helpClasspath Extensions - Support: sr #103351, in DEBUG mode, warn if server ask...

 
 

sr #103351: in DEBUG mode, warn if server ask for an AUTH, but not authenticator is given

Submitted by:  Ralf Hauser <ralfhauser>
Submitted on:  Fri 10 Sep 2004 09:20:55 AM UTC  
 
Category: NonePriority: 5 - Normal
Severity: 1 - WishStatus: Duplicate
Privacy: PublicAssigned to: Chris Burdess <dog>
Open/Closed: ClosedOperating System: None

Add a New Comment (Rich MarkupRich Markup):
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Tue 28 Sep 2004 04:56:07 PM UTC, comment #3:

Any class in the VM can access the session properties. The default session instance is a singleton, so it lasts until the Session class is garbage collected.

Chris Burdess <dog>
Project AdministratorIn charge of this item.
Fri 10 Sep 2004 10:24:00 PM UTC, comment #2:

SaslClientFactory.LOGIN really doesn't appear to be implemented yet --> bug #10346

Ralf Hauser <ralfhauser>
Fri 10 Sep 2004 09:10:30 PM UTC, comment #1:

if sasl returns null, mention
to add the ${JRE_HOME}/lib/security/${VM_NAME}.security:

security.provider.N=gnu.crypto.jce.GnuCrypto

see also: http://www.gnu.org/software/gnu-crypto/manual/Installing-the-GNU-Crypto-Provider.html#Installing%20the%20GNU%20Crypto%20Provider

Anonymous
Fri 10 Sep 2004 09:20:55 AM UTC, original submission:

Just to ease migration of Sun users to gnu mail users, warn if
auth.password, auth.user, smtp.host, smtp.sender are used.

or should this even result in an error?

Chris> None of the above are documented by GNU JavaMail and as you say, they are

> ignored. Perhaps you're not actually supplying any authentication
> credentials, in which case the SMTPTransport cannot be expected to
> authenticate for you.
>
> Use the Transport.connect method specifying a username and password, or
> specify an Authenticator for the session. GNU JavaMail will never support
> authentication credentials stored in session properties, as this is
> inherently insecure.

Why is having them in a session inherently insecure?
Doesn't this session object just live for the particular message being processed?

Ralf Hauser <ralfhauser>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

Please enter the title of George Orwell's famous dystopian book (it's a date):

 

 

Follow 3 latest changes.

Date Changed By Updated Field Previous Value => Replaced By
Wed 29 Sep 2004 11:39:29 AM UTCdogStatusNone=>Duplicate
  Assigned toNone=>dog
  Open/ClosedOpen=>Closed

Back to the top


Powered by Savane 3.1-cleanup