feat(openID): second part with a lot of fixes and cleaning

SoObjects/Mailer/SOGoMailBaseObject.m

@@ -132,14 +132,24 @@
 
 - (NGImap4ConnectionManager *) mailManager
 {
-  return [NGImap4ConnectionManager defaultConnectionManager];
+  SOGoSystemDefaults *sd;
+  NSString *imapAuthMech, *domain;
+
+  domain = [[[self context] activeUser] loginDomain];
+  sd = [SOGoSystemDefaults sharedSystemDefaults];
+  if([sd doesLoginTypeByDomain])
+    imapAuthMech = [sd getImapAuthMechForDomain: domain];
+  else
+    imapAuthMech = nil;
+
+  return [NGImap4ConnectionManager defaultConnectionManager: imapAuthMech];
 }
 
 - (NGImap4Connection *) _createIMAP4Connection
 {
   NGImap4ConnectionManager *manager;
   NGImap4Connection *newConnection;
-  NSString *password;
+  NSString *password, *domain;
   NGInternetSocketAddress *host;
   SOGoSystemDefaults *sd;
   BOOL usesSSO;
@@ -152,12 +162,15 @@
   host = [NGInternetSocketAddress addressWithPort:0 onHost:[[self imap4URL] host]];
 
   sd = [SOGoSystemDefaults sharedSystemDefaults];
-  usesSSO = [sd isSsoUsed];
+
+  domain = [[[self context] activeUser] loginDomain];
+  usesSSO = [sd isSsoUsed: domain];
 
   if (![[[self mailAccountFolder] nameInContainer] isEqualToString: @"0"] &&
       usesSSO &&
       [host isLocalhost])
     {
+      //
       [self errorWithFormat: @"Trying to use localhost for additional IMAP account - aborting."];
       return nil;
     }
@@ -227,19 +240,17 @@
       login = [[[self context] activeUser] login];
 
       if (!login)
-	login = [[[[self container] context] activeUser] login];
+	      login = [[[[self container] context] activeUser] login];
 
-      cacheKey = [NSString stringWithFormat: @"%@+%@",
-			   login,
-			   [[self mailAccountFolder] nameInContainer]];
+      cacheKey = [NSString stringWithFormat: @"%@+%@", login, [[self mailAccountFolder] nameInContainer]];
       imap4 = [sogoCache imap4ConnectionForKey: cacheKey];
       if (!imap4)
-        {
-          imap4 = [self _createIMAP4Connection];
-	  [sogoCache registerIMAP4Connection: imap4
-				      forKey: cacheKey];
-        }
-      [imap4 retain];
+      {
+        imap4 = [self _createIMAP4Connection];
+        [sogoCache registerIMAP4Connection: imap4
+                                    forKey: cacheKey];
+      }
+    [imap4 retain];
     }
 
    // Connection broken, try to reconnect

SoObjects/SOGo/NSDictionary+Utilities.m

@@ -95,6 +95,7 @@
   return keysWithFormat;
 }
 
+
 - (NSComparisonResult) caseInsensitiveDisplayNameCompare: (NSDictionary *) theDictionary
 {
   return [[self objectForKey: @"cn"] caseInsensitiveCompare: [theDictionary objectForKey: @"cn"]];

SoObjects/SOGo/NSString+Utilities.m

@@ -80,7 +80,10 @@ static int cssEscapingCount;
     {
       hostR = [self rangeOfString: @"://"];
       locationR = [[self substringFromIndex: (hostR.location + hostR.length)] rangeOfString: @"/"];
-      newURL = [self substringFromIndex: (hostR.location + hostR.length + locationR.location)];
+      if(locationR.location != NSNotFound)
+        newURL = [self substringFromIndex: (hostR.location + hostR.length + locationR.location)];
+      else
+        newURL = @"";
     }
 
   return newURL;

SoObjects/SOGo/SOGoDAVAuthenticator.m

@@ -141,6 +141,7 @@
   return password;
 }
 
+
 /* create SOGoUser */
 
 - (SOGoUser *) userInContext: (WOContext *)_ctx

SoObjects/SOGo/SOGoDefaultsSource.h

@@ -62,6 +62,7 @@ extern NSString *SOGoDefaultsSourceUnmutableSource;
 
 - (void) setBool: (BOOL) value forKey: (NSString *) key;
 - (BOOL) boolForKey: (NSString *) key;
+- (BOOL) boolForKey: (NSString *) key andDict: (NSDictionary*) _dict;
 
 - (void) setFloat: (float) value forKey: (NSString *) key;
 - (float) floatForKey: (NSString *) key;

SoObjects/SOGo/SOGoDefaultsSource.m

@@ -164,6 +164,29 @@ static Class NSStringKlass = Nil;
   return value;
 }
 
+- (BOOL) boolForKey: (NSString *) key andDict: (NSDictionary*) _dict
+{
+  id boolForKey;
+  BOOL value;
+
+  boolForKey = [_dict objectForKey: key];
+  if (boolForKey)
+    {
+      if ([boolForKey respondsToSelector: @selector (boolValue)])
+        value = [boolForKey boolValue];
+      else
+        {
+          [self warnWithFormat: @"expected a boolean for '%@' (ignored)",
+                key];
+          value = NO;
+        }
+    }
+  else
+    value = NO;
+
+  return value;
+}
+
 - (void) setFloat: (float) value
 	   forKey: (NSString *) key
 {

SoObjects/SOGo/SOGoMailer.h

@@ -25,6 +25,7 @@
 @class NSArray;
 @class NSException;
 @class NSString;
+@class NSDictionary;
 
 @class WOContext;
 @class SOGoDomainDefaults;

