6.0.0-beta1
7/16/25

[#12255] SMTP authentication broken
Summary SMTP authentication broken
Queue IMP
Queue Version 6.1.0beta2
Type Bug
State Not A Bug
Priority 1. Low
Owners
Requester arjen+horde (at) de-korte (dot) org
Created 05/15/2013 (4445 days ago)
Due
Updated 06/24/2013 (4405 days ago)
Assigned 05/16/2013 (4444 days ago)
Resolved 05/18/2013 (4442 days ago)
Github Issue Link
Github Pull Request
Milestone
Patch No

History
06/24/2013 03:06:04 AM busywater (at) gmail (dot) com Comment #12 Reply to this comment

[Show Quoted Text - 22 lines]
I confirmed the above setting is working while if using SMTP on SSL of 
port 465.  The following setting must be used instead:

$conf[mailer][params]['host'] = 'ssl://mail.domain.comg';
$conf[mailer][params]['port'] = 465;
$conf[mailer][params]['auth'] = true;
05/23/2013 02:33:54 AM lfbm (dot) andamentos (at) gmail (dot) com Comment #11 Reply to this comment
I can confirm 'horde_auth' parameter in 'smtp' works (horde 5.1.0-git; 
imp 6.1.0-git):

$servers['imap'] = array(
     'disabled' => false,
     'name' => 'IMAP Server',
     'hostspec' => 'localhost',
     'hordeauth' => false,
     'protocol' => 'imap',
     'port' => 143,
     'secure' => 'tls',
     'smtp' => array(
        'horde_auth' => true,
      ),
);

horde/config/conf.php:

$conf['mailer']['params']['host'] = 'smtp.gmail.com';
$conf['mailer']['params']['port'] = 587;
$conf['mailer']['params']['auth'] = true;
$conf['mailer']['type'] = 'smtp';
05/18/2013 09:12:38 PM Michael Slusarz Comment #10 Reply to this comment
Turns out there was a limitation in IMP where you could either use no 
authentication or IMP authentication, but not Horde authentication.   
(Although generally Horde auth == IMP auth, this is not a 
requirement).  So it's possible the changes I just made to Horde_Core 
and IMP will fix for you.
05/18/2013 08:29:36 PM arjen+horde (at) de-korte (dot) org Comment #9 Reply to this comment
Proof from the mail headers:

Received: from localhost (localhost.localdomain [127.0.0.1])
        (Authenticated sender: slusarz)
        by bigworm.curecanti.org (Postfix) with ESMTPSA id 37A6E7022
        for <slusarz+test@curecanti.org>; Sat, 18 May 2013 14:09:39 -0600 (MDT)
[snip]
User-Agent: Internet Messaging Program (IMP) H5 (6.1.0-git)
This bug report is for IMP-6.1.0beta2, your headers show you're using 
IMP-6.1.0-git. Could it be there is a difference between the versions 
from PEAR and Git? Not neccessarily in IMP, but maybe in some other 
module?
05/18/2013 08:22:15 PM Michael Slusarz Comment #8 Reply to this comment
There is no smtp array in 'imp/config/backends.local.php'. This has 
worked since I started using Horde (about three years ago) and uses 
the credentials used for authentication to Horde for SMTP 
authentication. Since the upgrade to the latest beta versions, this 
no longer works.
This is *exactly* my setup.  My SMTP server requires authentication.   
I can verify that IMP uses the Horde authentication credentials to 
login to the SMTP server.  I have no 'smtp' config in IMP's 
backends.php.

