On 13/02/14 22:43, Alan Chandler wrote:
Hi
I am trying to achieve the following functionality
"usera" can't login because his account is set non active. there is a
deny query that checks this.
a master user ("masteruser") should be able login using
"usera*masteruser" syntax to this disabled account
I just tried it with auth_debug set on, but the deny query is being
run for usera, presumably because my master definition is
passdb {
driver = sql
master = yes
args = /etc/dovecot/sqlite-master.conf
# Unless you're using PAM, you probably still want the destination
user to
# be looked up from passdb that it really exists. pass=yes does that.
pass = yes
}
with pass=yes, and that causes usera to be validated through both the
deny and accept phase of authorisation.
In the password_query defined in sqlite-master.conf I user '%u' to
locate my master user. Is there any variable I could use to (in that
query) to also check that "usera" exists? I could then remove the pass
= yes, both to avoid two more queries and to avoid the trap that this
account is locked out.
To answer my own question - I found the variable in the wiki in the end
%{login_user}
At first it didn't work even then, because it was still trying to find
stuff from the userdb, but when I added a userdb_uid (which was all it
was looking for) it worked a treat.
To be more specific - my normal query to look up users is
SELECT m.name AS user, u.password AS password, u.uid+10000 AS userdb_uid \
FROM mailaccount m INNER JOIN user u ON m.username =
u.username \
WHERE m.name = '%u'
(I have a common user who could have several mail accounts = they will
be all in the virtual uid of the user, not his account.)
I took the master stanza above and removed the pass=yes
and changed the master query to be
SELECT u.password AS password,l.uid+10000 as userdb_uid FROM user u \
INNER JOIN capability c ON u.username = c.username \
,mailaccount m JOIN user l ON m.username =l.username \
WHERE c.role = 'masteruser' and u.username = '%u' AND
m.name = '%{login_user}'
and this seemed to work nicely.
Alan Chandler