SoObjects/SOGo/SOGoMailer.m

@@ -31,6 +31,7 @@
 #import "NSString+Utilities.h"
 #import "SOGoStaticAuthenticator.h"
 #import "SOGoEmptyAuthenticator.h"
+#import "SOGoWebAuthenticator.h"
 #import "SOGoSystemDefaults.h"
 #import "SOGoUser.h"
 #import "SOGoUserManager.h"
@@ -265,7 +266,7 @@
                       inContext: (WOContext *) woContext
                   systemMessage: (BOOL) isSystemMessage
 {
-  NSString *currentTo, *login, *password;
+  NSString *currentTo, *login, *password, *encryption, *protocol, *server;
   NSString * smtpAuthMethod;
   NSDictionary *currentAcount;
   NSMutableArray *toErrors;
@@ -274,6 +275,7 @@
   NSException *result;
   NSURL * smtpUrl;
   SOGoUser* user;
+  SOGoSystemDefaults *sd;
   BOOL doSmtpAuth;
 
   result = nil;
@@ -297,6 +299,22 @@
     doSmtpAuth = [currentAcount objectForKey: @"smtpAuth"] ? [[currentAcount objectForKey: @"smtpAuth"] boolValue] : NO;
   }
 
+  sd = [SOGoSystemDefaults sharedSystemDefaults];
+  if(userId == 0 && [sd doesLoginTypeByDomain] && [authenticator isKindOfClass: [SOGoWebAuthenticator class]])
+  {
+    //Check if the authentication depends on the domain, only for webmail requets not for dav...
+    NSString *username, *_domain;
+    NSRange r;
+
+    username = [currentAcount objectForKey: @"userName"];
+    r = [username rangeOfString: @"@"];
+    if (r.location != NSNotFound)
+    {
+      _domain = [username substringFromIndex: r.location+1];
+      smtpAuthMethod = [sd getSmtpAuthMechForDomain: _domain];
+    }
+  }
+
   NS_DURING
     {
       [client connect];
@@ -319,7 +337,18 @@
                         getExternalLoginForUID: [[authenticator userInContext: woContext] loginInDomain]
                                       inDomain: [[authenticator userInContext: woContext] domain]];
 
-            password = [authenticator passwordInContext: woContext];
+            encryption = [currentAcount objectForKey: @"encryption"];
+            protocol = @"imap";
+            if ([encryption isEqualToString: @"ssl"] || [encryption isEqualToString: @"tls"])
+              protocol = @"imaps";
+            server = [NSString stringWithFormat: @"%@://%@", protocol, [currentAcount objectForKey: @"serverName"]];
+            if([authenticator isKindOfClass: [SOGoWebAuthenticator class]])
+              password = [authenticator smtpPasswordInContext: woContext forURL: server];
+            else
+            {
+              password = [authenticator passwordInContext: woContext];
+              smtpAuthMethod = @"plain"; //is a dav or activesync request, only support plain method
+            }
           }
 
 

SoObjects/SOGo/SOGoOpenIdSession.h

@@ -25,6 +25,7 @@
    https://openid.net/developers/how-connect-works/ */
 
 #import <NGObjWeb/WOResponse.h>
+#import <SOGo/SOGoObject.h>
 
 
 @class NSString;
@@ -33,7 +34,7 @@
 @class NSJSONSerialization;
 
 
-@interface SOGoOpenIdSession : NSObject
+@interface SOGoOpenIdSession : SOGoObject
 {
   //For cache
   BOOL cacheUpdateNeeded;
@@ -47,6 +48,10 @@
   NSString *openIdClientSecret;
   NSString *openIdEmailParam;
   BOOL openIdEnableRefreshToken;
+  BOOL sendDomainInfo;
+
+  NSString *forDomain;
+
 
   //From request to well-known/configuration
   NSString *authorizationEndpoint;
@@ -66,16 +71,20 @@
 }
 
 + (BOOL) checkUserConfig;
-+ (SOGoOpenIdSession *) OpenIdSession;
++ (SOGoOpenIdSession *) OpenIdSession: (NSString *) _domain;
++ (SOGoOpenIdSession *) OpenIdSessionWithConfig: (NSDictionary *) _config;
++ (SOGoOpenIdSession *) OpenIdSessionWithToken: (NSString *) token domain: (NSString *) _domain;
++ (SOGoOpenIdSession *) OpenIdSessionWithTokenAndConfig: (NSString *) token config: (NSDictionary *) _config;
 + (void) deleteValueForSessionKey: (NSString *) theSessionKey;
 
 - (void) initialize;
+- (void) initializeWithConfig: (NSDictionary *) _config;
 - (BOOL) sessionIsOK;
 - (WOResponse *) _performOpenIdRequest: (NSString *) endpoint
                         method: (NSString *) method
                        headers: (NSDictionary *) headers
                           body: (NSData *) body;
-- (NSMutableDictionary *) fecthConfiguration;
+- (NSMutableDictionary *) fecthConfiguration: (NSString *) _domain;
 - (void) setAccessToken;
 - (NSString *) getRefreshToken; 
 - (NSString *) getToken;

SoObjects/SOGo/SOGoOpenIdSession.m

@@ -23,6 +23,9 @@
 #import <NGObjWeb/WOResponse.h>
 #import <NGExtensions/NSObject+Logs.h>
 
+#import <SOGo/SOGoUser.h>
+
+
 #import <GDLContentStore/GCSOpenIdFolder.h>
 #import <GDLContentStore/GCSFolderManager.h>
 
@@ -52,32 +55,73 @@ static BOOL SOGoOpenIDDebugEnabled = YES;
   return ([sd openIdConfigUrl] && [sd openIdScope]  && [sd openIdClient]  && [sd openIdClientSecret]);
 }
 
-- (void) initialize
+- (void) initializeWithConfig: (NSDictionary *) _config
 {
   SOGoSystemDefaults *sd;
+  id refreshTokenBool, domainInfo;
 
