mirror of https://github.com/mailscope/kumomta.git synced 2026-09-05 18:18:56 +00:00

Files

T

Wez Furlong 4055c50522 authz: introduce an ACL facility

This commit is a step towards some general improvements around
our handling of authentication and authorization.

This commit is focused primarily on authorization, but there are
some adjustments to how we track authentication as part of enabling
that.

We now have a separate AuthInfo type that holds the overall
authentication information/context associated with an inbound
SMTP or HTTP session.

It is populated with the peer_address as a fact rather than a statement
of trust.

If authentication via the appropriate lua auth callback is successful,
then the AuthInfo has additional identities added.

There are some types and events for loading access control lists and
matching their rules against an AuthInfo.

There is now a system default ACL that is equivalent to the prior
hard-coded access policy that was encoded into each HTTP endpoint.

This change makes it possible to replace the ACL with a
user-defined ACL.

Later will be some work on authentication to allow more options
for HTTP auth.

2025-12-18 06:30:06 +00:00

627 B

Raw Blame History

kumo.aaa.set_check_cache_ttl

kumo.on('pre_init', function()
  kumo.aaa.set_check_cache_ttl '5 minutes'
end)

This function sets the Time To Live (TTL) duration for the ACL-check cache.

The ACL-check cache is used to cache the overall status of an authorization check for a given resource, privilege, and auth_info combination.

The default duration is 5 minutes.

!!! note This function is intended to be used in pre_init as shown above. It can be called at any time, but reducing the TTL after init will not automatically trigger a cache eviction.

627 B Raw Blame History

kumo.aaa.set_check_cache_ttl

627 B

Raw Blame History