eeada2b9b5
merge changes from V55 upstream
2021-10-19 23:07:02 +02:00
1f0e493b8c
Exclude mru_token in user key hash
2020-09-30 12:34:26 +02:00
a8ea456b49
Reorganize the MFA backend methods
2020-09-26 09:58:25 -04:00
dcb93d071c
Add TOTP secret to user_key hash
...
thanks @downtownallday
* this invalidates all user_keys after TOTP status is changed for user
* after changing TOTP state, a login is required
* due to the forced login, we can't and don't need to store the code used for setup in `mru_code`
2020-09-12 16:34:06 +02:00
ce70f44c58
Extract TOTPStrategy class to totp.py
...
* this decouples `TOTP` validation and storage logic from `auth` and moves it to `totp`
* reduce `pyotp.validate#valid_window` from `2` to `1`
2020-09-03 11:19:19 +02:00
3c3683429b
implement two factor check during login
2020-09-02 17:23:32 +02:00
e9e6d94e3b
the control panel auth hmac message should also include the user's password so that resetting a password in the database forces that user to log in to the control panel again; also use a sha256 hmac
2015-06-06 12:38:19 +00:00
f98afac6df
if you make an API call with a user-specific API key (e.g. from control panel) but your account no longer exists on the system, there was an unhandled error
...
see 1039a08be6
2015-04-28 07:17:21 -04:00
1039a08be6
/admin login now issues a user-specific key for future calls (rather than providing the system-wide API key or passing the password on each request)
2015-01-31 20:42:43 +00:00
023b38df50
split management daemon authorization from authentication and use 'doveadm pw' rather than 'doveadm auth test' so that it is decoupled from dovecot's login mechanism
...
This was done to pave the way for two-factor authentication, but that's still a ways off.
2015-01-31 20:41:41 +00:00
b30d7ad80a
web-based administrative UI
...
closes #19
2014-08-17 22:46:06 +00:00
f41ec93cbe
management: dont raise an exception on a poorly formatted authentication header
2014-08-17 11:50:05 -04:00
9e63ec62fb
Cleanup: remove env dependency
2014-06-22 08:55:19 -04:00
d100a790a0
Remove API_KEY_FILE setting
2014-06-22 08:45:29 -04:00
067052d4ea
Add key-based authentication to management service
...
Intended to be the simplest auth possible: every time the service
starts, a random key is written to `/var/lib/mailinabox/api.key`. In
order to authenticate to the service, the client must pass the contents
of `api.key` in an HTTP basic auth header. In this way, users who do not
have read access to that file are not able to communicate with the
service.
2014-06-21 23:42:48 +00:00
github@kiekerjan.isdronken.nl
Felix Spöttel
Joshua Tauberer
Michael Kropat