-  // //From sogo.conf
-  // openIdConfigUrl = nil;
-  // openIdScope = nil;
-  // openIdClient = nil;
-  // openIdClientSecret = nil;
+  if([_config objectForKey: @"SOGoOpenIdConfigUrl"] &&
+      [_config objectForKey: @"SOGoOpenIdScope"] &&
+      [_config objectForKey: @"SOGoOpenIdClient"] &&
+      [_config objectForKey: @"SOGoOpenIdClientSecret"])
+  {
+    openIdConfigUrl          = [_config objectForKey: @"SOGoOpenIdConfigUrl"];
+    openIdScope              = [_config objectForKey: @"SOGoOpenIdScope"];
+    openIdClient             = [_config objectForKey: @"SOGoOpenIdClient"];
+    openIdClientSecret       = [_config objectForKey: @"SOGoOpenIdClientSecret"];
+    openIdEmailParam         = [_config objectForKey: @"SOGoOpenIdEmailParam"];
 
-  // //From request to well-known/configuration
-  // //SHoud be ste in sogo.cong in case of oauth
-  // authorizationEndpoint = nil;
-  // tokenEndpoint = nil;
-  // introspectionEndpoint = nil;
-  // userinfoEndpoint = nil;
-  // endSessionEndpoint = nil;
-  // revocationEndpoint = nil;
+    openIdEnableRefreshToken = NO;
+    refreshTokenBool = [_config objectForKey: @"SOGoOpenIdEnableRefreshToken"];
+    if (refreshTokenBool && [refreshTokenBool respondsToSelector: @selector (boolValue)])
+        openIdEnableRefreshToken = [refreshTokenBool boolValue];
 
-  // //Access token
-  // accessToken = nil;
+    sendDomainInfo = NO;
+    domainInfo = [_config objectForKey: @"SOGoOpenIdSendDomainInfo"];
+    if (domainInfo && [domainInfo respondsToSelector: @selector (boolValue)])
+        sendDomainInfo = [domainInfo boolValue];
+
+      
+    userTokenInterval        = [_config objectForKey: @"SOGoOpenIdTokenCheckInterval"];
+    [self _loadSessionFromCache: forDomain];
+
+    if(cacheUpdateNeeded)
+    {
+      [self fecthConfiguration: forDomain];
+    }
+  }
+  else
+  {
+    [self errorWithFormat: @"Missing parameters from sogo.conf"];
+  }
+}
+
+- (void) initialize: (NSString*) _domain
+{
+  SOGoSystemDefaults *sd;
+  NSDictionary *config;
+  NSString *type;
 
   sd = [SOGoSystemDefaults sharedSystemDefaults];
   SOGoOpenIDDebugEnabled = [sd openIdDebugEnabled];
   openIdSessionIsOK = NO;
-  if ([[self class] checkUserConfig])
+
+  //Check if there is a root config or config per domain
+  if(_domain != nil && [sd doesLoginTypeByDomain])
+  {
+    forDomain = _domain;
+    type = [sd getLoginTypeForDomain: _domain];
+    if(type != nil && [type isEqualToString: @"openid"])
+    {
+      config = [sd getLoginConfigForDomain: _domain];
+      [self initializeWithConfig: config];
+    }
+    else
+    {
+      [self errorWithFormat: @"Missing parameters from sogo.conf"];
+    }
+  }
+  else if ([[self class] checkUserConfig])
   {
     openIdConfigUrl          = [sd openIdConfigUrl];
     openIdScope              = [sd openIdScope];
@@ -86,12 +130,14 @@ static BOOL SOGoOpenIDDebugEnabled = YES;
     openIdEmailParam         = [sd openIdEmailParam];
     openIdEnableRefreshToken = [sd openIdEnableRefreshToken];
     userTokenInterval        = [sd openIdTokenCheckInterval];
+    sendDomainInfo           = [sd openIdSendDomainInfo];
+    forDomain = _domain;
 
-    [self _loadSessionFromCache];
+    [self _loadSessionFromCache: _domain];
 
     if(cacheUpdateNeeded)
     {
-      [self fecthConfiguration];
+      [self fecthConfiguration: _domain];
     }
       
   }
@@ -101,6 +147,7 @@ static BOOL SOGoOpenIDDebugEnabled = YES;
   }
 }
 
+
 - (WOResponse *) _performOpenIdRequest: (NSString *) endpoint
                         method: (NSString *) method
                        headers: (NSDictionary *) headers
@@ -112,16 +159,16 @@ static BOOL SOGoOpenIDDebugEnabled = YES;
   WOResponse *response;
   WOHTTPConnection *httpConnection;
   
-
+  
   url = [NSURL URLWithString: endpoint];
   if (url)
   {
     if(SOGoOpenIDDebugEnabled)
     {
-      NSLog(@"OpenId perform request: %@ %@", method, [endpoint hostlessURL]);
+      NSLog(@"OpenId perform request: %@ %@", method, endpoint);
       NSLog(@"OpenId perform request, headers %@", headers);
-      if(body)
-        NSLog(@"OpenId perform request: content %@", [[NSString alloc] initWithData:body encoding:NSUTF8StringEncoding]);
+      // if(body)
+      //   NSLog(@"OpenId perform request: content %@", [[NSString alloc] initWithData:body encoding:NSUTF8StringEncoding]);
     }
       
     httpConnection = [[WOHTTPConnection alloc] initWithURL: url];
@@ -156,13 +203,13 @@ static BOOL SOGoOpenIDDebugEnabled = YES;
   }
 }
 
