opendid part2

SoObjects/SOGo/NSDictionary+Utilities.m

@@ -95,6 +95,7 @@
   return keysWithFormat;
 }
 
+
 - (NSComparisonResult) caseInsensitiveDisplayNameCompare: (NSDictionary *) theDictionary
 {
   return [[self objectForKey: @"cn"] caseInsensitiveCompare: [theDictionary objectForKey: @"cn"]];

SoObjects/SOGo/NSString+Utilities.m

@@ -80,7 +80,10 @@ static int cssEscapingCount;
     {
       hostR = [self rangeOfString: @"://"];
       locationR = [[self substringFromIndex: (hostR.location + hostR.length)] rangeOfString: @"/"];
-      newURL = [self substringFromIndex: (hostR.location + hostR.length + locationR.location)];
+      if(locationR.location != NSNotFound)
+        newURL = [self substringFromIndex: (hostR.location + hostR.length + locationR.location)];
+      else
+        newURL = @"";
     }
 
   return newURL;

SoObjects/SOGo/SOGoDefaultsSource.h

@@ -62,6 +62,7 @@ extern NSString *SOGoDefaultsSourceUnmutableSource;
 
 - (void) setBool: (BOOL) value forKey: (NSString *) key;
 - (BOOL) boolForKey: (NSString *) key;
+- (BOOL) boolForKey: (NSString *) key andDict: (NSDictionary*) _dict;
 
 - (void) setFloat: (float) value forKey: (NSString *) key;
 - (float) floatForKey: (NSString *) key;

SoObjects/SOGo/SOGoDefaultsSource.m

@@ -164,6 +164,29 @@ static Class NSStringKlass = Nil;
   return value;
 }
 
+- (BOOL) boolForKey: (NSString *) key andDict: (NSDictionary*) _dict
+{
+  id boolForKey;
+  BOOL value;
+
+  boolForKey = [_dict objectForKey: key];
+  if (boolForKey)
+    {
+      if ([boolForKey respondsToSelector: @selector (boolValue)])
+        value = [boolForKey boolValue];
+      else
+        {
+          [self warnWithFormat: @"expected a boolean for '%@' (ignored)",
+                key];
+          value = NO;
+        }
+    }
+  else
+    value = NO;
+
+  return value;
+}
+
 - (void) setFloat: (float) value
 	   forKey: (NSString *) key
 {

SoObjects/SOGo/SOGoOpenIdSession.h

@@ -25,6 +25,7 @@
    https://openid.net/developers/how-connect-works/ */
 
 #import <NGObjWeb/WOResponse.h>
+#import <SOGo/SOGoObject.h>
 
 
 @class NSString;
@@ -33,7 +34,7 @@
 @class NSJSONSerialization;
 
 
-@interface SOGoOpenIdSession : NSObject
+@interface SOGoOpenIdSession : SOGoObject
 {
   //For cache
   BOOL cacheUpdateNeeded;
@@ -48,6 +49,9 @@
   NSString *openIdEmailParam;
   BOOL openIdEnableRefreshToken;
 
+  NSString *forDomain;
+
+
   //From request to well-known/configuration
   NSString *authorizationEndpoint;
   NSString *tokenEndpoint;
@@ -66,16 +70,20 @@
 }
 
 + (BOOL) checkUserConfig;
-+ (SOGoOpenIdSession *) OpenIdSession;
++ (SOGoOpenIdSession *) OpenIdSession: (NSString *) _domain;
++ (SOGoOpenIdSession *) OpenIdSessionWithConfig: (NSDictionary *) _config;
++ (SOGoOpenIdSession *) OpenIdSessionWithToken: (NSString *) token domain: (NSString *) _domain;
++ (SOGoOpenIdSession *) OpenIdSessionWithTokenAndConfig: (NSString *) token config: (NSDictionary *) _config;
 + (void) deleteValueForSessionKey: (NSString *) theSessionKey;
 
