Merge pull request #753 from apache/master

pull[bot] · web-flow · commit c66667aab419 · 2026-01-12T12:49:19.000Z
[pull] master from apache:master
diff --git a/docs/modules/servers/partials/configure/imap.adoc b/docs/modules/servers/partials/configure/imap.adoc
@@ -62,6 +62,9 @@ Whether to enable Authentication PLAIN if the connection is not encrypted via SS
 | auth.oidc.scope
 | An OAuth scope that is valid to access the service (RF: RFC7628). Only configure this when you want to authenticate IMAP server using a OIDC provider.
 
+| auth.adminUsers.adminUser
+| XML list of administrators able to impersonate any IMAP users. This is typically enable on non publicly exposed IMAP servers eg port 994 for admin support or migration.
+
 | timeout
 | Default to 30 minutes. After this time, inactive channels that have not performed read, write, or both operation for a while
 will be closed. Negative value disable this behaviour.
diff --git a/docs/modules/servers/partials/configure/usersrepository.adoc b/docs/modules/servers/partials/configure/usersrepository.adoc
@@ -36,6 +36,8 @@ acting on the behalf of any user.
 | administratorIds
 | List of usernames. Allows multiple administrators to access the https://tools.ietf.org/html/rfc4616#section-2[impersonation command],
 acting on behalf of any user by specifying multiple `<administratorId>` entries inside the `<administratorIds>` block.
+Prefer ref:imap.adoc[imapserver.xml] `auth.adminUsers` property to not
+enable admin impersonation onto publicly exposed interfaces.
 
 Notes: Only one of the above `<administratorId>` property or this `<administratorIds>` block should be used to specify the administrator(s).
 
diff --git a/mailbox/api/src/main/java/org/apache/james/mailbox/Authorizator.java b/mailbox/api/src/main/java/org/apache/james/mailbox/Authorizator.java
@@ -38,7 +38,17 @@ interface FluentAuthorizator {
     enum AuthorizationState {
         ALLOWED,
         FORBIDDEN,
-        UNKNOWN_USER
+        UNKNOWN_USER;
+
+        static AuthorizationState combine(AuthorizationState a, AuthorizationState b) {
+            if (a == AuthorizationState.FORBIDDEN) {
+                return b;
+            }
+            if (a == UNKNOWN_USER && b == ALLOWED) {
+                return b;
+            }
+            return a;
+        }
     }
 
     AuthorizationState canLoginAsOtherUser(Username userId, Username otherUserId) throws MailboxException;
@@ -50,5 +60,11 @@ default FluentAuthorizator user(Username userId) {
     default Collection<Username> delegatedUsers(Username username) {
         return ImmutableList.of();
     }
+
+    static Authorizator combine(Authorizator a, Authorizator b) {
+        return (userA, userB) -> AuthorizationState.combine(
+            a.canLoginAsOtherUser(userA, userB),
+            b.canLoginAsOtherUser(userA, userB));
+    }
 }
 
