch : HEAD

Changed the default naming for password schemes: HMAC-MD5 -> CRAM-MD5. MD5 -> MD5-CRYPT. The old names still work for backwards compatibility. --HG-- branch : HEAD

Added OTP and S/KEY authentication mechanisms. Patch by Andrey Panin. --HG-- branch : HEAD

Added auth_request_set_credentials() to modify credentials in passdb and implemented it for SQL passdb. Added passdb_need_set_credentials boolean to mechanisms to indicate that it's required (OTP will need it). Patch by Andrey Panin. --HG-- branch : HEAD

If password is expired, give "Password expired" error. Currently works only with PAM. Also added "unknown user" PAM return value handling. --HG-- branch : HEAD

And one more comma removal --HG-- branch : HEAD

Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. --HG-- branch : HEAD

Added "bool" type and changed all ints that were used as booleans to bool. --HG-- branch : HEAD

Added authentication bind support. Patch by J.M. Maurer. Also cleaned up the LDAP code a bit and made it possible for passdbs to disable lookup_credentials in runtime. --HG-- branch : HEAD

Separated passdb_module's interface and the actual data struct. Now it's possible to have multiple passdbs of same type but with different settings. --HG-- branch : HEAD

Fixes and cleanups to credentials handling. Also fixed auth caching to work more correctly in case of internal failures. --HG-- branch : HEAD

Added deny password databases. --HG-- branch : HEAD

s/occured/occurred/ --HG-- branch : HEAD

Non-plaintext blocking passdb authentication wasn't working. Patch by Andrey Panin. --HG-- branch : HEAD

Replaced userdb/passdb settings with blocks so it's possible to give multiple ones. Plaintext password mechanisms now support handling multiple passdbs, but others don't yet. Also fixed a few memory leaks. --HG-- branch : HEAD

Restructuring of auth code. Balancer auth processes were a bad idea. Usually the balancer itself took as much CPU as the actual workers because it acted as a proxy. Now auth worker means different thing: they're used to execute blocking passdb and userdb queries. Currently just MySQL (PAM and checkpassword in TODO). --HG-- branch : HEAD

Moved cache handling from sql/ldap-specific code to generic auth-request code. Did some small optimizations on the way. --HG-- branch : HEAD

Cleanups. --HG-- branch : HEAD

Moved extern userdb/passdb declarations to .c files. --HG-- branch : HEAD

Reorganized the code to have less global/static variables. --HG-- branch : HEAD

Make FAIL reply contain "temp" parameter if the authentication failed because of temporary internal error. Also cleaned up the auth code a bit. --HG-- branch : HEAD

Added name variable for userdb_module and passdb_module and changed their initialization a bit. --HG-- branch : HEAD

Added simple LRU cache for auth requests. Currently only for sql passdb. --HG-- branch : HEAD

Created generic asynchronous SQL API and implemented MySQL and PostgreSQL drivers. MySQL is implemented synchronously because it's API doesn't provide async way to do it. Replaced pgsql and mysql userdb/passdb with generic sql userdb/passdb. --HG-- branch : HEAD

Added preinit() call to userdb/passdbs, which is called before dropping privileges. init() is called after. SQL/LDAP now parses the config file in preinit, but does the actual connecting only in init(). This fixes LDAP crashing at startup. --HG-- branch : HEAD

Added Compuserve RPA authentication. Patch by Andrey Panin. --HG-- branch : HEAD

Added LANMAN password scheme. Patch by Andrey Panin --HG-- branch : HEAD

NTLM authentication. Patch by Andrey Panin --HG-- branch : HEAD

Added checkpassword passdb. userdb has only beginnings. --HG-- branch : HEAD

MySQL authentication patch by Matther Reimer --HG-- branch : HEAD

CRAM-MD5 mechanism by Joshua Goodall, plus some cleanups. --HG-- branch : HEAD

Added bsdauth support, patch by Dan Cross --HG-- branch : HEAD

Added PostgreSQL support, patch by Alex Howansky --HG-- branch : HEAD

Added default_pass_scheme to LDAP. Support for more password schemes. Merged password checking code with LDAP and passwd-file, so both support the same schemes now. --HG-- branch : HEAD

passdb ldap added. fixes to userdb ldap. --HG-- branch : HEAD

auth process fixes, LDAP seems to be working (with the kludge define or fixed libldap) --HG-- branch : HEAD

Async userdb and passdb interface. --HG-- branch : HEAD

We have now separate "userdb" and "passdb". They aren't tied to each others in any way, so it's possible to use whatever user database with whatever password database. Added "static" userdb, which uses same uid/gid for everyone and generates home directory from given template. This could be useful with PAM, although insecure since everyone uses same uid. Not too well tested, and userdb/passdb API still needs to be changed to asynchronous for sql/ldap/etc lookups. --HG-- branch : HEAD