My Horde SMTP configuration looks like this:

$conf['mailer']['params']['host'] = 'localhost';
$conf['mailer']['params']['port'] = 25;
$conf['mailer']['params']['localhost'] = 'localhost';
$conf['mailer']['params']['auth'] = true;
$conf['mailer']['type'] = 'smtp';


In IMP's IMP_Factory_Mail, I can verify the following as the 
configuration (the $params variable):

Array
(
     [host] => localhost
     [port] => 25
     [localhost] => localhost
     [auth] => 1
     [username] => XXX
     [password] => YYY
)

I can also verify that these credentials are correctly being set in 
the SMTP object:

Horde_Mail_Transport_Smtp Object
(
     [greeting] =>
     [queuedAs] =>
     [_smtp:protected] =>
     [_extparams:protected] => Array
         (
         )

     [sep] =>

     [_params:protected] => Array
         (
             [auth] => 1
             [debug] =>
             [host] => localhost
             [localhost] => localhost
             [password] => YYY
             [persist] =>
             [pipelining] =>
             [port] => 25
             [timeout] =>
             [username] => XXX
         )

)

Proof from the mail headers:

Received: from localhost (localhost.localdomain [127.0.0.1])
        (Authenticated sender: slusarz)
        by bigworm.curecanti.org (Postfix) with ESMTPSA id 37A6E7022
        for <slusarz+test@curecanti.org>; Sat, 18 May 2013 14:09:39 -0600 (MDT)
[snip]
User-Agent: Internet Messaging Program (IMP) H5 (6.1.0-git)
05/18/2013 07:59:04 PM arjen+horde (at) de-korte (dot) org Comment #7 Reply to this comment

[Show Quoted Text - 13 lines]
OK, I'm officially lost now.

In Horde-5.0.4 I have the following in 'config/conf.php':

$conf['mailer']['params']['port'] = 587;
$conf['mailer']['params']['auth'] = true;
$conf['mailer']['type'] = 'smtp';

There is no smtp array in 'imp/config/backends.local.php'. This has 
worked since I started using Horde (about three years ago) and uses 
the credentials used for authentication to Horde for SMTP 
authentication. Since the upgrade to the latest beta versions, this no 
longer works.

What am I supposed to do if I want to use the credentials for logging 
into Horde for SMTP authentication? Is the configuration in the Mailer 
tab supposed to work? If yes, this bug is still open because it no 
longer works. If no, this needs to be documented in the changelist, 
since this is a BC break.

I *only* added the following in 'imp/config/backends.local.php' to 
work around this.

     'smtp' => array(
         'auth' => true,
         'password' => null,
         'port' => 587,
         'username' => null
     ),

The above will use SMTP authentication for sending messages with the 
credentials for logging into Horde. Is this *not* supposed to work? If 
not, how should one configure using per-user SMTP authentication for 
sending messages instead?
05/18/2013 07:24:06 PM Michael Slusarz Comment #6
State ⇒ Not A Bug
Reply to this comment
OK - verified that this works.  Still needs to be documented in 
horde/conf.xml (this is clearly documented in IMP's backends.php), as 
my confusion over this feature clearly indicates.  And this DOES work 
for all authentication backends.
If the same information from the Mailer tab is entered in 
'imp/config/backends.local.php' with 'username' and 'password' both 
null, authentication succeeds, so it looks like there is a problem 
with initialization the settings from the Mailer tab.
That's why.  Don't set 'username' and 'password' in IMP, because those 
strings are used as the authentication strings.  If you want to use 
the Horde defaults, don't define those strings at all.
05/18/2013 07:13:46 PM Michael Slusarz Comment #5 Reply to this comment

[Show Quoted Text - 12 lines]
Totally irrelevant.  We should never be in the business of  "assuming" 
that's what an admin wants.  You could very well "assume" that they 
used SMTP authentication simply because it is dirt easy to setup.  But 
I don't see how this has any connection to SMTP *sending* 
configuration unless and until they make it so.

Not to mention that it also potentially makes sense to allow *any* 
authentication credentials to be used as the SMTP authentication.  Why 
is SMTP special?
And it's worked this way since ever.
If so, this is totally news to me.  Especially since there is no 
documentation about this in the config file (any mention of this 
buried deep within a wiki entry is definitely not canon).

