As coded, the imap_auth module does not seem to check the email address of locally defined users to determine which account is using this email address.
Since Drupal (seemingly?) enforces a unique email address for each user, imap_auth ought to work like this:
1) user attempts to log in with their email address and IMAP password
2) Drupal sees that this is a user@domain login, and passes the auth attempt off to the external modules
3) imap_auth checks whether the user@domain email address exists in the user database. If not, bail out (no sense going any further).
4) if the email address is known, and the IMAP auth succeeds, imap_auth sets the global $user object with the data retrieved and sets $login to "1" to approve the login attempt.
I've done minimal testing, but the attached patch seems to work for me.
| Comment | File | Size | Author |
|---|---|---|---|
| #2 | SDM-imap_auth-take3.diff.txt | 369 bytes | skippy13 |
| #1 | SDM-imap_auth-take2.diff.txt | 490 bytes | skippy13 |
| SDM-imap_auth.diff.txt | 500 bytes | skippy13 |
Comments
Comment #1
skippy13 commentedThe previous patch included an OP_DEBUG constant on the imap_open() call. Though it should be harmless, this patch removes it.
Comment #2
skippy13 commented*sigh* The previous revised patch dropped an "@" before the imap_open().
Those responsible for sacking those responsible have just been sacked.
Comment #3
Cainan commentedi will review your patch in the next day or so.
Comment #4
asiby commentedI do not think that imap_auth should check existing user email addresses. The reason is that I am using many different email addresses (1 pop, and 2 imap). I would want to be able to check them through a single drupal account. Since Drupal will only allow one email address per account, it will not be convenient to have to create a seperate account just to check the other emails. Also, some people may be using an email address for their local Drupal (hotmail, yahoo, or other free email accounts) and want to check other email account (someone@internetprovider.com, someone@myownserver.com, etc.)
Regards,
a.k.a WebMaestro
Comment #5
Cainan commentedI must say your comments have me confused.
How does imap auth relate to you checking your email addresses?
The module, as defined is a one to one correlation to a *net account to a drupal userid.
I am still researching this issue.
Comment #6
Cainan commentedI am closing this issue.
The IMAP auth code works as defined by the Drupal API.
the Drupal API assumes that if an external api returns true,
the user is authorised to have a drupal account.
as for adressing the original concern. imap auth does not check for user->email address mapping.
that is done by drupal itself using authmaps
if you are trying to link external login to one or more email addresses w/o using authmaps, then you are breaking the API, and posibly introducing corruption into the authmap.
Comment #7
Cainan commentedComment #8
asiby commentedI see. I guess I didn't understand how this module worked.