Skip to content

Possibility to limit imap access based on username regexp #149

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
bilbolodz wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Possibility to limit imap access based on username regexp #149

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
df9cbe6
Added posibility to limit users access by user_regexp parameter
bilbolodz Apr 24, 2020
fce6595
Update README.md
bilbolodz Apr 24, 2020
2e24ece
Update imap.php
bilbolodz May 20, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 5 additions & 2 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,15 +62,15 @@ IMAP user and password need to be given for the Nextcloud login.


### Configuration
The parameters are `host, port, sslmode, domain`.
The parameters are `host, port, sslmode, domain, user_regexp`.
Possible values for sslmode are `ssl` or `tls`.
Add the following to your `config.php`:

'user_backends' => array(
array(
'class' => 'OC_User_IMAP',
'arguments' => array(
'127.0.0.1', 993, 'ssl', 'example.com', true, false
'127.0.0.1', 993, 'ssl', 'example.com', true, false, '^user[0-9]?$|^admin_user$|^other_admin_user$'
),
),
),
Expand All @@ -88,6 +88,9 @@ the rest used as username in Nextcloud. e.g. 'username@example.com' will be
the user, it is added to a group corresponding to the name of the domain part
of the address.

In case when not all email accounts should have access to nexcloud platform you can limit allowed users adding optional user_regexp setting.
That should be PHP preg_match patern. Be carreful with these setting especially with ^$ chars. Without ^$ patern 'user1' will match also 'other_user10' account!

**⚠⚠ Warning:** If you are [**upgrading** from versions **<0.6.0**](https://github.com/nextcloud/user_external/releases/tag/v0.6.0), beside adapting your `config.php` you also have to change the `backend` column in the `users_external` table of the database. In your pre 0.6.0 database it may look like `{127.0.0.1:993/imap/ssl/readonly}INBOX` or similar, but now it has to be just `127.0.0.1` for everything to work flawless again. ⚠⚠


Expand Down
13 changes: 12 additions & 1 deletion lib/imap.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,14 +35,15 @@ class OC_User_IMAP extends \OCA\user_external\Base {
* @param boolean $stripeDomain (whether to stripe the domain part from the username or not)
* @param boolean $groupDomain (whether to add the usere to a group corresponding to the domain of the address)
*/
public function __construct($mailbox, $port = null, $sslmode = null, $domain = null, $stripeDomain = true, $groupDomain = false) {
public function __construct($mailbox, $port = null, $sslmode = null, $domain = null, $stripeDomain = true, $groupDomain = false, $user_regexp = null) {
parent::__construct($mailbox);
$this->mailbox = $mailbox;
$this->port = $port === null ? 143 : $port;
$this->sslmode = $sslmode;
$this->domain = $domain === null ? '' : $domain;
$this->stripeDomain = $stripeDomain;
$this->groupDomain = $groupDomain;
$this->user_regexp = $user_regexp === null ? '' : $user_regexp;
}

/**
Expand Down Expand Up @@ -80,6 +81,16 @@ public function checkPassword($uid, $password) {
$username = $uid;
}

if ($this->user_regexp !== '') {
if (!preg_match('/'.$this->user_regexp.'/', $username)) {
OC::$server->getLogger()->error(
'ERROR: User:'.$username.' does NOT match user regexp: '.$this->user_regexp,
['app' => 'user_external']
);
return false;
}
}

$groups = [];
if ($this->groupDomain && $pieces[1]) {
$groups[] = $pieces[1];
Expand Down