Closed Bug 26830 Opened 25 years ago Closed 25 years ago

implement authenticated SMTP

Categories

(MailNews Core :: Backend, defect, P3)

PowerPC
Mac System 8.5
defect

Tracking

(Not tracked)

VERIFIED FIXED

People

(Reporter: Brade, Assigned: jefft)

Details

I am not asked for a password when sending e-mail. In 4.x, the user is prompted for a password after the user clicks "send" if the user hasn't logged in yet. To reproduce: * launch 5.0 browser * choose File->New->Message * enter an e-mail address * enter a subject such as "test" * enter some text in the body * click send I expect to be prompted for my e-mail password. [for the record: yes, I know that anyone can forge e-mail but I like the fact that we make it harder in 4.x]
I don't think we make forging email any harder than in 4.x. It should really be the same. For most people, the password they get when sending mail before downloading it is the password to put a copy of the outgoing message in the Sent folder. Do you have a Sent folder configured in mozilla? (in mail, Edit | Account Setup | <account> | Copies & Folders)
I think there are two issues here: * in 4.x I do put a copy to a local mail folder but I am still prompted for my IMAP password; in 5.0 I'm not prompted * in 5.x my settings are to put a copy on the IMAP server; an attempt is made to put the message on the server but it fails with "login failed" type message. I wasn't actually prompted to enter my password. I hope this helps!
Sounds like in 4.x the password you're getting asked for is the SMTP password. Can you look in your prefs file for the setting of "mail.auth_login"? If it's 1 or 2, then you're using authenticated SMTP in 4.x, which we don't yet have in mozilla. I'm sure the "login failed" thing is some side effect of single sign on. Are you remembering your IMAP password? Sorry for all the questions, but all this behavior varies so much based on user prefs that it takes some sorting out.
I checked my 4.x settings, I can't find any preferences like "mail.auth_login" so I don't think your guess is right. I don't have single signon setup for 5.0 (at least I don't think so!). Is mail counting on single signon knowing my password?
> I checked my 4.x settings, I can't find any preferences like "mail.auth_login" > so I don't think your guess is right. Then I'm baffled by the login dialog when sending mail. It's either SMTP auth or copying to an IMAP Sent folder (before otherwise authenticating to the IMAP server). There's no other login prompt when sending mail. > Is mail counting on single signon knowing my password? If you have "remember password" in Seamonkey, then yes, because mail passwords are stored in the SSO DB, rather than in prefs as they were in 4.x. If you don't have remember password on, then SSO may be confused into thinking it has your password when it doesn't.
Here are the mail/mailnews prefs from my 4.x file: user_pref("mail.addr_book.version", ".na2"); user_pref("mail.close_message_window.on_delete", true); user_pref("mail.close_message_window.on_file", false); user_pref("mail.identity.organization", "Netscape Communications"); user_pref("mail.identity.useremail", "brade@netscape.com"); user_pref("mail.identity.username", "Kathleen Brade"); user_pref("mail.imap.delete_is_move_to_trash", true); user_pref("mail.imap.server.nsmail-2.mcom.com..admin_url", "http:// brade@dredd.mcom.com:4444/bin/user/admin/bin/enduser"); user_pref("mail.imap.server.nsmail-2.mcom.com..capability", 31551); user_pref("mail.imap.server.nsmail-2.mcom.com..check_new_mail", false); user_pref("mail.imap.server.nsmail-2.mcom.com..check_time", 10); user_pref("mail.imap.server.nsmail-2.mcom.com..cleanup_inbox_on_exit", false); user_pref("mail.imap.server.nsmail-2.mcom.com..delete_model", 1); user_pref("mail.imap.server.nsmail-2.mcom.com..dual_use_folders", true); user_pref("mail.imap.server.nsmail-2.mcom.com..empty_trash_on_exit", false); user_pref("mail.imap.server.nsmail-2.mcom.com..empty_trash_threshhold", 0); user_pref("mail.imap.server.nsmail-2.mcom.com..isSecure", false); user_pref("mail.imap.server.nsmail-2.mcom.com..namespace.other_users", "\"Shared