<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"></head><body><div>Point of sending the success ones is to maintain whitelist as well as blacklist so you know which ones you should not tarpit anymore. We know it does scale as we have very large deployments using the whole three request per login model.</div><div><br></div><div id="composer_signature"><meta http-equiv="Content-Type" content="text/html; charset=UTF-8">---<div>Aki Tuomi</div><div>Dovecot oy</div></div><div><br></div><div style="font-size:100%;color:#000000"><!-- originalMessage --><div>-------- Original message --------</div><div>From: Peter Mogensen <apm@one.com> </div><div>Date: 15/09/2018 11:25 (GMT+02:00) </div><div>To: Dovecot Mailing List <dovecot@dovecot.org> </div><div>Subject: Re: auth_policy in a non-authenticating proxy chain </div><div><br></div></div>Hi ...<br><br>After the below thread, I wrote a patch to select on a node-by-node<br>basis which auth-policy request should be done from that node.<br><br>To my surprise the exact same functionality then turned up in 2.2.34<br>with just slightly different option names:*<br>*<br><br>*auth_policy_check_before_auth*: Whether to do policy lookup before<br>authentication is started<br><br>*auth_policy_check_after_auth*: Whether to do policy lookup after<br>authentication is completed<br><br>*auth_policy_report_after_auth*: Whether to report authentication result <br><br><br>This is great.<br><br>However... in the setup where you have a proxy in front of a backend and<br>the backend does all authentication, it would be nice with an option to<br>only do report requests in case of authentication failure.<br><br>Point being that, if the proxy authentication "fails", it does not proxy<br>and the backend will never see the req. and do any actual authentication<br>or reporting.<br><br>However, you would probably still want to know that there has been a<br>failed auth-attempt.<br>Enabling "report_after_auth" on the proxy would however, send a lot of<br>meaningless traffic about "successful" proxy auth events which would<br>tell you basically nothing the backed wouldn't later also report.<br><br>And the ration between success' and failures in the proxy is probably<br>very high.<br><br><br>regards,<br><br>Peter Mogensen<br><br><br>On 12/14/2017 08:30 AM, Peter Mogensen wrote:<br>> Hi,<br>><br>> I was looking into the new Authentication Policy feature:<br>> https://wiki2.dovecot.org/Authentication/Policy<br>><br>> I had kinda hoped that I would be able to enfore this in a proxy running<br>> in front of several backends. This proxy does not authenticate. It use<br>> "nopassword".<br>><br>><br>> But I realize that the "succes" reported in the final authpolicy req.<br>> (command=report) is not what is actaully happening on the IMAP protocol<br>> level, but rather the result of the passdb chain in the proxy.<br>> (I should probably have predicted this, it's kinda reasonable).<br>><br>> However... since the proxy use "nopassword", ALL passdb lookups result<br>> in "success", so the proxy will never report an authentication failure<br>> to the authpolicy server.<br>><br>> This, of course, forces me to do the authpolicy check on the backend<br>> with a shared state, but It would still have been nice to have the proxy<br>> being able to do the first "command=allow" req. and reject attemps<br>> already there even though the backend does "command=report".<br>><br>> /Peter<br><br></body></html>