-- (NSMutableDictionary *) fecthConfiguration
+- (NSMutableDictionary *) fecthConfiguration: (NSString*) _domain
 {
-  NSString *location, *content;
+  NSString *content;
   WOResponse * response;
   NSUInteger status;
   NSMutableDictionary *result;
-  NSDictionary *config;
+  NSDictionary *config, *headers;
   NSURL *url;
 
   result = [NSMutableDictionary dictionary];
@@ -171,9 +218,14 @@ static BOOL SOGoOpenIDDebugEnabled = YES;
   url = [NSURL URLWithString: self->openIdConfigUrl ];
   if (url)
   {
+    if(self->sendDomainInfo && _domain != nil && [_domain length] > 0)
+      headers = [NSDictionary dictionaryWithObject: _domain forKey: @"sogo-user-domain"];
+    else
+      headers = nil;
+
     response = [self _performOpenIdRequest: self->openIdConfigUrl 
                       method: @"GET"
-                      headers: nil
+                      headers: headers
                         body: nil];
 
     if (response)
@@ -185,12 +237,17 @@ static BOOL SOGoOpenIDDebugEnabled = YES;
         config = [content objectFromJSONString];
         self->authorizationEndpoint = [config objectForKey: @"authorization_endpoint"];
         self->tokenEndpoint         = [config objectForKey: @"token_endpoint"];
-        self->introspectionEndpoint = [config objectForKey: @"introspection_endpoint"];
         self->userinfoEndpoint      = [config objectForKey: @"userinfo_endpoint"];
         self->endSessionEndpoint    = [config objectForKey: @"end_session_endpoint"];
-        self->revocationEndpoint    = [config objectForKey: @"revocation_endpoint"];
+
+        //Optionnals?
+        if([config objectForKey: @"introspection_endpoint"])
+          self->introspectionEndpoint = [config objectForKey: @"introspection_endpoint"];
+        if([config objectForKey: @"revocation_endpoint"])
+          self->revocationEndpoint    = [config objectForKey: @"revocation_endpoint"];
+
         openIdSessionIsOK = YES;
-        [self _saveSessionToCache];
+        [self _saveSessionToCache: _domain];
       }
       else
       {
@@ -206,18 +263,29 @@ static BOOL SOGoOpenIDDebugEnabled = YES;
   return result;
 }
 
-+ (SOGoOpenIdSession *) OpenIdSession
++ (SOGoOpenIdSession *) OpenIdSession: (NSString *) _domain
 {
   SOGoOpenIdSession *newSession;
 
   newSession = [self new];
   [newSession autorelease];
-  [newSession initialize];
+  [newSession initialize: _domain];
 
   return newSession;
 }
 
-+ (SOGoOpenIdSession *) OpenIdSessionWithToken: (NSString *) token
++ (SOGoOpenIdSession *) OpenIdSessionWithConfig: (NSDictionary *) _config
+{
+  SOGoOpenIdSession *newSession;
+
+  newSession = [self new];
+  [newSession autorelease];
+  [newSession initializeWithConfig: _config];
+
+  return newSession;
+}
+
++ (SOGoOpenIdSession *) OpenIdSessionWithToken: (NSString *) token domain: (NSString *) _domain
 {
   SOGoOpenIdSession *newSession;
 
@@ -225,7 +293,7 @@ static BOOL SOGoOpenIDDebugEnabled = YES;
     {
       newSession = [self new];
       [newSession autorelease];
-      [newSession initialize];
+      [newSession initialize: _domain];
       
       [newSession setAccessToken: token];
     }
@@ -235,52 +303,90 @@ static BOOL SOGoOpenIDDebugEnabled = YES;
   return newSession;
 }
 
++ (SOGoOpenIdSession *) OpenIdSessionWithTokenAndConfig: (NSString *) token config: (NSDictionary *) _config
+{
+  SOGoOpenIdSession *newSession;
+
+  if (token)
+    {
+      newSession = [self new];
+      [newSession autorelease];
+      [newSession initializeWithConfig: _config];
+      
+      [newSession setAccessToken: token];
+    }
+  else
+    newSession = nil;
+
+  return newSession;
+}
+
+
 - (BOOL) sessionIsOk
 {
   return self->openIdSessionIsOK;
 }
 
-- (void) _loadSessionFromCache
+- (void) _loadSessionFromCache: (NSString*) _domain
 {
   SOGoCache *cache;
-  NSString *jsonSession;
+  NSString *jsonSession, *cacheKey;
   NSDictionary *sessionDict;
 
+  if(_domain != nil && [_domain length] > 0)
+    cacheKey = [self->openIdConfigUrl stringByAppendingFormat: @":%@", _domain];
+  else
+    cacheKey = self->openIdConfigUrl;
+
   cache = [SOGoCache sharedCache];
-  jsonSession = [cache openIdSessionFromServer: self->openIdConfigUrl];
+  jsonSession = [cache openIdSessionFromServer: cacheKey];
   if ([jsonSession length])
   {
     sessionDict = [jsonSession objectFromJSONString];
     ASSIGN (authorizationEndpoint, [sessionDict objectForKey: @"authorization_endpoint"]);
     ASSIGN (tokenEndpoint, [sessionDict objectForKey: @"token_endpoint"]);
-    ASSIGN (introspectionEndpoint, [sessionDict objectForKey: @"introspection_endpoint"]);
     ASSIGN (userinfoEndpoint, [sessionDict objectForKey: @"userinfo_endpoint"]);
     ASSIGN (endSessionEndpoint, [sessionDict objectForKey: @"end_session_endpoint"]);
-    ASSIGN (revocationEndpoint, [sessionDict objectForKey: @"revocation_endpoint"]);
+
+    //Optionnals?
+    if([sessionDict objectForKey: @"introspection_endpoint"])
+      ASSIGN (introspectionEndpoint, [sessionDict objectForKey: @"introspection_endpoint"]);
+    if([sessionDict objectForKey: @"revocation_endpoint"])
+      ASSIGN (revocationEndpoint, [sessionDict objectForKey: @"revocation_endpoint"]);
     openIdSessionIsOK = YES;
   }
   else
     cacheUpdateNeeded = YES;
 }
 
