Gnous/mailcow
2
0
Fork 0
Code Issues Pull Requests 1 Packages Projects Releases Wiki Activity

Merge pull request #6488 from mailcow/fix/6470

Browse Source 
[Dovecot] Fix EAS login issue with app passwords and improve auth cache handling in Dovecot
This commit is contained in:
FreddleSpl0it 2025-05-08 11:49:55 +02:00 committed by GitHub
commit db7b917944
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 17 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
data/conf/dovecot/auth/mailcowauth.php
View File

@ -79,7 +79,9 @@ if ($isSOGoRequest) {
} }
} }
if ($result === false){ if ($result === false){
$result = apppass_login($post['username'], $post['password'], array($post['service'] => true), array( // If it's a SOGo Request, don't check for protocol access
$service = ($isSOGoRequest) ? false : array($post['service'] => true);
$result = apppass_login($post['username'], $post['password'], $service, array(
'is_internal' => true, 'is_internal' => true,
'remote_addr' => $post['real_rip'] 'remote_addr' => $post['real_rip']
)); ));

18
data/conf/dovecot/auth/passwd-verify.lua
View File

@ -29,13 +29,23 @@ function auth_password_verify(request, password)
insecure = true insecure = true
} }
if c ~= 200 then -- Returning PASSDB_RESULT_PASSWORD_MISMATCH will reset the user's auth cache entry.
-- Returning PASSDB_RESULT_INTERNAL_FAILURE keeps the existing cache entry,
-- even if the TTL has expired. Useful to avoid cache eviction during backend issues.
if c ~= 200 and c ~= 401 then
dovecot.i_info("HTTP request failed with " .. c .. " for user " .. request.user) dovecot.i_info("HTTP request failed with " .. c .. " for user " .. request.user)
return dovecot.auth.PASSDB_RESULT_INTERNAL_FAILURE, "Upstream error" return dovecot.auth.PASSDB_RESULT_PASSWORD_MISMATCH, "Upstream error"
end end
local api_response = json.decode(table.concat(res)) local response_str = table.concat(res)
if api_response.success == true then local is_response_valid, response_json = pcall(json.decode, response_str)
if not is_response_valid then
dovecot.i_info("Invalid JSON received: " .. response_str)
return dovecot.auth.PASSDB_RESULT_PASSWORD_MISMATCH, "Invalid response format"
end
if response_json.success == true then
return dovecot.auth.PASSDB_RESULT_OK, "" return dovecot.auth.PASSDB_RESULT_OK, ""
end end