NAME

Net::IMAP::Server::DefaultAuth - Encapsulates per-connection authorization information for an IMAP user.

DESCRIPTION

IMAP credentials are passed in one of two ways: using the LOGIN command, or the AUTHENTICATE command. LOGIN sends the password unencrypted; note, however, that Net::IMAP::Server will not allow the LOGIN command unless the connection is protected by either SSL or TLS. Thus, even when the LOGIN command is used, the password is not sent in the clear.

The default implementation accepts any username and password. Most subclasses will simply want to override "auth_plain", unless they need to implement other forms of authorization than LOGIN or AUTHENTICATE PLAIN.

METHODS

user [VALUE]

Gets or sets the plaintext username of the authenticated user.

provides_plain

If "provides_plain" returns true (the default), LOGIN capability will be advertised when under a layer, and "auth_plain" will be called if the user sends the LOGIN command.

auth_plain USER, PASSWORD

Returns true if the given USER is allowed to log in using the provided PASSWORD. This should also set "user" to the username if login was successful. This path is used by both LOGIN and AUTHENTICATE PLAIN commands.

sasl_provides

The AUTHENTICATE command checks that the provided SASL authentication type is in the list that "sasl_provides" returns. It defaults to only PLAIN.

sasl_plain

Called when the client requests PLAIN SASL authentication. This parses the SASL protocol, and defers to "auth_plain" to determine if the username and password is actually allowed to log in.

IMPLEMENTING NEW SASL METHODS

The "sasl_plain" method is a simple example of implementing a SASL protocol, albeit a very simple one. SASL authentication methods should expect to be called with no arguments, and should return an anonymous function, which will be called each time the client transmits more information.

Each time it is called, it will be passed the client data, which will already have been base-64 decoded (the exception being the first time it is called, when it will be called with the empty string).

If the function returns a scalar reference, the scalar will be base-64 encoded and transmitted to the client. Anything which is not a scalar reference will be interpreted as a boolean, as to whether the authentication was successful. Successful authentications should be sure to set "user" themselves.