-- (void) _saveSessionToCache
+- (void) _saveSessionToCache: (NSString*) _domain
 {
   SOGoCache *cache;
-  NSString *jsonSession;
+  NSString *jsonSession, *cacheKey;
   NSMutableDictionary *sessionDict;
 
   cache = [SOGoCache sharedCache];
   sessionDict = [NSMutableDictionary dictionary];
   [sessionDict setObject: authorizationEndpoint forKey: @"authorization_endpoint"];
   [sessionDict setObject: tokenEndpoint forKey: @"token_endpoint"];
-  [sessionDict setObject: introspectionEndpoint forKey: @"introspection_endpoint"];
   [sessionDict setObject: userinfoEndpoint forKey: @"userinfo_endpoint"];
   [sessionDict setObject: endSessionEndpoint forKey: @"end_session_endpoint"];
-  [sessionDict setObject: revocationEndpoint forKey: @"revocation_endpoint"];
+
+  //Optionnals?
+  if(introspectionEndpoint)
+    [sessionDict setObject: introspectionEndpoint forKey: @"introspection_endpoint"];
+  if(revocationEndpoint)
+    [sessionDict setObject: revocationEndpoint forKey: @"revocation_endpoint"];
 
   jsonSession = [sessionDict jsonRepresentation];
+
+  if(_domain != nil && [_domain length] > 0)
+    cacheKey = [self->openIdConfigUrl stringByAppendingFormat: @":%@", _domain];
+  else
+    cacheKey = self->openIdConfigUrl;
+
   [cache setOpenIdSession: jsonSession
-         forServer: self->openIdConfigUrl];
+                forServer: cacheKey];
 }
 
 
@@ -332,6 +438,8 @@ static BOOL SOGoOpenIDDebugEnabled = YES;
   logUrl = [logUrl stringByAppendingString: @"&response_type=code"];
   logUrl = [logUrl stringByAppendingFormat: @"&client_id=%@", self->openIdClient];
   logUrl = [logUrl stringByAppendingFormat: @"&redirect_uri=%@", oldLocation];
+  if(self->forDomain != nil && [self->forDomain length] > 0)
+    logUrl = [logUrl stringByAppendingFormat: @"&sogo_domain=%@", forDomain];
   // logurl = [self->logurl stringByAppendingFormat: @"&state=%@", state];
 
   return logUrl;
@@ -397,7 +505,11 @@ static BOOL SOGoOpenIDDebugEnabled = YES;
     form = [form stringByAppendingFormat: @"&client_secret=%@", self->openIdClientSecret];
     form = [form stringByAppendingFormat: @"&client_id=%@", self->openIdClient];
 
-    headers = [NSDictionary dictionaryWithObject: @"application/x-www-form-urlencoded"  forKey: @"content-type"];
+    if(self->sendDomainInfo && self->forDomain != nil && [self->forDomain length] > 0)
+      headers = [NSDictionary dictionaryWithObjectsAndKeys: @"application/x-www-form-urlencoded", @"content-type",
+                                                                self->forDomain, @"sogo-user-domain", nil];
+    else
+      headers = [NSDictionary dictionaryWithObject: @"application/x-www-form-urlencoded"  forKey: @"content-type"];
     
     response = [self _performOpenIdRequest: location
                       method: @"POST"
@@ -467,7 +579,11 @@ static BOOL SOGoOpenIDDebugEnabled = YES;
     form = [form stringByAppendingFormat: @"&client_secret=%@", self->openIdClientSecret];
     form = [form stringByAppendingFormat: @"&client_id=%@", self->openIdClient];
 
-    headers = [NSDictionary dictionaryWithObject: @"application/x-www-form-urlencoded"  forKey: @"content-type"];
+    if(self->sendDomainInfo && self->forDomain != nil && [self->forDomain length] > 0)
+      headers = [NSDictionary dictionaryWithObjectsAndKeys: @"application/x-www-form-urlencoded", @"content-type",
+                                                                self->forDomain, @"sogo-user-domain", nil];
+    else
+      headers = [NSDictionary dictionaryWithObject: @"application/x-www-form-urlencoded"  forKey: @"content-type"];
     
     response = [self _performOpenIdRequest: location
                       method: @"POST"
@@ -525,7 +641,13 @@ static BOOL SOGoOpenIDDebugEnabled = YES;
   if (url)
   {
     auth = [NSString stringWithFormat: @"Bearer %@", self->accessToken];
-    headers = [NSDictionary dictionaryWithObject: auth forKey: @"authorization"];
+    if(self->sendDomainInfo && self->forDomain != nil && [self->forDomain length] > 0)
+      headers = [NSDictionary dictionaryWithObjectsAndKeys: @"application/x-www-form-urlencoded", @"content-type",
+                                                                self->forDomain, @"sogo-user-domain",
+                                                                auth, @"authorization", nil];
+    else
+      headers = [NSDictionary dictionaryWithObjectsAndKeys: @"application/x-www-form-urlencoded", @"content-type",
+                                                                auth, @"authorization", nil];
 
     response = [self _performOpenIdRequest: location
                        method: @"GET"
@@ -646,7 +768,7 @@ static BOOL SOGoOpenIDDebugEnabled = YES;
   return @"anonymous";
 }
 
-- (BOOL) login: (NSString *) email
+- (NSString *) login: (NSString *) email
 {
   //Check if we need to fetch userinfo
   if(self->userTokenInterval > 0 && [self _loadUserFromCache: email])

SoObjects/SOGo/SOGoSession.m

@@ -247,12 +247,20 @@
 			      usingKey: theKey];
   
   r = [decodedValue rangeOfString: @":"];
-  *theLogin = [decodedValue substringToIndex: r.location];
-  *thePassword = [decodedValue substringFromIndex: r.location+1];
+  if (r.location != NSNotFound) 
+  {
+    *theLogin = [decodedValue substringToIndex: r.location];
+    *thePassword = [decodedValue substringFromIndex: r.location+1];
+  }
+  else
+  {
+    *theLogin = nil;
+    *thePassword = nil;
+  }
   *theDomain = nil;
-  
+
   sd = [SOGoSystemDefaults sharedSystemDefaults];
-  if ([sd enableDomainBasedUID])
+  if (*theLogin &&[sd enableDomainBasedUID])
     {
       r = [*theLogin rangeOfString: @"@" options: NSBackwardsSearch];
       if (r.location != NSNotFound)

