auth_ds – Datasource based SMTP Authentication

auth_ds {
  Scheme "ecauth" {
    Authenticate {
      ...
      # this scheme returns a password in the column named "password"
      password_column = "password"
      returns_password = "true"
    }
  }
}

auth_ds {
  Scheme "auth" {
    Authenticate {
      query = "SELECT password FROM webconsole.users WHERE username = :user"
      cache = "auth"
      map = [
        user = "%{username}"
      ]
      type = "md5"
      returns_password = "true"
      password_column = "password"
    }
    QueryGroups {
      query = "SELECT groupname FROM webconsole.groupassignments WHERE username = :user"
      cache = "auth"
      group_column = "groupname"
      map = [
        user = "%{username}"
      ]
    }
    EnumGroups {
      query = "SELECT role from webconsole.roles"
      cache = "auth"
      group_column = "role"
    }
  }
}

cache

Datasource cache to execute the query against.

EnumGroups

Stanza enumerates all possible groups or roles.

EnumGroups stanzas can be used to plug in to an external authentication system defined in an Authorization stanza. For example, the EnumGroup stanza allows you to interrogate the groups and then present those in a list for assigning permissions via an Authorization stanza. See authorization.

map

Parameter expansion map to use.

query

Query to be executed.

QueryGroups

All the groups associated with the user.

QueryGroups stanzas can be used to plug in to an external authentication system defined in an Authorization stanza. See authorization.

returns_password

Whether or not the query returns a password for validation inside the module or simply a truth value, for validation inside the DB.

type

Encryption type for passwords in the data store. Enabled this by setting the type parameter within the ecauth block. If this is unspecified, you can extract this from the data store as well using the type_column option.

The type option can take the values "ucrypt" and "md5" specifying Unix style and digest md5 style respectively.

type_column

Column name containing the encryption type for a given password. This corresponds with the type_map option.

type_map

Dictionary that maps a column to an encryption type.

Type maps contain key-value pairs where the key is the contents of the column identified by the type_column option and the value is one of the following:

• clear – Cleartext

• digest-md5 – Digest-MD5 encryption

• hmac_md5 – HMAC MD5 encryption

• md5 – MD5 encryption

• md5_base64 – MD5 encryption (base64 representation)

• md5_hex – MD5 encryption (hex representation)

• rfc2307 – RFC 2307 encryption specifiers (crypt, md5, smd5, sha, ssha)

• sha1_base64 – SHA1 encryption (base64 representation)

• sha1_hex – SHA1 encryption (hex representation)

• smd5 – Seeded MD5 encryption

• ssha1 – Seeded SHA1 encryption

• ucrypt – Unix crypt

crypt

Describes the level of crypto in use. Valid values are clear (for LOGIN), md5, hmac_md5 (for CRAM-MD5) or digest-md5 (for DIGEST-MD5).

nonce

nonce for MD5 based authenticators

password

The password may be cleartext, or it may have some level of crypto applied to it, according to the crypt parameter.

realm , digest-uri

Parameters for DIGEST-MD5 based auth

uri

uri specified in the listener configuration

username

Username

# Define a cache named authdb
# that talks to a mysql server
Datasource "authdb" {
  uri = ( "mysql:host=localhost;port=3306;dbname=ecauth;user=root;password=password" )
}

# Load the authentication module
auth_ds {
  # register "mysqlauth" as an authentication scheme
  # this is referenced by the ESMTP_Listener below.
  Scheme "mysqlauth" {
    Authenticate {
      # This query will return a row containing the value 1 if
      # the username and password match up
        query = "SELECT 1 AS ALLOW FROM users WHERE user_name = :user and
          password = encrypt(:pass, PASSWORD)"
      # The query will be presented against the MySQL cache
      cache = "authdb"
      # This map is used to resolve the placeholders in the query by substituting
      # the username and password supplied by the user.

      map = [
        user = "%{username}"
        pass = "%{password}"
      ]
    }
  }
}

ESMTP_Listener {
  Listen ":25" {
    SMTP_Extensions = (
      "ENHANCEDSTATUSCODES"
      "STARTTLS"
      "AUTH LOGIN"
    )
    AuthLoginParameters = [uri = "mysqlauth://"]
    SMTP_Extensions = ( "ENHANCEDSTATUSCODES" "AUTH LOGIN" )
  }
}

auth_ds {
  Scheme "myscheme_openwave" {
    Authenticate {
      query = "ldap:///?mailpassword,mailpasswordtype?sub? »
              (|(maillogin=$user)(mail=$user)(mailalternateaddress=$user))"
      cache = "openwave_directory"
      returns_password = "true"
      password_column = "mailpassword"
      type_column = "mailpasswordtype"
      map = [
        user = "%{username}"
      ]
      type_map = [
        C = "clear"
        U = "ucrypt"
        H = "sha1_hex"
        S = "ssha1"
        M = "smd5"
      ]
    }
  }
}

auth_ds {
  Scheme "ldapauthscheme" {
    Authenticate {
      query = "ldap://ldaphostname/????bindname=uid=$user%2Cou=people »
              %2Cdc=example%2Cdc=com,x-bindpw=$pass"
      cache = "ldapauth"
      map =  [
        user = "%{username}"
        pass = "%{password}"
      ]
    }
  }
}