Plugin to add additional accounts by a ldap lookup

[cm-schl]

Hi,

as already described in #616 I've began to write a plugin to automatically add additional mail accounts to SnappyMail basing on a ldap lookup.
As I'm new to SnappyMail and my programming skills aren't the best I've used the ldap-identities plugin as base of my plugin https://github.com/cm-schl/snappymail/tree/master/plugins/ldap-mail-accounts.

The idea behind this:
Often you already use a ldap directory to manage the additional accounts a user has access to. For example a ldap object could contain a member attribute that contains the username of those users that have access to the additional mail account (=this ldap object).
If SnappyMail could lookup the ldap for additional accounts the user / admin does not have to configure these additional accounts by hand.

My plugin therefore has to be configured before the first use with:

• the server address, version and credentials of the ldap server
• the object class, base DN of the query
• the field name which contains the username of the user that has access to this additional mail account
• the search string to use. This can be as simple as the username of the logged in SnappyMail user, or something more complex depending how this information is saved in your ldap (for example something like uid=<username> etc.)

When a user logs in to SnappyMail the plugin starts a search using this information and if some entry is found in the ldap it returns the username, domain part and display name of the additional mailbox. The fields which have to be returned are also configurable in the configuration of the plugin.

My first tests worked - but as said I'm new to this and have to learn a lot 🙂.

Actually this is on the todo list:

• check and log if a domain is used that isn't configured in SnappyMail (Log ClientExceptions to logfile #705)
• remove a mailbox if a user looses the right to see it. Here the problem seems to be that the object containing the additional accounts can't contain the information if it has been created manually or if it is managed by a plugin
• I can't set the name of the mailbox because I'm using RainLoop\Model\AdditionalAccount::NewInstanceFromCredentials to create the object...

My hope is that someone who knows the details about SnappyMail (maybe @the-djmaze 😉) could have a look on my plugin so that I could get the best out of it and share it with others that have the same need (I think this could be useful for companies for example).

[the-djmaze]

There are several things possible.

1. Instead of NewInstanceFromCredentials use:

\AdditionalAccount::NewInstanceFromTokenArray($oActions, [
	'email' => $this->sEmail,
	'login' => $this->sLogin,
	'pass'  => $this->sPassword,
	'name' => $this->sName
]);

2. Remove additional accounts by changing the email value something like info@ldap.domain.com and there are login hooks to remove the 'ldap.' part (ldap is just an example. use your imagination how you want it).
   This way you don't mess around with accounts that the user added.
   On the other hand: Should user be allowed to add otheruser@company.tld without permission?
   Else you can just make a match for managing @company.tld only.

[cm-schl]

Hi and thanks for your reply!

1. I tried to use AdditionalAccount::NewInstanceFromTokenArray but I'm stuck at some point I can't identify 🙈.
   I imagine the problem comes from the fact that NewInstanceFromTokenArray can't find the MainAccount because I created a new $oActions object? Sorry maybe this is a easy task but I don't know how to solve this...
   My code looks like this:

                $oActions = \RainLoop\Api::Actions();

		if (!$oActions->GetCapa(Capa::ADDITIONAL_ACCOUNTS)) {
			return $oActions->FalseResponse(__FUNCTION__);
		}

		$aAccounts = $oActions->GetAccounts($oAccount);

		foreach($mailAddressResults as $mailAddressResult)
		{
			$sUsername = $mailAddressResult->username;
			$sDomain = $mailAddressResult->domain;
			$sName = $mailAddressResult->name;

			//Check if the domain of the found mail address is in the list of configured domains
			if ($oActions->DomainProvider()->Load($sDomain, true))
			{
				if (!$aAccounts["$sUsername@$sDomain"] && $oAccount->Email() !== "$sUsername@$sDomain")
				{
					$sPass = $oAccount->Password();

					$aNewAccountData = array(
						'email' => $sUsername . "@" . $sDomain,
						'login' => $sUsername, 
						'pass' => $sPass, 
						'name' => $sName
					);
					
					$oNewAccount = RainLoop\Model\AdditionalAccount::NewInstanceFromTokenArray($oActions, $aNewAccountData);
					$aAccounts["$sUsername@$sDomain"] = $oNewAccount->asTokenArray($oAccount);			
				}
			}
			else {
				$this->logger->Write("Domain $sDomain is not part of configured domains in SnappyMail Admin Panel - mail address $sUsername@$sDomain will not be added.", \LOG_NOTICE, self::LOG_KEY);
			}				
		}

		if ($aAccounts)
		{
			$oActions->SetAccounts($oAccount, $aAccounts);
			return true;
		}

Alternatively I know saw that I simply could add the mailbox name to the object created by AdditionalAccount::NewInstanceFromCredentials but I think your solution to use NewInstanceFromTokenArray would be better...

2. At least from my point of view a user that has the login data of a specific account like otheruser@company.tld should also can add this mailbox manually... For me the solution would be simpler to match for @company.tld but i think the plugin would be more flexible if it could handle this dynamically 🙂.
   Your solution to add something to the email value is nice but seems a bit like a workaround..? I'm a bit afraid that this could get into conflict with other solutions working in the same manner - but I'm not sure about this. I know it may be to much but wouldn't it be ideal if the additional account object would have some additional info if this account is managed by the user or by a plugin or else?
   I really don't know - it's a point I would like to discuss with you to find an ideal solution for this problem...

[the-djmaze]

The only way to create additional accounts is through the user interface (not ?admin).
Because passwords are encrypted with the mainaccount password that user login with.

This is to prevent a bug that i reported to RainLoop.

[cm-schl]

Interesting - so maybe I'm doing something strange by calling NewInstanceFromCredentials but this works to add accounts to SnappyMail... Probably these accounts are not connected to the MainAccount and I only can't see the difference...?
For me (I think) this does not change a lot as the user will see all his accounts connected to her/him inside the ldap.

[cm-schl]

Hi @the-djmaze I've modified my plugin and now it works - but I'm using a different approach to solve the two things you mentioned:

1. I switched back to AdditionalAccount::NewInstanceFromCredentials but inject the name of the mailbox afterwards into the array. This seems to work without problems.
2. I did not wanted to mess up something by changing the mail address because I had doubts that this could interfere with other plugins. Therefore I'm adding " (LDAP)" to the name of the mailbox and using this to remove all mailboxes before adding those the user has access to.
   I'm aware of the fact that a user could create a mailbox with such a suffix but I think this can be ignored at the moment (or better I have to ignore it because of lacking additional time to work on this).

How would you like to proceed with this plugin? Should I create a PR for this or do you prefer to leave this plugin in my repository?

[the-djmaze]

1. If you want it publicly available then you can push a PR.
2. Else we can figure out a way to allow multiple repositories inside SnappyMail and you roll your own.

In both cases you can add updates.
In case 1 SnappyMail is responsible for secure updates (prevent hacked)
In case 2 you are responsible for secure updates (prevent hacked)

[cm-schl]

I think you already saw that I'm new to all of this, so I guess point 1 would be better for all the users 🙂.