Skip to content

upgrading: Document empty password rejection and EXTERNAL changes #1591

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
vmo69 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

upgrading: Document empty password rejection and EXTERNAL changes #1591

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions docs/installation/upgrade/2.4-to-2.4.x.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -134,6 +134,8 @@ changed to `2.4.4`.
ISO 8601 / RFC 3339 output via the `iso8601` filter. The deprecated providers
keep working for now.

<!-- @include: include/2.4.5-auth-empty-password.inc -->

#### Changed Setting Defaults

These changes don't take effect until [[setting,dovecot_config_version]] is
Expand Down
19 changes: 19 additions & 0 deletions docs/installation/upgrade/include/2.4.5-auth-empty-password.inc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
* A [[link,passdb]] lookup returning an empty password now fails
authentication instead of allowing login with an empty password. Passdb
entries intended to have no fixed password should return the `nopassword`
[[link,passdb_extra_fields,extra field]] (e.g. `user:::::::nopassword=yes`
in a passwd-file) instead of an empty password field; any non-empty client
password is then accepted.
* An empty client-supplied password is now always rejected before the passdb
lookup, for all passdb drivers. Previously only LDAP auth binds rejected
it. `nopassword` does not allow an empty client password either; only
mechanisms that authenticate without a password (EXTERNAL via client
certificate, OAuth2) are unaffected.
* The EXTERNAL SASL mechanism now treats the client certificate as the
authentication and no longer verifies any passdb password. Existing
client-certificate setups (e.g. passwd-file entries with an empty password
field) keep working, and EXTERNAL now also works with passdbs that verify
the password themselves, e.g. LDAP with auth binds. For EXTERNAL logins
`passdb { skip = authenticated }` passdbs are now skipped and
`skip = unauthenticated` passdbs run; if all passdbs are skipped, the
login fails.