IMAP auth is broken due to change of config variables, error on ssl mode

[janaurka]

Hi *

After upgrading to user_external v0.6 logging in using IMAP does not work anymore.

I’m seeing the following in the logs:

{"reqId":"5iUZ0(...)","level":3,"time":"2019-03-16T02:30:58+00:00","remoteAddr":"$IP","user":"--","app":"PHP","method":"POST","url":"\/login?user=$USER","message":"Use of undefined constant ssl - assum
ed 'ssl' at \/var\/www\/nextcloud\/config\/config.php#33","userAgent":"Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/73.0.3683.75 Safari\/537.36","version":"15.0.5.3"}
{"reqId":"bM1aectC(...)","level":3,"time":"2019-03-16T02:30:58+00:00","remoteAddr":"$IP","user":"--","app":"PHP","method":"GET","url":"\/login?user=$USER","message":"Use of undefined constant ssl - assumed 'ssl
' at \/var\/www\/nextcloud\/config\/config.php#33","userAgent":"Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/73.0.3683.75 Safari\/537.36","version":"15.0.5.3"}
{"reqId":"gzT2LKW(...)","level":3,"time":"2019-03-16T02:30:59+00:00","remoteAddr":"$IP","user":"--","app":"PHP","method":"GET","url":"\/cron.php","message":"Use of undefined constant ssl - assumed 'ssl' at \/var\/www\/next
cloud\/config\/config.php#33","userAgent":"Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/73.0.3683.75 Safari\/537.36","version":"15.0.5.3"}

I have changed the config from something like:

  array (
    0 => 
    array (
      'class' => 'OC_User_IMAP',
      'arguments' => 
      array (
        0 => '{$IMAP-IP:993/imap/ssl/novalidate-cert}',
      ),
    ),
  ),

to

  array (
    array (
      'class' => 'OC_User_IMAP',
      'arguments' => 
      array (
        '$IMAP-IP', 993, ssl
      ),
    ),
  ),

(as it should be according to the updated readme).

which caused the error message in nextcloud.log as shown above.

Running Nextcloud Stable latest (15.0.5).

# php-fpm7.0 --version
PHP 7.0.33-0ubuntu0.16.04.2 (fpm-fcgi)
Copyright (c) 1997-2017 The PHP Group
Zend Engine v3.0.0, Copyright (c) 1998-2017 Zend Technologies
    with Zend OPcache v7.0.33-0ubuntu0.16.04.2, Copyright (c) 1999-2017, by Zend Technologies

# uname -a
Linux nextcloud 4.4.0-143-generic #169-Ubuntu SMP Thu Feb 7 07:56:38 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux

# cat /etc/*-release
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=16.04
DISTRIB_CODENAME=xenial
DISTRIB_DESCRIPTION="Ubuntu 16.04.6 LTS"
NAME="Ubuntu"
VERSION="16.04.6 LTS (Xenial Xerus)"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 16.04.6 LTS"
VERSION_ID="16.04"
HOME_URL="http://www.ubuntu.com/"
SUPPORT_URL="http://help.ubuntu.com/"
BUG_REPORT_URL="http://bugs.launchpad.net/ubuntu/"
VERSION_CODENAME=xenial
UBUNTU_CODENAME=xenial

Also changing the way the config file is parsed during a release is kinda uncool, especially since there is no remark in the release comments as breaking changes. Would be cool, if breaking changes would be announced at least in the GH release and if possible also in the Nextcloud UI/occ when trying to perform an update.

+ it would be great if there would be a list of possible options (eg for the ssl mode) at least somewhere in the code :)

lmk if you need more logoutput and stuff. I’ve fixed the problem for now by c&p the imap.php file from the release before and simply not running any sanity check on the files, which is ... suboptimal.

cheers

[MarBie77]

Just ran into the same issue, you have to escape the ssl_mode param:

array (
    array (
      'class' => 'OC_User_IMAP',
      'arguments' => 
      array (
        '$IMAP-IP', 993, 'ssl', ''
      ),
    ),
  ),

and I added an empty domain param, so the new source code doesn't change the username.

I hope this helps.