I don't object to adding this - or at a minimum clearly documenting 
the behavior in the conf.php file.  But as mentioned above, this has 
absolutely nothing to do with Horde SMTP authentication.  This needs 
to work independent of the Horde authentication backend.
05/17/2013 10:34:46 AM Jan Schneider Comment #4 Reply to this comment
Which makes sense.  Imagine a scenario where you authenticate to a
SMTP server for Horde authentication, but don't need any
authentication for SMTP mailing.  If you automatically populate this
field with authentication credentials, as you suggest, this is not
possible.
The above makes zero sense to me. Why would anyone bother to setup 
authentication on a SMTP server, but not require it for relaying mail?
Agreed. If people don't want to use authentication, they don't have 
to. If they need per-user authentication for SMTP, using the current 
authentication credentials is the only thing that makes sense. And 
it's worked this way since ever.
05/16/2013 09:00:08 PM arjen+horde (at) de-korte (dot) org Comment #3 Reply to this comment
I don't agree with this.  We don't do this with ANY other 
authentication driver (e.g., if using imap authentication we don't 
use these credentials for any other reason except authentication).   
Authentication setup should be completely separate from mailer setup.
Straight from the Wiki:

Can IMP be used with SMTP authentication?

Horde and IMP can support SMTP authentication, but only if the SMTP 
server take the same authentication credentials as the POP/IMAP server 
(which would generally be the case) or the same set of credentials for 
ever user. Simply edit the Horde configuration as per the comments in 
the Mailer tab of the setup interface.

So far (Horde-5.0.4 and earlier) this has worked fine. If you enter 
'username' and 'password', these will be used for all users, if you 
leave them blank, the credentials used for logging in will be used.

But as I wrote before, this will still work in IMP-6.1.0beta, but this 
now requires setting up the 'smtp' array in 
'imp/config/backends.local.php'. I asked on the mailinglist if this 
was the new/preferred way of doing this, but Jan replied the above 
method should still work and this was a bug. Therefor I submitted this 
report. Feel free to close this bug report if you think otherwise, 
since what I intend to do still works, but requires now a different 
way of configuring it.
Which makes sense.  Imagine a scenario where you authenticate to a 
SMTP server for Horde authentication, but don't need any 
authentication for SMTP mailing.  If you automatically populate this 
field with authentication credentials, as you suggest, this is not 
possible.
The above makes zero sense to me. Why would anyone bother to setup 
authentication on a SMTP server, but not require it for relaying mail?
05/16/2013 08:40:50 PM Michael Slusarz Comment #2
State ⇒ Feedback
Reply to this comment
I don't agree with this.  We don't do this with ANY other 
authentication driver (e.g., if using imap authentication we don't use 
these credentials for any other reason except authentication).   
Authentication setup should be completely separate from mailer setup.

Which makes sense.  Imagine a scenario where you authenticate to a 
SMTP server for Horde authentication, but don't need any 
authentication for SMTP mailing.  If you automatically populate this 
field with authentication credentials, as you suggest, this is not 
possible.
05/15/2013 09:14:48 AM arjen+horde (at) de-korte (dot) org Comment #1
State ⇒ Unconfirmed
Patch ⇒ No
Milestone ⇒
Queue ⇒ IMP
Summary ⇒ SMTP authentication broken
Type ⇒ Bug
Priority ⇒ 1. Low
Reply to this comment
When SMTP authentication is enabled in the Mailer tab from the Horde 
configuration screen and $conf[mailer][params][username] and 
$conf[mailer][params][password] are left blank, the credentials used 
for logging in should be used to SMTP authenticate. However, no 
credentials (empty) are passed to the SMTP server. As a consequence, 
authentication fails.

If the same information from the Mailer tab is entered in 
'imp/config/backends.local.php' with 'username' and 'password' both 
null, authentication succeeds, so it looks like there is a problem 
with initialization the settings from the Mailer tab.

Saved Queries