<!DOCTYPE html><html><head><title></title><style type="text/css">p.MsoNormal,p.MsoNoSpacing{margin:0}</style></head><body><div>On Tue, Sep 19, 2023, at 18:34, Maxim Dounin wrote:<br></div><blockquote type="cite" id="qt" style=""><div>On Tue, Sep 19, 2023 at 12:28:49PM +0200, Arnout Engelen wrote:<br></div><div>> # HG changeset patch<br></div><div>> # User Arnout Engelen <<a href="mailto:arnout@bzzt.net">arnout@bzzt.net</a>><br></div><div>> # Date 1695027670 -7200<br></div><div>> # Mon Sep 18 11:01:10 2023 +0200<br></div><div>> # Node ID 9606e589b9537495c0457383048ac6888be0e7b4<br></div><div>> # Parent daf8f5ba23d8e9955b22782d945f9c065f4b6baa<br></div><div>> Mail: allow auth to the proxy without auth to the backend<br></div><div>> <br></div><div>> Currently, when the client authenticates itself to the nginx<br></div><div>> mail proxy, the mail proxy also authenticates itself to the<br></div><div>> backend.<br></div><div>> <br></div><div>> I encountered a situation where I wanted the proxy to require<br></div><div>> authentication, and forward the mail to a (local/firewalled)<br></div><div>> mailserver that does not have authentication configured. I<br></div><div>> created the patch below to support that.<br></div><div>> <br></div><div>> I'm providing this patch primarily for feedback at this point:<br></div><div>> while it does work for my scenario and pass the nginx-tests,<br></div><div>> it likely needs additional cleanup and testing. I'd like your<br></div><div>> thoughs on whether this change makes sense in the first place,<br></div><div>> and whether this is generally a reasonable approach - if so I'll<br></div><div>> clean up the patch further.<br></div><div>> <br></div><div>> My approach is to allow the authentication server to return a<br></div><div>> 'Auth-Method: none' header, in which case the proxy will not<br></div><div>> attempt to authenticate to the backend but instead wait for<br></div><div>> the 'MAIL FROM' from the client.<br></div><div>> <br></div><div>> You'll notice I've added a 'proxy_auth_method'. The reason I didn't<br></div><div>> overwrite 'auth_method' is that 'auth_method' is also used to determine<br></div><div>> whether to confirm the authentication to the client. Is that acceptable<br></div><div>> from a binary compatibility perspective?<br></div><div>> <br></div><div>> Looking forward to hearing your thoughts!<br></div><div><br></div><div>From the description it is not clear why "proxy_smtp_auth off;" <br></div><div>(which is the default and implies that nginx won't try to <br></div><div>authenticate against SMTP backends) does not work for you. Could <br></div><div>you please elaborate?<br></div></blockquote><div><br></div><div>Ah, indeed I didn't describe that: I have two different backends, and the HTTP authentication server decides based on the account whether to proxy the mail to one (which requires authentication) or the other (which doesn't allow authentication).<br></div><div><br></div><div>This does make me wonder whether adding that 'proxy_auth_method' field was really necessary, though, as you'd expect the "proxy_smtp_auth off" code path should need something similar. I'll look into that.<br></div><div><br></div><div><br></div><div>Kind regards,<br></div><div><br></div><div>Arnout<br></div></body></html>