Folders/User/\""); user_pref("mail.imap.server.nsmail-2.mcom.com..namespace.personal", "\"\""); user_pref("mail.imap.server.nsmail-2.mcom.com..namespace.public", ""); user_pref("mail.imap.server.nsmail-2.mcom.com..offline_download", false); user_pref("mail.imap.server.nsmail-2.mcom.com..override_namespaces", true); user_pref("mail.imap.server.nsmail-2.mcom.com..remember_password", false); user_pref("mail.imap.server.nsmail-2.mcom.com..userName", "brade"); user_pref("mail.imap.server.nsmail-2.mcom.com..using_subscription", true); user_pref("mail.incorporate.return_receipt", 1); user_pref("mail.mdn.report.enabled", false); user_pref("mail.notification.sound", "None"); user_pref("mail.pane_arrangement", 1); user_pref("mail.pop_name", "brade"); user_pref("mail.server_type", 1); user_pref("mail.smtp_name", "brade"); user_pref("mail.wrap_long_lines", true); user_pref("mailnews.profile_age", 29); user_pref("mailnews.reuse_message_window", false); In 5.0, I don't have "remember password" set in my mail/account settings.
QA Contact: lchiang → esther
Phil found a way to weasel out of owning this bug. Reassigning.
Assignee: phil → selmer
Jeff, are you the right person to carry the ball from here? Marking M17, not sure this should hold beta2. Please adjust if necessary.
Assignee: selmer → jefft
Target Milestone: --- → M17
Status: NEW → ASSIGNED
For this bug, we haven't figured out why Kathy is getting a password dialog in 4.7, so we can't verify that same feature works in 6.0 yet. Phil stated the (2) ways a user would get prompted for a password when sending in 4.7 without having logged in first. Based on Kathy's responses and prefs neither of these apply to her. One other way Kathy would get a password dialog is if she has the SSL option in her Mail Server pref set to "Always". This setting would prompt for a password the first time she sends whether she has already logged into the IMAP server or not. This password dialog has different wording than the IMAP or SMTP password dialog. It states "Please Enter the password or pin for Communicator Certificate DB". Kathy, if you are still getting a password request in 4.7 when sending the first time, could you please let me know what the password dialog says and/or if your preference for the server has "always" or "If possible" options selected. This preference (in 4.7) is located on the mail server panel under the Outgoing Server section.
see http://help.netscape.com/kb/corporate/19980217-7.html updating summary. note, this is not SMTP over SSL. (see bug #30321)
Summary: not asked for password when sending e-mail → implement authenticated SMTP
4.7 default mail.auth_login is set to true that's the reason that mail.auth_login does not show up in brade's prefs.js. Auth login also relys on the smtp server's capability if it supports it. Auth login for Netscape 6 has been implemented and working. Since, auth login has never being a really secured channel. It's part of a solution we have in 4.7 for showing users that the mail message is coming from an internal user so we never have an UI designed for it. I doubt we will have the UI for it in Netscape 6.0 too. To test the auth login smtp you need to set the following pref: user_pref("mail.smtpserver.smtp1.auth_method", 2); 2 is for auth login. There are other values defined for ssl but ssl hasn't been hooked up yet.
Status: ASSIGNED → RESOLVED
Closed: 25 years ago
Resolution: --- → FIXED
Ok, we still need to hear from Kathy regarding the Password dialog that she gets with 4.7 to determine if she's being asked for an smtp server password (according to her comments she does not know it her smtp server is authenticated server) or if she's being asked for a certificate password. When we determine that, then we can test the scenario.
sorry; I don't understand what is needed from me. I am not being prompted for a certification password since I am not using SSL with my mail server nor do I get that dialog in 4.x (it's just the generic password dialog). If authenticated login was athe default in 4.x why isn't it in Netscape 6? Why do I need to hand-edit my file to get the same behavior? That is what this bug is about... compatibility with 4.x; being prompted for my password on send.
I have verified that a SMTP authenticated server (I used AOL's server) is asking for a password when sending when I have not logged in prior to sending. Authenticated SMTP is working in 6.0. Verifying. If this is not working for a specific SMPT authenticated server please reopen and give the server name.
Status: RESOLVED → VERIFIED
Product: MailNews → Core
Product: Core → MailNews Core
You need to log in before you can comment on or make changes to this bug.