Mercurial > hg > nginx

comparison src/mail/ngx_mail_pop3_handler.c @ 9290:4538c1ffb0f8

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Mail: added support for XOAUTH2 and OAUTHBEARER authentication. This patch adds support for the OAUTHBEARER SASL mechanism as defined by RFC 7628, as well as pre-RFC XOAUTH2 SASL mechanism. For both mechanisms, the "Auth-User" header is set to the client identity obtained from the initial SASL response sent by the client, and the "Auth-Pass" header is set to the Bearer token itself. The auth server may return the "Auth-Error-SASL" header, which is passed to the client as an additional SASL challenge. It is expected to contain mechanism-specific error details, base64-encoded. After the client responds (with an empty SASL response for XAUTH2, or with "AQ==" dummy response for OAUTHBEARER), the error message from the "Auth-Status" header is sent. Based on a patch by Rob Mueller.
author Maxim Dounin <mdounin@mdounin.ru>
date Mon, 03 Jun 2024 18:03:11 +0300
parents 32d4582c484d
children
comparison
equal deleted inserted replaced
9289:20017bff0de8 9290:4538c1ffb0f8
258 break; 258 break;
259 259
260 case ngx_pop3_auth_external: 260 case ngx_pop3_auth_external:
261 rc = ngx_mail_auth_external(s, c, 0); 261 rc = ngx_mail_auth_external(s, c, 0);
262 break; 262 break;
263
264 case ngx_pop3_auth_xoauth2:
265 rc = ngx_mail_auth_xoauth2(s, c, 0);
266 break;
267
268 case ngx_pop3_auth_oauthbearer:
269 rc = ngx_mail_auth_oauthbearer(s, c, 0);
270 break;
263 } 271 }
264 } 272 }
265 273
266 if (s->buffer->pos < s->buffer->last || c->read->ready) { 274 if (s->buffer->pos < s->buffer->last || c->read->ready) {
267 s->blocked = 1; 275 s->blocked = 1;
551 559
552 ngx_str_set(&s->out, pop3_username); 560 ngx_str_set(&s->out, pop3_username);
553 s->mail_state = ngx_pop3_auth_external; 561 s->mail_state = ngx_pop3_auth_external;
554 562
555 return NGX_OK; 563 return NGX_OK;
564
565 case NGX_MAIL_AUTH_XOAUTH2:
566
567 if (!(pscf->auth_methods & NGX_MAIL_AUTH_XOAUTH2_ENABLED)) {
568 return NGX_MAIL_PARSE_INVALID_COMMAND;
569 }
570
571 if (s->args.nelts == 2) {
572 s->mail_state = ngx_pop3_auth_xoauth2;
573 return ngx_mail_auth_xoauth2(s, c, 1);
574 }
575
576 ngx_str_set(&s->out, pop3_next);
577 s->mail_state = ngx_pop3_auth_xoauth2;
578
579 return NGX_OK;
580
581 case NGX_MAIL_AUTH_OAUTHBEARER:
582
583 if (!(pscf->auth_methods & NGX_MAIL_AUTH_OAUTHBEARER_ENABLED)) {
584 return NGX_MAIL_PARSE_INVALID_COMMAND;
585 }
586
587 if (s->args.nelts == 2) {
588 s->mail_state = ngx_pop3_auth_oauthbearer;
589 return ngx_mail_auth_oauthbearer(s, c, 1);
590 }
591
592 ngx_str_set(&s->out, pop3_next);
593 s->mail_state = ngx_pop3_auth_oauthbearer;
594
595 return NGX_OK;
556 } 596 }
557 597
558 return rc; 598 return rc;
559 } 599 }