diff --git a/mailbox/api/src/main/java/org/apache/james/mailbox/SessionProvider.java b/mailbox/api/src/main/java/org/apache/james/mailbox/SessionProvider.java
@@ -75,4 +75,6 @@ interface AuthorizationStep {
      *             when the creation fails for other reasons
      */
     AuthorizationStep authenticate(Username givenUserid);
+
+    SessionProvider withExtraAuthorizator(Authorizator authorizator);
 }
diff --git a/mailbox/api/src/test/java/org/apache/james/mailbox/AuthorizatorTest.java b/mailbox/api/src/test/java/org/apache/james/mailbox/AuthorizatorTest.java
@@ -0,0 +1,45 @@
+/******************************************************************
+ * Licensed to the Apache Software Foundation (ASF) under one     *
+ * or more contributor license agreements.  See the NOTICE file   *
+ * distributed with this work for additional information          *
+ * regarding copyright ownership.  The ASF licenses this file     *
+ * to you under the Apache License, Version 2.0 (the              *
+ * "License"); you may not use this file except in compliance     *
+ * with the License.  You may obtain a copy of the License at     *
+ *                                                                *
+ * http://www.apache.org/licenses/LICENSE-2.0                     *
+ *                                                                *
+ * Unless required by applicable law or agreed to in writing,     *
+ * software distributed under the License is distributed on an    *
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY         *
+ * KIND, either express or implied.  See the License for the      *
+ * specific language governing permissions and limitations        *
+ * under the License.                                             *
+ ******************************************************************/
+
+package org.apache.james.mailbox;
+
+import static org.apache.james.mailbox.Authorizator.AuthorizationState.ALLOWED;
+import static org.apache.james.mailbox.Authorizator.AuthorizationState.FORBIDDEN;
+import static org.apache.james.mailbox.Authorizator.AuthorizationState.UNKNOWN_USER;
+
+import org.apache.james.mailbox.Authorizator.AuthorizationState;
+import org.assertj.core.api.SoftAssertions;
+import org.junit.jupiter.api.Test;
+
+class AuthorizatorTest {
+    @Test
+    void combineShouldAggregateResults() {
+        SoftAssertions.assertSoftly(softly -> {
+            softly.assertThat(AuthorizationState.combine(ALLOWED, ALLOWED)).isEqualTo(ALLOWED);
+            softly.assertThat(AuthorizationState.combine(ALLOWED, FORBIDDEN)).isEqualTo(ALLOWED);
+            softly.assertThat(AuthorizationState.combine(FORBIDDEN, ALLOWED)).isEqualTo(ALLOWED);
+            softly.assertThat(AuthorizationState.combine(FORBIDDEN, FORBIDDEN)).isEqualTo(FORBIDDEN);
+            softly.assertThat(AuthorizationState.combine(UNKNOWN_USER, FORBIDDEN)).isEqualTo(UNKNOWN_USER);
+            softly.assertThat(AuthorizationState.combine(FORBIDDEN, UNKNOWN_USER)).isEqualTo(UNKNOWN_USER);
+            softly.assertThat(AuthorizationState.combine(UNKNOWN_USER, UNKNOWN_USER)).isEqualTo(UNKNOWN_USER);
+            softly.assertThat(AuthorizationState.combine(UNKNOWN_USER, ALLOWED)).isEqualTo(ALLOWED);
+            softly.assertThat(AuthorizationState.combine(ALLOWED, UNKNOWN_USER)).isEqualTo(ALLOWED);
+        });
+    }
+}
diff --git a/mailbox/store/src/main/java/org/apache/james/mailbox/store/SessionProviderImpl.java b/mailbox/store/src/main/java/org/apache/james/mailbox/store/SessionProviderImpl.java
@@ -148,4 +148,9 @@ private long randomId() {
     private Optional<Username> isValidLogin(Username userid, String passwd) throws MailboxException {
         return authenticator.isAuthentic(userid, passwd);
     }
+
+    @Override
+    public SessionProvider withExtraAuthorizator(Authorizator authorizator) {
+        return new SessionProviderImpl(authenticator, Authorizator.combine(this.authorizator, authorizator));
+    }
 }
diff --git a/mailbox/store/src/main/java/org/apache/james/mailbox/store/StoreMailboxManager.java b/mailbox/store/src/main/java/org/apache/james/mailbox/store/StoreMailboxManager.java
@@ -37,6 +37,7 @@
 import org.apache.james.core.quota.QuotaCountUsage;
 import org.apache.james.core.quota.QuotaSizeUsage;
 import org.apache.james.events.EventBus;
+import org.apache.james.mailbox.Authorizator;
 import org.apache.james.mailbox.DefaultMailboxes;
 import org.apache.james.mailbox.MailboxAnnotationManager;
 import org.apache.james.mailbox.MailboxManager;
@@ -250,6 +251,11 @@ public AuthorizationStep authenticate(Username givenUserid, String passwd) {
         return sessionProvider.authenticate(givenUserid, passwd);
     }
 