[megamaced]

thanks @MarBie77 that fixed it for me

[violoncelloCH]

thank you for reporting! @janaurka
as @MarBie77 said, the sslmode needs to be in quotes too, because it's a string (I already made PR #53 to fix the documentation; it's waiting for approving review so we can merge it)

see #49 for the changed IMAP auth:
we now (starting from v0.6.0) use roundcube's IMAP implementation, which uses direct socket connections, so we can get rid of the deprecated php-imap library
this deprecated php-imap library didn't support >TLS 1.0
with the old implementation we directly passed the parameters (arguments) to php-imap, but the parameters in this form don't fit the new implementation what is why we changed the documentation for the configuration...

Please kindly note that this app is not above v1.0.0, so breaking changes can happen any time.
However you're right, that I should've added a warning in the Github release. (added one now :) )

Regarding the possible sslmodes I first have to check what roundcube takes as parameters there. At least 'ssl' or 'tls' should be possible there.

[janaurka]

and I added an empty domain param, so the new source code doesn't change the username.

D*mn, I’ve thought that I tested this quickly and it did not work for me. Although I did not enter an empty string for the domain. Whatever if it works, I’m pretty happy

@violoncelloCH: awesome thx, also for writing/maintaining this plugin. i did not mean to be harsh or so. I’m aware on how stressful/annoying it can be to maintain open source software and some random people open angry bugs and basically yell at you for doing stuff they can use for free. again: danke tuusig (thanks a lot in swiss german).

I’d leave it open for now, feel free to close @violoncelloCH as soon as everything is merged to master and release is carved or whatever.

[daviddahlberg]

The following works for me[tm]:
'$ip:993/imap/ssl/novalidate-cert'
->'$hostname',993,ssl

And I put the hostname into the chrooted hosts file (/var/www/etc/hosts), so that validation may succeed.

But I still would prefer to have some documentation on how to put those the PHP parameters correctly into the config file.

[violoncelloCH]

thank you @janaurka for these words :)

as far as I understand from https://github.com/roundcube/roundcubemail/wiki/Configuration#imap-server-connection and roundcube's source code (https://github.com/roundcube/roundcubemail/blob/master/program/lib/Roundcube/rcube_imap_generic.php#L972-L987 && https://github.com/roundcube/roundcubemail/blob/master/program/lib/Roundcube/rcube_imap_generic.php#L1034-L1062) 'ssl' or 'tls' are the only supported parameters.
I added a commit accordingly to the open PR #53.

@daviddahlberg I think I don't fully get what you mean. Do you mean documentation about non-validated certs?

[Erling74]

A quick update of available apps ended here on this topic... ;-)
Thanks to this post I replaced:

array (
0 =>
array (
'class' => 'OC_User_IMAP',
'arguments' =>
array (
0 => '{localhost:993/imap/ssl/novalidate-cert}',
),
),
),

First I replaced with:
array (
array (
'class' => 'OC_User_IMAP',
'arguments' =>
array (
'localhost', 993, 'ssl', ''
),
),
),

Unfortunate this didn't solve the problem... After replacing "localhost" with the FQDN of my server everything worked like a charm again, so I assume you can't ignore the certificate check anymore.

Is this correct or is there a different way to do this?

[PaulFreund]

I also tried various different config settings starting from the old working parameters (993 and SSL against my domain name) and still can not authenticate. Dovecot shows the following:

Mar 17 15:21:56 XXXX dovecot: imap-login: Disconnected (no auth attempts in 1 secs): user=<>, rip=::1, lip=::1, TLS, session=<xxxx/xxxxxxxxxxxxxxxxxxxxxx>

I reverted back to 0.5.1 and it worked again, especially the user= field in the log is then populated which indicates that the requests to IMAP are malformed

[lsbbs]

The code taken from roundcube is giving in this way another problem:
I have a nextcloud instance running where I have users from two domains (this to domains are two departments of a company). But on the IMAP server are more than this two domains.
Striping out the domain part will now create a problem with duplicate usernames.
Without restricting the login to domains users from other domains can login. Not good, and not wanted.

[Flachzange]

After replacing "localhost" with the FQDN of my server everything worked like a charm again,

I can confirm this. With localhost I get only "Login failed".

However, I see now the following error messages:

[PHP] Error: Undefined offset: 1 at /www/htdocs/..../user_external/lib/imap/imap_rcube.php#149

[PHP] Error: Undefined index: force_caps at /www/htdocs/.../user_external/lib/imap/imap_rcube.php#945