Re: Sending SSL/TLS state to Dovecot auth

2009-05-06 Thread Timo Sirainen
On Thu, 2009-04-16 at 20:53 -0400, Wietse Venema wrote: > Postfix 2.6 will pass the "TLS is active flag". I have changed the > API so that we no longer need to make code changes in every SASL > plugin when another attribute is added. It works with smtps but doesn't work with STARTTLS, because tls_

Re: Sending SSL/TLS state to Dovecot auth

2009-04-16 Thread Wietse Venema
Postfix 2.6 will pass the "TLS is active flag". I have changed the API so that we no longer need to make code changes in every SASL plugin when another attribute is added. Wietse On Mon, Feb 23, 2009 at 02:18:01PM -0500, Timo Sirainen wrote: > In some setups it's useful for authentication

Re: Sending SSL/TLS state to Dovecot auth

2009-02-23 Thread Victor Duchovni
On Mon, Feb 23, 2009 at 05:40:05PM -0500, Timo Sirainen wrote: > It's too late for a few times (until user fixes the client > configuration), but not forever (because it won't work until the > configuration is fixed). Also with a laptop the initial setup is often > done in a relatively safe locati

Re: Sending SSL/TLS state to Dovecot auth

2009-02-23 Thread Timo Sirainen
Mon, 2009-02-23 at 17:11 -0500, Wietse Venema wrote: > Timo Sirainen: > > On Mon, 2009-02-23 at 16:49 -0500, Wietse Venema wrote: > > > > It's basically the same thing as "disable plaintext authentication", > > > > except on a per-user (or per-domain, or per-source-IP-range) basis > > > > rather t

Re: Sending SSL/TLS state to Dovecot auth

2009-02-23 Thread Wietse Venema
Timo Sirainen: > On Mon, 2009-02-23 at 16:49 -0500, Wietse Venema wrote: > > > It's basically the same thing as "disable plaintext authentication", > > > except on a per-user (or per-domain, or per-source-IP-range) basis > > > rather than globally. There are probably some other use cases that I've

Re: Sending SSL/TLS state to Dovecot auth

2009-02-23 Thread Timo Sirainen
On Mon, 2009-02-23 at 16:49 -0500, Wietse Venema wrote: > > It's basically the same thing as "disable plaintext authentication", > > except on a per-user (or per-domain, or per-source-IP-range) basis > > rather than globally. There are probably some other use cases that I've > > heard before but ca

Re: Sending SSL/TLS state to Dovecot auth

2009-02-23 Thread Wietse Venema
Timo Sirainen: > On Mon, 2009-02-23 at 14:32 -0500, Victor Duchovni wrote: > > On Mon, Feb 23, 2009 at 02:18:01PM -0500, Timo Sirainen wrote: > > > > > In some setups it's useful for authentication handling to know if the > > > connection is SSL/TLS secured. The patch below should tell this to > >

Re: Sending SSL/TLS state to Dovecot auth

2009-02-23 Thread Timo Sirainen
On Mon, 2009-02-23 at 14:32 -0500, Victor Duchovni wrote: > On Mon, Feb 23, 2009 at 02:18:01PM -0500, Timo Sirainen wrote: > > > In some setups it's useful for authentication handling to know if the > > connection is SSL/TLS secured. The patch below should tell this to > > Dovecot. It compiles, bu

Re: Sending SSL/TLS state to Dovecot auth

2009-02-23 Thread Wietse Venema
Victor Duchovni: > On Mon, Feb 23, 2009 at 02:18:01PM -0500, Timo Sirainen wrote: > > > In some setups it's useful for authentication handling to know if the > > connection is SSL/TLS secured. The patch below should tell this to > > Dovecot. It compiles, but other than that I haven't yet tested it

Re: Sending SSL/TLS state to Dovecot auth

2009-02-23 Thread Victor Duchovni
On Mon, Feb 23, 2009 at 02:18:01PM -0500, Timo Sirainen wrote: > In some setups it's useful for authentication handling to know if the > connection is SSL/TLS secured. The patch below should tell this to > Dovecot. It compiles, but other than that I haven't yet tested it. How is this useful? It s

Sending SSL/TLS state to Dovecot auth

2009-02-23 Thread Timo Sirainen
In some setups it's useful for authentication handling to know if the connection is SSL/TLS secured. The patch below should tell this to Dovecot. It compiles, but other than that I haven't yet tested it. It anyway looks like sending the SSL/TLS state requires an additional parameter to xsasl_serve