SoObjects/SOGo/SOGoSieveManager.m

@@ -28,6 +28,7 @@
 #import <SOGo/NSDictionary+Utilities.h>
 #import <SOGo/NSString+Utilities.h>
 #import <SOGo/SOGoDomainDefaults.h>
+#import <SOGo/SOGoSystemDefaults.h>
 #import <SOGo/SOGoUser.h>
 #import <SOGo/SOGoTextTemplateFile.h>
 
@@ -697,8 +698,11 @@ static NSString *sieveScriptName = @"sogo";
   NSDictionary *result;
   NSString *login, *authname, *password;
   SOGoDomainDefaults *dd;
+  SOGoSystemDefaults *sd;
   NGSieveClient *client;
   NSString *sieveServer, *sieveScheme, *sieveQuery, *imapServer;
+  NSString *imapAuthMech, *userDomain;
+  NSRange r;
   NSURL *url, *cUrl;
   int sievePort;
   BOOL connected;
@@ -773,7 +777,20 @@ static NSString *sieveScriptName = @"sogo";
   url = [NSURL URLWithString: [NSString stringWithFormat: @"%@://%@:%d%@",
                                sieveScheme, sieveServer, sievePort, sieveQuery]];
 
-  client = [[NGSieveClient alloc] initWithURL: url];
+  //In case of differrent auth method for different domain, check it
+  sd = [SOGoSystemDefaults sharedSystemDefaults];
+  imapAuthMech = nil;
+  if([sd doesLoginTypeByDomain])
+  {
+    r = [theUsername rangeOfString: @"@"];
+    if (r.location != NSNotFound)
+    {
+      userDomain = [theUsername substringFromIndex: r.location+1];
+      imapAuthMech = [sd getImapAuthMechForDomain: userDomain];
+    }
+  }
+
+  client = [[NGSieveClient alloc] initWithURL: url andAuthMech: imapAuthMech];
 
   if (!client) {
     [self errorWithFormat: @"Sieve connection failed on %@", [url description]];

SoObjects/SOGo/SOGoSystemDefaults.h

@@ -36,6 +36,11 @@ static const NSString *kDisableSharingCalendar = @"Calendar";
 + (SOGoSystemDefaults *) sharedSystemDefaults;
 
 - (NSArray *) domainIds;
+- (BOOL) doesLoginTypeByDomain;
+- (NSString *) getLoginTypeForDomain: (NSString*) _domain;
+- (NSString *) getLoginConfigForDomain: (NSDictionary*) _domain;
+- (NSString *) getImapAuthMechForDomain: (NSString*) _domain;
+- (NSString *) getSmtpAuthMechForDomain: (NSString*) _domain;
 - (BOOL) forbidUnknownDomainsAuth;
 - (NSArray *) domainsAllowed;
 - (BOOL) enableDomainBasedUID;
@@ -90,7 +95,7 @@ NSComparisonResult languageSort(id el1, id el2, void *context);
 - (NSString *) loginSuffix;
 
 - (NSString *) authenticationType;
-- (BOOL) isSsoUsed;
+- (BOOL) isSsoUsed: (NSString *) domain;
 - (NSString *) davAuthenticationType;
 
 - (NSString *) CASServiceURL;
@@ -102,8 +107,9 @@ NSComparisonResult languageSort(id el1, id el2, void *context);
 - (NSString *) openIdClientSecret;
 - (NSString *) openIdEmailParam;
 - (BOOL) openIdEnableRefreshToken;
-- (BOOL) openIdLogoutEnabled;
+- (BOOL) openIdLogoutEnabled: (NSString *) _domain;
 - (int) openIdTokenCheckInterval;
+- (BOOL) openIdSendDomainInfo;
 
 - (NSString *) SAML2PrivateKeyLocation;
 - (NSString *) SAML2CertificateLocation;

SoObjects/SOGo/SOGoSystemDefaults.m

@@ -262,6 +262,143 @@ _injectConfigurationFromFile (NSMutableDictionary *defaultsDict,
   return [domains allKeys];
 }
 