+    @Override
+    public SessionProvider withExtraAuthorizator(Authorizator authorizator) {
+        return sessionProvider.withExtraAuthorizator(authorizator);
+    }
+
     @Override
     public AuthorizationStep authenticate(Username givenUserid) {
         return sessionProvider.authenticate(givenUserid);
diff --git a/protocols/imap/src/main/java/org/apache/james/imap/api/ImapConfiguration.java b/protocols/imap/src/main/java/org/apache/james/imap/api/ImapConfiguration.java
@@ -20,6 +20,7 @@
 package org.apache.james.imap.api;
 
 import java.time.Duration;
+import java.util.List;
 import java.util.Map;
 import java.util.Optional;
 import java.util.Properties;
@@ -31,6 +32,7 @@
 import com.google.common.base.MoreObjects;
 import com.google.common.base.Objects;
 import com.google.common.base.Preconditions;
+import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableMap;
 import com.google.common.collect.ImmutableSet;
 
@@ -65,6 +67,7 @@ private static boolean noBlankString(String disableCap) {
         private Optional<Boolean> provisionDefaultMailboxes;
         private Optional<Properties> customProperties;
         private ImmutableSet<String> additionalConnectionChecks;
+        private ImmutableList<String> adminUsers;
         private ImmutableMap<String, String> idFieldsResponse;
 
         private Builder() {
@@ -80,6 +83,7 @@ private Builder() {
             this.customProperties = Optional.empty();
             this.additionalConnectionChecks = ImmutableSet.of();
             this.idFieldsResponse = ImmutableMap.of();
+            this.adminUsers = ImmutableList.of();
         }
 
         public Builder idleTimeInterval(long idleTimeInterval) {
@@ -114,6 +118,11 @@ public Builder disabledCaps(ImmutableSet<String> disabledCaps) {
             return this;
         }
 
+        public Builder adminUsers(ImmutableList<String> adminUsers) {
+            this.adminUsers = adminUsers;
+            return this;
+        }
+
         public Builder disabledCaps(String... disableCaps) {
             this.disabledCaps = ImmutableSet.copyOf(disableCaps);
             return this;
@@ -166,23 +175,25 @@ public Builder idFieldsResponse(ImmutableMap<String, String> idFieldsResponse) {
 
         public ImapConfiguration build() {
             ImmutableSet<Capability> normalizeDisableCaps = disabledCaps.stream()
-                    .filter(Builder::noBlankString)
-                    .map(StringUtils::normalizeSpace)
-                    .map(Capability::of)
-                    .collect(ImmutableSet.toImmutableSet());
+                .filter(Builder::noBlankString)
+                .map(StringUtils::normalizeSpace)
+                .map(Capability::of)
+                .collect(ImmutableSet.toImmutableSet());
+
             return new ImapConfiguration(
-                    appendLimit,
-                    enableIdle.orElse(DEFAULT_ENABLE_IDLE),
-                    idleTimeInterval.orElse(DEFAULT_HEARTBEAT_INTERVAL_IN_SECONDS),
-                    concurrentRequests.orElse(DEFAULT_CONCURRENT_REQUESTS),
-                    maxQueueSize.orElse(DEFAULT_QUEUE_SIZE),
-                    idleTimeIntervalUnit.orElse(DEFAULT_HEARTBEAT_INTERVAL_UNIT),
-                    normalizeDisableCaps,
-                    isCondstoreEnable.orElse(DEFAULT_CONDSTORE_DISABLE),
-                    provisionDefaultMailboxes.orElse(DEFAULT_PROVISION_DEFAULT_MAILBOXES),
-                    customProperties.orElseGet(Properties::new),
-                    additionalConnectionChecks,
-                    idFieldsResponse);
+                appendLimit,
+                enableIdle.orElse(DEFAULT_ENABLE_IDLE),
+                idleTimeInterval.orElse(DEFAULT_HEARTBEAT_INTERVAL_IN_SECONDS),
+                concurrentRequests.orElse(DEFAULT_CONCURRENT_REQUESTS),
+                maxQueueSize.orElse(DEFAULT_QUEUE_SIZE),
+                idleTimeIntervalUnit.orElse(DEFAULT_HEARTBEAT_INTERVAL_UNIT),
+                normalizeDisableCaps,
+                isCondstoreEnable.orElse(DEFAULT_CONDSTORE_DISABLE),
+                provisionDefaultMailboxes.orElse(DEFAULT_PROVISION_DEFAULT_MAILBOXES),
+                customProperties.orElseGet(Properties::new),
+                additionalConnectionChecks,
+                adminUsers,
+                idFieldsResponse);
         }
     }
 
