SMTP authentication broken

When SMTP authentication is enabled in the Mailer tab from t

Wed, 15 May 2013 09:14:48 +0000

When SMTP authentication is enabled in the Mailer tab from the Horde configuration screen and $conf[mailer][params][username] and $conf[mailer][params][password] are left blank, the credentials used for logging in should be used to SMTP authenticate. However, no credentials (empty) are passed to the SMTP server. As a consequence, authentication fails. If the same information from the Mailer tab is entered in 'imp/config/backends.local.php' with 'username' and 'password' both null, authentication succeeds, so it looks like there is a problem with initialization the settings from the Mailer tab.

I don't agree with this. We don't do this with ANY other au

Thu, 16 May 2013 20:40:50 +0000

I don't agree with this. We don't do this with ANY other authentication driver (e.g., if using imap authentication we don't use these credentials for any other reason except authentication). Authentication setup should be completely separate from mailer setup. Which makes sense. Imagine a scenario where you authenticate to a SMTP server for Horde authentication, but don't need any authentication for SMTP mailing. If you automatically populate this field with authentication credentials, as you suggest, this is not possible.

> I don't agree with this. We don't do this with ANY other

Thu, 16 May 2013 21:00:08 +0000

> I don't agree with this. We don't do this with ANY other > authentication driver (e.g., if using imap authentication we don't > use these credentials for any other reason except authentication). > Authentication setup should be completely separate from mailer setup. Straight from the Wiki: Can IMP be used with SMTP authentication? Horde and IMP can support SMTP authentication, but only if the SMTP server take the same authentication credentials as the POP/IMAP server (which would generally be the case) or the same set of credentials for ever user. Simply edit the Horde configuration as per the comments in the Mailer tab of the setup interface. So far (Horde-5.0.4 and earlier) this has worked fine. If you enter 'username' and 'password', these will be used for all users, if you leave them blank, the credentials used for logging in will be used. But as I wrote before, this will still work in IMP-6.1.0beta, but this now requires setting up the 'smtp' array in 'imp/config/backends.local.php'. I asked on the mailinglist if this was the new/preferred way of doing this, but Jan replied the above method should still work and this was a bug. Therefor I submitted this report. Feel free to close this bug report if you think otherwise, since what I intend to do still works, but requires now a different way of configuring it. > Which makes sense. Imagine a scenario where you authenticate to a > SMTP server for Horde authentication, but don't need any > authentication for SMTP mailing. If you automatically populate this > field with authentication credentials, as you suggest, this is not > possible. The above makes zero sense to me. Why would anyone bother to setup authentication on a SMTP server, but not require it for relaying mail?

>> Which makes sense. Imagine a scenario where you authenti

Fri, 17 May 2013 10:34:46 +0000

>> Which makes sense. Imagine a scenario where you authenticate to a >> SMTP server for Horde authentication, but don't need any >> authentication for SMTP mailing. If you automatically populate this >> field with authentication credentials, as you suggest, this is not >> possible. > > The above makes zero sense to me. Why would anyone bother to setup > authentication on a SMTP server, but not require it for relaying mail? Agreed. If people don't want to use authentication, they don't have to. If they need per-user authentication for SMTP, using the current authentication credentials is the only thing that makes sense. And it's worked this way since ever.