+- (BOOL) doesLoginTypeByDomain
+{
+  return ([self dictionaryForKey: @"SOGoLoginTypeByDomain"] != nil);
+}
+
+- (NSString *) getLoginTypeForDomain: (NSString*) _domain
+{
+  NSDictionary *domains, *config;
+  NSString *type;
+  if(![self doesLoginTypeByDomain])
+    return nil;
+  domains = [self dictionaryForKey: @"SOGoLoginTypeByDomain"];
+  if([domains objectForKey: _domain])
+  {
+    config = [domains objectForKey: _domain];
+  }
+  else if([domains objectForKey: @"login_default"])
+  {
+    config = [domains objectForKey: @"login_default"];
+  }
+  else
+    return nil;
+
+  if((type = [config objectForKey: @"type"]))
+  {
+    return type;
+  }
+  else
+    return nil;
+}
+
+- (NSString *) getImapAuthMechForDomain: (NSString*) _domain
+{
+  NSDictionary *domains, *config;
+  NSString *type;
+
+  if(![self doesLoginTypeByDomain])
+    return nil;
+
+  domains = [self dictionaryForKey: @"SOGoLoginTypeByDomain"];
+
+  if([domains objectForKey: _domain])
+  {
+    config = [domains objectForKey: _domain];
+  }
+  else if([domains objectForKey: @"login_default"])
+  {
+    config = [domains objectForKey: @"login_default"];
+  }
+  else
+    return nil;
+
+  if((type = [config objectForKey: @"imapAuthMech"]))
+  {
+    return type;
+  }
+  else
+    return nil;
+}
+
+- (NSString *) getSmtpAuthMechForDomain: (NSString*) _domain
+{
+  NSDictionary *domains, *config;
+  NSString *type;
+  
+  if(![self doesLoginTypeByDomain])
+    return nil;
+
+  domains = [self dictionaryForKey: @"SOGoLoginTypeByDomain"];
+
+  if([domains objectForKey: _domain])
+  {
+    config = [domains objectForKey: _domain];
+  }
+  else if([domains objectForKey: @"login_default"])
+  {
+    config = [domains objectForKey: @"login_default"];
+  }
+  else
+    return nil;
+
+  if((type = [config objectForKey: @"smtpAuthMech"]))
+  {
+    return type;
+  }
+  else
+    return nil;
+}
+
+- (NSString *) getLoginConfigForDomain: (NSDictionary*) _domain
+{
+  NSDictionary *domains, *config;
+  if(![self doesLoginTypeByDomain])
+    return nil;
+  domains = [self dictionaryForKey: @"SOGoLoginTypeByDomain"];
+  if([domains objectForKey: _domain])
+  {
+    config = [domains objectForKey: _domain];
+  }
+  else if([domains objectForKey: @"login_default"])
+  {
+    config = [domains objectForKey: @"login_default"];
+  }
+  
+  if(config)
+    return config;
+  else
+    return nil;
+}
+
+- (BOOL) hasOpenIdType
+{
+  if([self doesLoginTypeByDomain])
+  {
+    NSDictionary *domainsConfig;
+    NSEnumerator *e; 
+    NSString *domain, *type;
+    if(![self doesLoginTypeByDomain])
+      return NO;
+    domainsConfig = [self dictionaryForKey: @"SOGoLoginTypeByDomain"];
+    e = [domainsConfig keyEnumerator];
+    while((domain = [e nextObject]))
+    {
+      if((type = [[domainsConfig objectForKey: domain] objectForKey: @"type"]))
+      {
+        if([type isEqualToString: @"openid"])
+          return YES;
+      }
+    }
+    return NO;
+  }
+  else
+    return [[self authenticationType] isEqualToString: @"openid"];
+
+}
+
+
 - (BOOL) enableDomainBasedUID
 {
   return [self boolForKey: @"SOGoEnableDomainBasedUID"];
@@ -587,11 +724,13 @@ NSComparisonResult languageSort(id el1, id el2, void *context)
   return [[self stringForKey: @"SOGoAuthenticationType"] lowercaseString];
 }
 
-- (BOOL) isSsoUsed
+- (BOOL) isSsoUsed: (NSString *) domain
 {
   NSString* authType;
-  authType = [self authenticationType];
 
+  authType = [self getLoginTypeForDomain: domain];
+  if(!authType)
+    authType = [self authenticationType];
   return ([authType isEqualToString: @"cas"] || [authType isEqualToString: @"saml2"] || [authType isEqualToString: @"openid"]);
 }
 
@@ -640,11 +779,28 @@ NSComparisonResult languageSort(id el1, id el2, void *context)
   return emailParam;
 }
 
-- (BOOL) openIdLogoutEnabled
+- (BOOL) openIdLogoutEnabled: (NSString *) _domain
 {
+  if(_domain && [self doesLoginTypeByDomain])
+  {
+    NSDictionary *config;
+    NSString *type;
+    id value;
+    if((config = [self getLoginConfigForDomain: _domain]))
+    {
+      if((type = [config objectForKey: @"type"]) && [type isEqualToString:@"openid"])
+        return [self boolForKey: @"SOGoOpenIdLogoutEnabled" andDict: config];
+    }
+    return NO;
+  }
   return [self boolForKey: @"SOGoOpenIdLogoutEnabled"];
 }
 
+- (BOOL) openIdSendDomainInfo
+{
+  return [self boolForKey: @"SOGoOpenIdSendDomainInfo"];
+}
+
 - (int) openIdTokenCheckInterval
 {
 

SoObjects/SOGo/SOGoUser.h

@@ -91,6 +91,7 @@
 
 /* properties */
 - (NSString *) domain;
+- (NSString *) loginDomain;
 - (id <SOGoSource>) authenticationSource;
 
 - (NSArray *) allEmails;

SoObjects/SOGo/SOGoUser.m

@@ -301,6 +301,19 @@ static const NSString *kEncryptedUserNamePrefix = @"uenc";
   return [self _fetchFieldForUser: @"c_domain"];
 }
 
+- (NSString *) loginDomain
+{
+    NSRange r;
+    NSString *domain = nil;
+    r = [self->login rangeOfString: @"@"];
+    if (r.location != NSNotFound)
+    {
+        domain = [self->login substringFromIndex: r.location+1];
+    }
+    return domain;
+}
+
+
 - (id <SOGoSource>) authenticationSource
 {
   NSString *sourceID;

SoObjects/SOGo/SOGoWebAuthenticator.h

@@ -27,6 +27,7 @@
 #import "SOGoConstants.h"
 
 @class NSString;
+@class NSMutableDictionary;
 
 @class WOContext;
 @class WOCookie;

SoObjects/SOGo/SOGoWebAuthenticator.m

@@ -138,11 +138,33 @@
   SOGoOpenIdSession * openIdSession;
   SOGoSystemDefaults *sd;
   NSString *authenticationType;
+  NSString* loginDomain;
   BOOL rc;
 
   sd = [SOGoSystemDefaults sharedSystemDefaults];
+  
+  //Basic check
+  if(!_login)
+    return NO;
+  if(_login && [_login length] == 0)
+    return NO;
+
+  loginDomain = nil;
+  if(*_domain == nil || [*_domain length] == 0)
+  {
+      NSRange r;
+      r = [_login rangeOfString: @"@"];
+      if (r.location != NSNotFound)
+      {
+        loginDomain = [_login substringFromIndex: r.location+1];
+      }
+  }
+
+  if([sd doesLoginTypeByDomain])
+    authenticationType = [sd getLoginTypeForDomain: loginDomain];
+  else
+    authenticationType = [sd authenticationType];
 