@@ -197,6 +208,7 @@ public ImapConfiguration build() {
     private final boolean provisionDefaultMailboxes;
     private final Properties customProperties;
     private final ImmutableSet<String> additionalConnectionChecks;
+    private final List<String> adminUsers;
     private final ImmutableMap<String, String> idFieldsResponse;
 
     private ImapConfiguration(Optional<Long> appendLimit,
@@ -210,6 +222,7 @@ private ImapConfiguration(Optional<Long> appendLimit,
                               boolean provisionDefaultMailboxes,
                               Properties customProperties,
                               ImmutableSet<String> additionalConnectionChecks,
+                              List<String> adminUsers,
                               ImmutableMap<String, String> idFieldsResponse) {
         this.appendLimit = appendLimit;
         this.enableIdle = enableIdle;
@@ -222,6 +235,7 @@ private ImapConfiguration(Optional<Long> appendLimit,
         this.provisionDefaultMailboxes = provisionDefaultMailboxes;
         this.customProperties = customProperties;
         this.additionalConnectionChecks = additionalConnectionChecks;
+        this.adminUsers = adminUsers;
         this.idFieldsResponse = idFieldsResponse;
     }
 
@@ -277,6 +291,10 @@ public ImmutableMap<String, String> getIdFieldsResponse() {
         return idFieldsResponse;
     }
 
+    public List<String> getAdminUsers() {
+        return adminUsers;
+    }
+
     @Override
     public final boolean equals(Object obj) {
         if (obj instanceof ImapConfiguration that) {
@@ -291,7 +309,8 @@ public final boolean equals(Object obj) {
                 && Objects.equal(that.getCustomProperties(), customProperties)
                 && Objects.equal(that.isCondstoreEnable(), isCondstoreEnable)
                 && Objects.equal(that.getAdditionalConnectionChecks(), additionalConnectionChecks)
-                && Objects.equal(that.getIdFieldsResponse(), idFieldsResponse);
+                && Objects.equal(that.getIdFieldsResponse(), idFieldsResponse)
+                && Objects.equal(that.getAdminUsers(), adminUsers);
         }
         return false;
     }
@@ -300,7 +319,7 @@ public final boolean equals(Object obj) {
     public final int hashCode() {
         return Objects.hashCode(enableIdle, idleTimeInterval, idleTimeIntervalUnit, disabledCaps, isCondstoreEnable,
             concurrentRequests, maxQueueSize, appendLimit, provisionDefaultMailboxes, customProperties, additionalConnectionChecks,
-            idFieldsResponse);
+            idFieldsResponse, adminUsers);
     }
 