>>> Which makes sense. Imagine a scenario where you authent

Sat, 18 May 2013 19:13:46 +0000

>>> Which makes sense. Imagine a scenario where you authenticate to a >>> SMTP server for Horde authentication, but don't need any >>> authentication for SMTP mailing. If you automatically populate this >>> field with authentication credentials, as you suggest, this is not >>> possible. >> >> The above makes zero sense to me. Why would anyone bother to setup >> authentication on a SMTP server, but not require it for relaying mail? > > Agreed. If people don't want to use authentication, they don't have > to. If they need per-user authentication for SMTP, using the current > authentication credentials is the only thing that makes sense. Totally irrelevant. We should never be in the business of "assuming" that's what an admin wants. You could very well "assume" that they used SMTP authentication simply because it is dirt easy to setup. But I don't see how this has any connection to SMTP *sending* configuration unless and until they make it so. Not to mention that it also potentially makes sense to allow *any* authentication credentials to be used as the SMTP authentication. Why is SMTP special? > And > it's worked this way since ever. If so, this is totally news to me. Especially since there is no documentation about this in the config file (any mention of this buried deep within a wiki entry is definitely not canon). I don't object to adding this - or at a minimum clearly documenting the behavior in the conf.php file. But as mentioned above, this has absolutely nothing to do with Horde SMTP authentication. This needs to work independent of the Horde authentication backend.

OK - verified that this works. Still needs to be documented

Sat, 18 May 2013 19:24:06 +0000

OK - verified that this works. Still needs to be documented in horde/conf.xml (this is clearly documented in IMP's backends.php), as my confusion over this feature clearly indicates. And this DOES work for all authentication backends. > If the same information from the Mailer tab is entered in > 'imp/config/backends.local.php' with 'username' and 'password' both > null, authentication succeeds, so it looks like there is a problem > with initialization the settings from the Mailer tab. That's why. Don't set 'username' and 'password' in IMP, because those strings are used as the authentication strings. If you want to use the Horde defaults, don't define those strings at all.

> OK - verified that this works. Still needs to be document

Sat, 18 May 2013 19:59:04 +0000

> OK - verified that this works. Still needs to be documented in > horde/conf.xml (this is clearly documented in IMP's backends.php), as > my confusion over this feature clearly indicates. And this DOES work > for all authentication backends. > >> If the same information from the Mailer tab is entered in >> 'imp/config/backends.local.php' with 'username' and 'password' both >> null, authentication succeeds, so it looks like there is a problem >> with initialization the settings from the Mailer tab. > > That's why. Don't set 'username' and 'password' in IMP, because > those strings are used as the authentication strings. If you want to > use the Horde defaults, don't define those strings at all. OK, I'm officially lost now. In Horde-5.0.4 I have the following in 'config/conf.php': $conf['mailer']['params']['port'] = 587; $conf['mailer']['params']['auth'] = true; $conf['mailer']['type'] = 'smtp'; There is no smtp array in 'imp/config/backends.local.php'. This has worked since I started using Horde (about three years ago) and uses the credentials used for authentication to Horde for SMTP authentication. Since the upgrade to the latest beta versions, this no longer works. What am I supposed to do if I want to use the credentials for logging into Horde for SMTP authentication? Is the configuration in the Mailer tab supposed to work? If yes, this bug is still open because it no longer works. If no, this needs to be documented in the changelist, since this is a BC break. I *only* added the following in 'imp/config/backends.local.php' to work around this. 'smtp' => array( 'auth' => true, 'password' => null, 'port' => 587, 'username' => null ), The above will use SMTP authentication for sending messages with the credentials for logging into Horde. Is this *not* supposed to work? If not, how should one configure using per-user SMTP authentication for sending messages instead?

> There is no smtp array in 'imp/config/backends.local.php'.