-  authenticationType = [sd authenticationType];
   if ([authenticationType isEqualToString: @"cas"])
     {
       casSession = [SOGoCASSession CASSessionWithIdentifier: _pwd fromProxy: NO];
@@ -153,7 +175,7 @@
     }
   else if ([authenticationType isEqualToString: @"openid"])
   {
-    openIdSession = [SOGoOpenIdSession OpenIdSessionWithToken: _pwd];
+    openIdSession = [SOGoOpenIdSession OpenIdSessionWithToken: _pwd domain: loginDomain];
     if (openIdSession)
       rc = [[openIdSession login: _login] isEqualToString: _login];
     else
@@ -180,7 +202,6 @@
                                                    grace: _grace
                                           additionalInfo: _additionalInfo
                                                 useCache: _useCache];
-  
   //[self logWithFormat: @"Checked login with ppolicy enabled: %d %d %d", *_perr, *_expire, *_grace];
   
   // It's important to return the real value here. The callee will handle
@@ -259,7 +280,8 @@
                      login: &login
                     domain: &domain
                   password: &pwd];
-  
+
+
   if (![self checkLogin: login
                password: pwd
                  domain: &domain
@@ -282,32 +304,42 @@
 {
   NSString *authType, *password;
   SOGoSystemDefaults *sd;
+  SOGoUser *user;
+  NSRange r;
+  NSString *loginDomain, *login;
  
   password = [self passwordInContext: context];
   if ([password length])
     {
+      user = [self userInContext: context];
+      login = [user loginInDomain];
+      r = [login rangeOfString: @"@"];
+      if (r.location != NSNotFound)
+        loginDomain = [login substringFromIndex: r.location+1];
+      else
+        loginDomain = nil;
+
       sd = [SOGoSystemDefaults sharedSystemDefaults];
-      authType = [sd authenticationType];
+      if([sd doesLoginTypeByDomain])
+        authType = [sd getLoginTypeForDomain: loginDomain];
+      else
+        authType = [sd authenticationType];
+
       if ([authType isEqualToString: @"cas"])
         {
           SOGoCASSession *session;
-          SOGoUser *user;
           NSString *service, *scheme;
 
           session = [SOGoCASSession CASSessionWithIdentifier: password
                                                    fromProxy: NO];
-
-          user = [self userInContext: context];
           // Try configured CAS service name first
           service = [[user domainDefaults] imapCASServiceName];
           if (!service)
             {
               // We must NOT assume the scheme exists
               scheme = [server scheme];
-
               if (!scheme)
                 scheme = @"imap";
-
               service = [NSString stringWithFormat: @"%@://%@",
                          scheme, [server host]];
             }
@@ -316,17 +348,16 @@
             [session invalidateTicketForService: service];
 
           password = [session ticketForService: service];
-
           if ([password length] || renew)
             [session updateCache];
         }
       else if ([authType isEqualToString: @"openid"])
       {
         SOGoOpenIdSession* session;
-        NSString* currentToken;
+
         //If the token has been refresh during the request, we need to use the new access_token
         //as the one from the cookie is no more valid
-        session = [SOGoOpenIdSession OpenIdSessionWithToken: password];
+        session = [SOGoOpenIdSession OpenIdSessionWithToken: password domain: loginDomain];
         password = [session getCurrentToken];
       }
 #if defined(SAML2_CONFIG)
@@ -351,6 +382,16 @@
   return password;
 }
 
+- (NSString *) smtpPasswordInContext: (WOContext *) context
+                              forURL: (NSURL *) server
+{
+  NSString *password;
+
+  password = [self imapPasswordInContext: context forURL: server forceRenew:NO];
+
+  return password;
+}
+
 /* create SOGoUser */
 
 - (SOGoUser *) userWithLogin: (NSString *) login
@@ -459,21 +500,36 @@
 {
   NSArray *listCookies = nil;
   SOGoSystemDefaults *sd;
-  NSString *authType;
+  NSString *authType, *username, *login, *loginDomain;
+  NSRange r;
+  SOGoUser *user;
+
+  user = [self userInContext: _ctx];
+  login = [user loginDomain];
+  r = [login rangeOfString: @"@"];
+  if (r.location != NSNotFound)
+    loginDomain = [login substringFromIndex: r.location+1];
+  else
+    loginDomain = nil;
 
   sd = [SOGoSystemDefaults sharedSystemDefaults];
-  authType = [sd authenticationType];
+  if(loginDomain && [sd doesLoginTypeByDomain])
+    authType = [sd getLoginTypeForDomain: loginDomain];
+  else
+    authType = [sd authenticationType];
   if([authType isEqualToString:@"openid"] && [sd openIdEnableRefreshToken])
   {
-    NSString *currentPassword, *newPassword, *username;
+    NSString *currentPassword, *newPassword;
     SOGoOpenIdSession *openIdSession;
-
     WOCookie* newCookie;
+
+
     currentPassword = [self passwordInContext: _ctx];
     newPassword = [self imapPasswordInContext: _ctx forURL: nil forceRenew: NO];
     if(currentPassword && newPassword && ![newPassword isEqualToString: currentPassword])
     {
-      openIdSession = [SOGoOpenIdSession OpenIdSessionWithToken: newPassword];
+
+      openIdSession = [SOGoOpenIdSession OpenIdSessionWithToken: newPassword domain: loginDomain];
       if (openIdSession)
         username = [openIdSession login: @""]; //Force to refresh the name
       else