This is an automated email from the ASF dual-hosted git repository. quantranhong1999 pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/james-project.git
commit 5af96523c1d33bbf408d59a323b56895684b2e9e Author: Quan Tran <[email protected]> AuthorDate: Thu Aug 13 09:46:53 2026 +0700 JAMES-4210 Document ManageSieve SASL adoption --- docs/modules/servers/partials/configure/sieve.adoc | 55 +++++++++++++++++++++- upgrade-instructions.md | 20 ++++++++ 2 files changed, 73 insertions(+), 2 deletions(-) diff --git a/docs/modules/servers/partials/configure/sieve.adoc b/docs/modules/servers/partials/configure/sieve.adoc index 47e62761b5..65bd4adb41 100644 --- a/docs/modules/servers/partials/configure/sieve.adoc +++ b/docs/modules/servers/partials/configure/sieve.adoc @@ -39,5 +39,56 @@ It contains one `managesieveservers` element that can contain multiple `managesi The `managesieveserver` element can be configured using the common options described xref:{pages-path}/configure/server.adoc[here]. -Additionally, it can contain an optional `oidc` element. -The OIDC configuration is described xref:{pages-path}/configure/oidc.adoc[here]. +== Authentication + +ManageSieve supports the `PLAIN`, `OAUTHBEARER`, and `XOAUTH2` SASL mechanisms, by default. `PLAIN` is enabled by default. +The OAuth mechanisms are enabled when `auth.oidc` is configured. Their stable default order is `PLAIN`, +`OAUTHBEARER`, then `XOAUTH2`. + +Guice applications can also load extension-provided SASL mechanisms, such as the optional `GSSAPI` Kerberos +mechanism, as well as other custom or community mechanisms, through their SASL mechanism factories. + +The optional `auth` element supports the following properties: + +.`auth` element +|=== +| Property Name | Explanation + +| `auth.saslMechanisms` +| Configures an ordered, comma-separated list of SASL mechanism factory class names. +Built-in factories can be referenced by simple name, for example `PlainSaslMechanismFactory`. +Guice applications can load a custom factory by its fully qualified class name when the implementation and its +dependencies are available to Guice. Spring applications support built-in factories only. + +| `auth.plainAuthEnabled` +| Enables the `PLAIN` mechanism. It is an optional boolean that defaults to `true`. + +| `auth.requireSSL` +| Requires a secure connection (TLS or STARTTLS) before affected SASL mechanisms are advertised or accepted. +It is an optional boolean that defaults to `false` for compatibility. Enabling it is strongly recommended for +`PLAIN` and bearer-token authentication. + +| `auth.oidc` +| Configures authentication via OIDC. The configuration is described in more detail +xref:{pages-path}/configure/oidc.adoc[here]. + +|=== + +Example: + +[source,xml] +---- +<managesieveserver enabled="true"> + <!-- ... --> + <auth> + <requireSSL>true</requireSSL> + <saslMechanisms>PlainSaslMechanismFactory,OauthBearerSaslMechanismFactory,XOauth2SaslMechanismFactory</saslMechanisms> + <oidc> + <!-- See the OIDC configuration documentation. --> + </oidc> + </auth> +</managesieveserver> +---- + +The former root-level `oidc` element remains accepted as a compatibility alias. New configurations should use +`auth.oidc`; configuring both paths for one server is rejected. diff --git a/upgrade-instructions.md b/upgrade-instructions.md index 22571c3b9d..8ca73e0c8d 100644 --- a/upgrade-instructions.md +++ b/upgrade-instructions.md @@ -21,6 +21,7 @@ Change list: - [Lucene mailbox index schema update for collapseThreads support](#lucene-mailbox-index-schema-update-for-collapsethreads-support) - [JAMES-4210 SMTP AuthHook deprecation](#james-4210-smtp-authhook-deprecation) - [JAMES-4210 POP3 USER/PASS requires TLS by default](#james-4210-pop3-userpass-requires-tls-by-default) + - [JAMES-4210 ManageSieve SASL adoption](#james-4210-managesieve-sasl-adoption) ### JAMES-4210 POP3 USER/PASS requires TLS by default @@ -37,6 +38,25 @@ intentionally allow clear-text USER/PASS authentication must add the following t </auth> ``` +### JAMES-4210 ManageSieve SASL adoption + +Date: 13/08/2026 + +Concerned products: ManageSieve servers and custom ManageSieve authentication extensions + +ManageSieve authentication now uses the shared SASL mechanism stack. The non-standard empty challenge `+ ""` is +now emitted as the RFC 5804 string `""`. Clients should send quoted or literal strings for SASL continuations; +legacy bare continuations remain accepted for compatibility. + +Invalid OIDC tokens now follow RFC 7628: the server sends an error challenge, the client acknowledges it, and the +server completes the failed authentication with `NO`. + +OIDC configuration should move from the root `oidc` element to `auth.oidc`, to align with other protocol's pattern. The root `oidc` element remains accepted as a +compatibility alias, but configuring both paths is rejected. + +The internal ManageSieve `AuthenticationProcessor` extension point was removed. Custom authentication extensions +should provide a `SaslMechanismFactory` and list its fully qualified class name in `auth.saslMechanisms`. + ### JAMES-4210 SMTP AuthHook deprecation Date: 24/06/2026 --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