     @Override
@@ -318,6 +337,7 @@ public String toString() {
                 .add("customProperties", customProperties)
                 .add("additionalConnectionChecks", additionalConnectionChecks)
                 .add("idFieldsResponse", idFieldsResponse)
+                .add("adminUsers", adminUsers)
                 .toString();
     }
 }
diff --git a/protocols/imap/src/main/java/org/apache/james/imap/processor/AbstractAuthProcessor.java b/protocols/imap/src/main/java/org/apache/james/imap/processor/AbstractAuthProcessor.java
@@ -27,6 +27,7 @@
 import org.apache.james.imap.api.message.response.StatusResponseFactory;
 import org.apache.james.imap.api.process.ImapSession;
 import org.apache.james.imap.main.PathConverter;
+import org.apache.james.mailbox.Authorizator;
 import org.apache.james.mailbox.DefaultMailboxes;
 import org.apache.james.mailbox.MailboxManager;
 import org.apache.james.mailbox.MailboxSession;
@@ -126,13 +127,23 @@ protected void doAuthWithDelegation(AuthenticationAttempt authenticationAttempt,
         }
         Username otherUser = authenticationAttempt.getDelegateUserName().orElseThrow();
         doAuthWithDelegation(() -> getMailboxManager()
+                .withExtraAuthorizator(withAdminUsers())
                 .authenticate(givenUser, authenticationAttempt.getPassword())
                 .as(otherUser),
             session,
             request, responder,
             givenUser, otherUser);
     }
 
+    protected Authorizator withAdminUsers() {
+        return (userId, otherUserId) -> {
+            if (imapConfiguration.getAdminUsers().contains(userId.asString())) {
+                return Authorizator.AuthorizationState.ALLOWED;
+            }
+            return Authorizator.AuthorizationState.FORBIDDEN;
+        };
+    }
+
     protected void doAuthWithDelegation(MailboxSessionAuthWithDelegationSupplier mailboxSessionSupplier,
                                         ImapSession session, ImapRequest request, Responder responder,
                                         Username authenticateUser, Username delegatorUser) {
diff --git a/protocols/imap/src/main/java/org/apache/james/imap/processor/AuthenticateProcessor.java b/protocols/imap/src/main/java/org/apache/james/imap/processor/AuthenticateProcessor.java
@@ -215,6 +215,7 @@ private void doOAuth(OIDCSASLParser.OIDCInitialResponse oidcInitialResponse, Oid
                 Username associatedUser = Username.of(oidcInitialResponse.getAssociatedUser());
                 if (!associatedUser.equals(authenticatedUser)) {
                     doAuthWithDelegation(() -> getMailboxManager()
+                            .withExtraAuthorizator(withAdminUsers())
                             .authenticate(authenticatedUser)
                             .as(associatedUser),
                         session, request, responder, authenticatedUser, associatedUser);
diff --git a/server/protocols/protocols-imap4/src/main/java/org/apache/james/imapserver/netty/IMAPServer.java b/server/protocols/protocols-imap4/src/main/java/org/apache/james/imapserver/netty/IMAPServer.java
@@ -67,6 +67,7 @@
 
 import com.google.common.annotations.VisibleForTesting;
 import com.google.common.base.Splitter;
+import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableMap;
 import com.google.common.collect.ImmutableSet;
 
@@ -249,19 +250,21 @@ private static Integer parseLiteralSizeLimit(HierarchicalConfiguration<Immutable
 
     @VisibleForTesting static ImapConfiguration getImapConfiguration(HierarchicalConfiguration<ImmutableNode> configuration) {
         ImmutableSet<String> disabledCaps = ImmutableSet.copyOf(Splitter.on(CAPABILITY_SEPARATOR).split(configuration.getString("disabledCaps", "")));
+        ImmutableList<String> adminUsers = ImmutableList.copyOf(configuration.getStringArray("auth.adminUsers.adminUser"));
 