Sat, 18 May 2013 20:22:15 +0000

> There is no smtp array in 'imp/config/backends.local.php'. This has > worked since I started using Horde (about three years ago) and uses > the credentials used for authentication to Horde for SMTP > authentication. Since the upgrade to the latest beta versions, this > no longer works. This is *exactly* my setup. My SMTP server requires authentication. I can verify that IMP uses the Horde authentication credentials to login to the SMTP server. I have no 'smtp' config in IMP's backends.php. My Horde SMTP configuration looks like this: $conf['mailer']['params']['host'] = 'localhost'; $conf['mailer']['params']['port'] = 25; $conf['mailer']['params']['localhost'] = 'localhost'; $conf['mailer']['params']['auth'] = true; $conf['mailer']['type'] = 'smtp'; In IMP's IMP_Factory_Mail, I can verify the following as the configuration (the $params variable): Array ( [host] => localhost [port] => 25 [localhost] => localhost [auth] => 1 [username] => XXX [password] => YYY ) I can also verify that these credentials are correctly being set in the SMTP object: Horde_Mail_Transport_Smtp Object ( [greeting] => [queuedAs] => [_smtp:protected] => [_extparams:protected] => Array ( ) [sep] => [_params:protected] => Array ( [auth] => 1 [debug] => [host] => localhost [localhost] => localhost [password] => YYY [persist] => [pipelining] => [port] => 25 [timeout] => [username] => XXX ) ) Proof from the mail headers: Received: from localhost (localhost.localdomain [127.0.0.1]) (Authenticated sender: slusarz) by bigworm.curecanti.org (Postfix) with ESMTPSA id 37A6E7022 for ; Sat, 18 May 2013 14:09:39 -0600 (MDT) [snip] User-Agent: Internet Messaging Program (IMP) H5 (6.1.0-git)

> Proof from the mail headers: > > Received: from localhos

Sat, 18 May 2013 20:29:36 +0000

> Proof from the mail headers: > > Received: from localhost (localhost.localdomain [127.0.0.1]) > (Authenticated sender: slusarz) > by bigworm.curecanti.org (Postfix) with ESMTPSA id 37A6E7022 > for ; Sat, 18 May 2013 14:09:39 -0600 (MDT) > [snip] > User-Agent: Internet Messaging Program (IMP) H5 (6.1.0-git) This bug report is for IMP-6.1.0beta2, your headers show you're using IMP-6.1.0-git. Could it be there is a difference between the versions from PEAR and Git? Not neccessarily in IMP, but maybe in some other module?

Turns out there was a limitation in IMP where you could eith

Sat, 18 May 2013 21:12:38 +0000

Turns out there was a limitation in IMP where you could either use no authentication or IMP authentication, but not Horde authentication. (Although generally Horde auth == IMP auth, this is not a requirement). So it's possible the changes I just made to Horde_Core and IMP will fix for you.

I can confirm 'horde_auth' parameter in 'smtp' works (horde

Thu, 23 May 2013 02:33:54 +0000

I can confirm 'horde_auth' parameter in 'smtp' works (horde 5.1.0-git; imp 6.1.0-git): $servers['imap'] = array( 'disabled' => false, 'name' => 'IMAP Server', 'hostspec' => 'localhost', 'hordeauth' => false, 'protocol' => 'imap', 'port' => 143, 'secure' => 'tls', 'smtp' => array( 'horde_auth' => true, ), ); horde/config/conf.php: $conf['mailer']['params']['host'] = 'smtp.gmail.com'; $conf['mailer']['params']['port'] = 587; $conf['mailer']['params']['auth'] = true; $conf['mailer']['type'] = 'smtp';

> I can confirm 'horde_auth' parameter in 'smtp' works (hord

Mon, 24 Jun 2013 03:06:04 +0000

> I can confirm 'horde_auth' parameter in 'smtp' works (horde > 5.1.0-git; imp 6.1.0-git): > > $servers['imap'] = array( > 'disabled' => false, > 'name' => 'IMAP Server', > 'hostspec' => 'localhost', > 'hordeauth' => false, > 'protocol' => 'imap', > 'port' => 143, > 'secure' => 'tls', > 'smtp' => array( > 'horde_auth' => true, > ), > ); > > horde/config/conf.php: > > $conf['mailer']['params']['host'] = 'smtp.gmail.com'; > $conf['mailer']['params']['port'] = 587; > $conf['mailer']['params']['auth'] = true; > $conf['mailer']['type'] = 'smtp'; I confirmed the above setting is working while if using SMTP on SSL of port 465. The following setting must be used instead: $conf[mailer][params]['host'] = 'ssl://mail.domain.comg'; $conf[mailer][params]['port'] = 465; $conf[mailer][params]['auth'] = true;