domi/forgejo-domi
1
0
Fork 0
forked from forgejo/forgejo
Code Pull requests Activity

Improve SMTP authentication and Fix user creation bugs (#16612)

Browse source 
* Improve SMTP authentication, Fix user creation bugs and add LDAP cert/key options

This PR has two parts:

Improvements for SMTP authentication:

* Default to use SMTPS if port is 465, and allow setting of force SMTPS.
* Always use STARTTLS if available
* Provide CRAM-MD5 mechanism
* Add options for HELO hostname disabling
* Add options for providing certificates and keys
* Handle application specific password response as a failed user login
instead of as a 500.

Close #16104

Fix creation of new users:

* A bug was introduced when allowing users to change usernames which
prevents the creation of external users.
* The LoginSource refactor also broke this page.

Close #16104

Signed-off-by: Andrew Thornton <art27@cantab.net>
This commit is contained in:
zeripath 2021-08-11 21:42:58 +01:00 • committed by GitHub
parent f1a810e090
commit e29e163737
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
15 changed files with 162 additions and 78 deletions
Download patch file Download diff file Expand all files Collapse all files

15
services/auth/source/smtp/source_authenticate.go
View file

@ -28,12 +28,15 @@ func (source *Source) Authenticate(user *models.User, login, password string) (*
}
var auth smtp.Auth
if source.Auth == PlainAuthentication {
switch source.Auth {
case PlainAuthentication:
auth = smtp.PlainAuth("", login, password, source.Host)
} else if source.Auth == LoginAuthentication {
case LoginAuthentication:
auth = &loginAuthenticator{login, password}
} else {
return nil, errors.New("Unsupported SMTP auth type")
case CRAMMD5Authentication:
auth = smtp.CRAMMD5Auth(login, password)
default:
return nil, errors.New("unsupported SMTP auth type")
}
if err := Authenticate(auth, source); err != nil {
@ -44,6 +47,10 @@ func (source *Source) Authenticate(user *models.User, login, password string) (*
strings.Contains(err.Error(), "Username and Password not accepted") {
return nil, models.ErrUserNotExist{Name: login}
}
if (ok && tperr.Code == 534) ||
strings.Contains(err.Error(), "Application-specific password required") {
return nil, models.ErrUserNotExist{Name: login}
}
return nil, err
}