         return ImapConfiguration.builder()
-                .enableIdle(configuration.getBoolean("enableIdle", ImapConfiguration.DEFAULT_ENABLE_IDLE))
-                .idleTimeInterval(configuration.getLong("idleTimeInterval", ImapConfiguration.DEFAULT_HEARTBEAT_INTERVAL_IN_SECONDS))
-                .idleTimeIntervalUnit(getTimeIntervalUnit(configuration.getString("idleTimeIntervalUnit", DEFAULT_TIME_UNIT)))
-                .disabledCaps(disabledCaps)
-                .appendLimit(Optional.of(parseLiteralSizeLimit(configuration)).filter(i -> i > 0))
-                .maxQueueSize(configuration.getInteger("maxQueueSize", ImapConfiguration.DEFAULT_QUEUE_SIZE))
-                .concurrentRequests(configuration.getInteger("concurrentRequests", ImapConfiguration.DEFAULT_CONCURRENT_REQUESTS))
-                .isProvisionDefaultMailboxes(configuration.getBoolean("provisionDefaultMailboxes", ImapConfiguration.DEFAULT_PROVISION_DEFAULT_MAILBOXES))
-                .withCustomProperties(configuration.getProperties("customProperties"))
-                .idFieldsResponse(getIdCommandResponseFields(configuration))
-                .build();
+            .enableIdle(configuration.getBoolean("enableIdle", ImapConfiguration.DEFAULT_ENABLE_IDLE))
+            .idleTimeInterval(configuration.getLong("idleTimeInterval", ImapConfiguration.DEFAULT_HEARTBEAT_INTERVAL_IN_SECONDS))
+            .idleTimeIntervalUnit(getTimeIntervalUnit(configuration.getString("idleTimeIntervalUnit", DEFAULT_TIME_UNIT)))
+            .disabledCaps(disabledCaps)
+            .appendLimit(Optional.of(parseLiteralSizeLimit(configuration)).filter(i -> i > 0))
+            .maxQueueSize(configuration.getInteger("maxQueueSize", ImapConfiguration.DEFAULT_QUEUE_SIZE))
+            .concurrentRequests(configuration.getInteger("concurrentRequests", ImapConfiguration.DEFAULT_CONCURRENT_REQUESTS))
+            .isProvisionDefaultMailboxes(configuration.getBoolean("provisionDefaultMailboxes", ImapConfiguration.DEFAULT_PROVISION_DEFAULT_MAILBOXES))
+            .withCustomProperties(configuration.getProperties("customProperties"))
+            .idFieldsResponse(getIdCommandResponseFields(configuration))
+            .adminUsers(adminUsers)
+            .build();
     }
 
     private static ImmutableMap<String, String> getIdCommandResponseFields(HierarchicalConfiguration<ImmutableNode> configuration) {
diff --git a/server/protocols/protocols-imap4/src/test/java/org/apache/james/imapserver/netty/IMAPServerTest.java b/server/protocols/protocols-imap4/src/test/java/org/apache/james/imapserver/netty/IMAPServerTest.java
diff --git a/server/protocols/protocols-imap4/src/test/resources/imapServerAdminUsers.xml b/server/protocols/protocols-imap4/src/test/resources/imapServerAdminUsers.xml
diff --git a/src/site/xdoc/server/config-imap4.xml b/src/site/xdoc/server/config-imap4.xml
diff --git a/src/site/xdoc/server/config-users.xml b/src/site/xdoc/server/config-users.xml

Original file line number	Diff line number	Diff line change
`@@ -75,4 +75,6 @@ interface AuthorizationStep {`
`75`	`75`	`* when the creation fails for other reasons`
`76`	`76`	`*/`
`77`	`77`	`AuthorizationStep authenticate(Username givenUserid);`
	`78`	`+`
	`79`	`+ SessionProvider withExtraAuthorizator(Authorizator authorizator);`
`78`	`80`	`}`
Original file line number	Diff line number	Diff line change
`@@ -148,4 +148,9 @@ private long randomId() {`
`148`	`148`	`private Optional<Username> isValidLogin(Username userid, String passwd) throws MailboxException {`
`149`	`149`	`return authenticator.isAuthentic(userid, passwd);`
`150`	`150`	`}`
	`151`	`+`
	`152`	`+ @Override`
	`153`	`+ public SessionProvider withExtraAuthorizator(Authorizator authorizator) {`
	`154`	`+ return new SessionProviderImpl(authenticator, Authorizator.combine(this.authorizator, authorizator));`
	`155`	`+ }`
`151`	`156`	`}`