Danny wrote:
> No I was merely observing that AUTH seems designed to identify people
> who may be permitted, not machines.

Actually, I was re-reading http://james.apache.org/rfclist/smtp/rfc2554.txt.
It can be used to authenticate one SMTP server to another.  Then the sending
server can use:

   MAIL FROM: <[EMAIL PROTECTED]> [EMAIL PROTECTED]

to indicate that it authenticated frodo (or trusts a server that had
similarly relayed for an authenticated sender).  According to RFC 2554
section 5, if James cannot authenticate the sender, and wants to relay using
SMTP AUTH, then after authenticating itself, James should use:

   MAIL FROM: <[EMAIL PROTECTED]> AUTH=<>

to indicate that [EMAIL PROTECTED] was not authenticated.  It is permissible to
use AUTH=<>, and never authenticate senders.

> Also that it is possible to associate credentials with outward hosts in
> javamail therfore it should be straightforward to associate ONE set of
> credentials with a gateway in RemoteDelivery.

Perhaps not so straightforward.  JavaMail's SMTP transport doesn't appear to
support the MAIL FROM AUTH= extension.  A gateway server would have to be
configured to specifically trust the connecting James server, and credit the
sender as if authenticated.  That could be a bad idea, because mail being
delivered from a non-trusted sender intended for a local user, from a
trusted sender wanting to relay, and from a non-trusted sender trying to
relay, would be indistinguishable.

Something to pass onto Bill Shannon, and a simple change (JavaMail already
supports a similar extension, MAIL FROM RET=), but I'm afraid that we may
have missed the window to get it into JavaMail.

        --- Noel


---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Reply via email to