6.0.0-beta1
7/4/25

[#9211] Bad login message
Summary Bad login message
Queue IMP
Queue Version Git master
Type Bug
State Resolved
Priority 2. Medium
Owners slusarz (at) horde (dot) org
Requester goncalo.queiros (at) portugalmail (dot) net
Created 09/01/2010 (5420 days ago)
Due
Updated 09/02/2010 (5419 days ago)
Assigned 09/02/2010 (5419 days ago)
Resolved 09/02/2010 (5419 days ago)
Github Issue Link
Github Pull Request
Milestone 5
Patch No

History
09/02/2010 05:25:33 PM Michael Slusarz Assigned to Michael Slusarz
State ⇒ Resolved
Version ⇒ Git master
Milestone ⇒ 5
 
09/02/2010 05:25:11 PM Michael Slusarz Comment #6
Priority ⇒ 2. Medium
State ⇒ Assigned
Queue ⇒ IMP
Version ⇒
Reply to this comment
#1 - You marked this ticket as a DIMP ticket.  DIMP only exists with 
H3, which uses c-client.  What I previously said is correct - dimp 1.x 
uses c-client which has very limited login error handling.
#2 - As for IMP 5.x - login error handling can be improved.  However, 
we are still very limited by the possible error messages that can be 
given.  Per RFC 3501, the reason for authentication is not specified 
(actually, it might be in the IMAP response, but odds are very high 
that this explanation is either technical in nature and/or completely 
in English).
Very recently (RFC 5530), additional response codes were defined that 
potentially give better information on failure reasons.  At this time, 
adoption of these new response codes by IMAP servers is limited 
(although I can verify that Dovecot 2.0.1 uses at least some of them). 
  So use information provided by these response codes, if given.  If 
not, we MUST default to an authentication failure message even though 
it might be a server issue (see RFC 5530[3]).

As far as translations - no Exception messages are translated (since 
1) they are not really designed to be passed to the end user and/or 2) 
we still haven't determined how to handle gettext strings in framework 
packages).
09/02/2010 01:55:21 PM goncalo (dot) queiros (at) portugalmail (dot) net Comment #3 Reply to this comment
Im not using the c-client (im using the client_socket), and as far as 
i can tell, it raises pretty correct errors when the user provides a 
wrong username/password. Can't we give a more meaningful error message 
to user when using client_socket?
If this is not changed, then i guess that Horde_Auth::REASON_FAILED 
and Horde_Auth::REASON_BADLOGIN will never be used on login.php right?
Btw, there's a bunch of Exceptions being thrown without translation 
"IMAP server denied authentication." is one of them.
09/01/2010 06:12:55 PM Michael Slusarz Comment #2
State ⇒ Not A Bug
Reply to this comment
Nope - all sorts of limitations of error reporting with c-client.   
Since c-client doesn't provide a reliable error reporting mechanism, 
we have to play it safe and provide a generic bad login message.
09/01/2010 05:11:45 PM goncalo (dot) queiros (at) portugalmail (dot) net Comment #1
State ⇒ Unconfirmed
Patch ⇒ No
Milestone ⇒
Queue ⇒ DIMP
Summary ⇒ Bad login message
Type ⇒ Bug
Priority ⇒ 1. Low
Reply to this comment
When i try to login with a bad username/password, instead of getting a 
message like "login failed" or "bad username/password" i only get a 
"IMAP server denied authentication." one. I found out that this is a 
error being thrown if the imap login is not successful.
Don't know if this is the expected behavior but looking at login.php i 
think that its Horde intention to notify the user with a more 
"friendly" message.

Saved Queries