Mailing List Archive

Hello,

Ok, I've got this usermap patch updated and tested somewhat
under both mysql and postgres - with and without a usermap table.
I'd be glad for others to try it too and report any problems. We're
using it in production now, so it's "good enough" enough under
postgres with a usermap table present.

How it works is by performaing a normal lookup in the users table
for a userid - if not found, and the usermap table is present, it
will then try a second lookup for a matchine userid in the usermap
table (which returns the proper user_idnr for a user in users table).

This patch also includes some security fixes, namely it escapes
the userid searched in auth_md5_validate() (ie. apop command) and
in auth_user_exists(), just like in auth_validate().

The full patch against cvs is availabe at:
http://www.kci.net/dbmail-20031108-usermap.cvs.patch
I also made a patch with just these changes, if you applied the
other -fomit-frame-pointer patch I mailed about the other day...
it is attached or available at:
http://www.kci.net/dbmail-20031108-usermap.patch

The usermap table is quite simple, and examples are in the sql/*
directories.

Later,
Jesse


---- Original Message ----
From: Jesse Norell <dbmail-dev@dbmail.org>
To: dbmail-dev@dbmail.org
Subject: [Dbmail-dev] Re: [Dbmail] solicit feature interest
Sent: Thu, 6 Nov 2003 09:30:42 -0700 (MST)

>
> Hello,
>
> I've got our usermap patch updated to current cvs code. As far
> as testing for whether the usermap table is present or not, would
> it seem worthwhile to put in a runtime tests piece, with just this
> test for now, but easy to add more later? It'd of course be
> quicker to just put this specific test right in auth_validate(),
> but I can do a nice run-once-at-startup setup if it'd seem useful
> for anyone else.
>
> jn
>
>
> ---- Original Message ----
> From: Jesse Norell <dbmail@dbmail.org>
> To: dbmail@dbmail.org
> Subject: Re: [Dbmail] solicit feature interest
> Sent: Tue, 7 Oct 2003 08:50:33 -0600 (MDT)
>
> >
> > Hello,
> >
> > Yes, it was patched for mysql and pgsql and applied clean last
> > I'd tried, but that's been a couple months. I'm not sure on the
> > graceful failure when usermap table doesn't exist, but I'm sure
> > that can be done. I can forward the patch now if you want to work
> > with it, but I may not/probably won't get to working on it today.
> > This thread ought to probably move to dbmail-dev about now. :)
> >
> >
> > ---- Original Message ----
> > From: Paul J Stevens <dbmail@dbmail.org>
> > To: dbmail@dbmail.org
> > Subject: Re: [Dbmail] solicit feature interest
> > Sent: Tue, 07 Oct 2003 09:40:03 +0200
> >
> > > Jesse,
> > >
> > > I'm interested.
> > >
> > > Does the patch apply cleanly to current CVS-head? Does it support both
> > > mysql and postgresql? If so, could you please send me the patch, or
> > > upload it to sf.net. I'll see if I can extend the current debian
> > > packages with this added capability.
> > >
> > > fwiw, I have no problems with extending the debian packages beyond
> > > dbmail-1.1 as long as those patches apply cleanly, support both db
> > > backends and gracefully degrade. That is, I won't apply patches that
> > > will break dbmail for people doing an apt-get upgrade. So your patch
> > > shouldn't break dbmail for people who don't have the usermap table.
> > >
> > >
> > >
> > > Jesse Norell wrote:
> > > > Hello,
> > > >
> > > > Trying to solicit some response for interest in a feature of dbmail.
> > > > We had a fairly good size user base when we migrated to dbmail that
> > > > were all using short usernames, and we wanted to start using long names,
> > > > but knew we couldn't just up and switch, so we wrote a little patch to
> > > > help the migration which allows users to use multiple login names via
> > > > another lookup table. Would anyone else find this useful? If so,
> > > > we've patched both mysql and pgsql to do this (under dbmail 1.x tree)
> > > > and if we could get it adopted into the main dbmail source, we can
> > > > stop maintaining our own custom patches and go to the debian packages.
> > > > :)
> > > >
> > > > The actual implimentation is a simple lookup table (which we called
> > > > usermap), which is simply a map of user_idnr, userid pairs. The
> > > > normal lookup is done for a matchind userid in users table, and if
> > > > one is not found, a query is done for a matching usermap entry (or it
> > > > may be reversed, falling back to users table if usermap entry isn't
> > > > found). All new users are only added to the users table, using full
> > > > email address logins, and at the time of conversion we filled the
> > > > usermap with all the short names. The same table could facilitate
> > > > a number of other scenarios as well (login names at different
> > > > domains, etc.).
> > > >
> > > > I don't know that we've tested the results without having the
> > > > usermap table created, but I'm sure it could be handled so that if
> > > > you've not done so it continues on without a problem. So - anyone
> > > > interested? (And will any new features eveb be accepted for dbmail
> > > > 1.x?)
> > > >
> > > > Jesse
> > > >
> > > > --
> > > > Jesse Norell
> > > > jesse (at) kci.net
> > > >
> > > >
> > > > _______________________________________________
> > > > Dbmail mailing list
> > > > Dbmail@dbmail.org
> > > > https://mailman.fastxs.nl/mailman/listinfo/dbmail
> > > >
> > >
> > > --
> > > ________________________________________________________________
> > > Paul Stevens mailto:paul@nfg.nl
> > > NET FACILITIES GROUP PGP: finger paul@nfg.nl
> > > The Netherlands________________________________http://www.nfg.nl
> > >
> > > _______________________________________________
> > > Dbmail mailing list
> > > Dbmail@dbmail.org
> > > https://mailman.fastxs.nl/mailman/listinfo/dbmail
> > >
> > -- End Original Message --
> >
> >
> > --
> > Jesse Norell
> > jesse (at) kci.net
> >
> >
> > _______________________________________________
> > Dbmail mailing list
> > Dbmail@dbmail.org
> > https://mailman.fastxs.nl/mailman/listinfo/dbmail
> >
> -- End Original Message --
>
>
> --
> Jesse Norell
> jesse (at) kci.net
>
>
> _______________________________________________
> Dbmail-dev mailing list
> Dbmail-dev@dbmail.org
> http://twister.fastxs.net/mailman/listinfo/dbmail-dev
>
-- End Original Message --


--
Jesse Norell
jesse (at) kci.net