 - (void) initialize;
+- (void) initializeWithConfig: (NSDictionary *) _config;
 - (BOOL) sessionIsOK;
 - (WOResponse *) _performOpenIdRequest: (NSString *) endpoint
                         method: (NSString *) method
                        headers: (NSDictionary *) headers
                           body: (NSData *) body;
-- (NSMutableDictionary *) fecthConfiguration;
+- (NSMutableDictionary *) fecthConfiguration: (NSString *) _domain;
 - (void) setAccessToken;
 - (NSString *) getRefreshToken; 
 - (NSString *) getToken;

SoObjects/SOGo/SOGoOpenIdSession.m

@@ -23,6 +23,9 @@
 #import <NGObjWeb/WOResponse.h>
 #import <NGExtensions/NSObject+Logs.h>
 
+#import <SOGo/SOGoUser.h>
+
+
 #import <GDLContentStore/GCSOpenIdFolder.h>
 #import <GDLContentStore/GCSFolderManager.h>
 
@@ -52,32 +55,67 @@ static BOOL SOGoOpenIDDebugEnabled = YES;
   return ([sd openIdConfigUrl] && [sd openIdScope]  && [sd openIdClient]  && [sd openIdClientSecret]);
 }
 
-- (void) initialize
+- (void) initializeWithConfig: (NSDictionary *) _config
 {
   SOGoSystemDefaults *sd;
+  id refreshTokenBool;
 
-  // //From sogo.conf
-  // openIdConfigUrl = nil;
-  // openIdScope = nil;
-  // openIdClient = nil;
-  // openIdClientSecret = nil;
+  if([_config objectForKey: @"SOGoOpenIdConfigUrl"] &&
+      [_config objectForKey: @"SOGoOpenIdScope"] &&
+      [_config objectForKey: @"SOGoOpenIdClient"] &&
+      [_config objectForKey: @"SOGoOpenIdClientSecret"])
+  {
+    openIdConfigUrl          = [_config objectForKey: @"SOGoOpenIdConfigUrl"];
+    openIdScope              = [_config objectForKey: @"SOGoOpenIdScope"];
+    openIdClient             = [_config objectForKey: @"SOGoOpenIdClient"];
+    openIdClientSecret       = [_config objectForKey: @"SOGoOpenIdClientSecret"];
+    openIdEmailParam         = [_config objectForKey: @"SOGoOpenIdEmailParam"];
 
-  // //From request to well-known/configuration
-  // //SHoud be ste in sogo.cong in case of oauth
-  // authorizationEndpoint = nil;
-  // tokenEndpoint = nil;
-  // introspectionEndpoint = nil;
-  // userinfoEndpoint = nil;
-  // endSessionEndpoint = nil;
-  // revocationEndpoint = nil;
+    openIdEnableRefreshToken = NO;
+    refreshTokenBool = [_config objectForKey: @"SOGoOpenIdEnableRefreshToken"];
+    if (refreshTokenBool && [refreshTokenBool respondsToSelector: @selector (boolValue)])
+        openIdEnableRefreshToken = [refreshTokenBool boolValue];
 
-  // //Access token
-  // accessToken = nil;
+    userTokenInterval        = [_config objectForKey: @"SOGoOpenIdTokenCheckInterval"];
+    [self _loadSessionFromCache: forDomain];
+
+    if(cacheUpdateNeeded)
+    {
+      [self fecthConfiguration: forDomain];
+    }
+  }
+  else
+  {
+    [self errorWithFormat: @"Missing parameters from sogo.conf"];
+  }
+}
+
+- (void) initialize: (NSString*) _domain
+{
+  SOGoSystemDefaults *sd;
+  NSDictionary *config;
+  NSString *type;
 
   sd = [SOGoSystemDefaults sharedSystemDefaults];
   SOGoOpenIDDebugEnabled = [sd openIdDebugEnabled];
   openIdSessionIsOK = NO;
-  if ([[self class] checkUserConfig])
+
+  //Check if there is a root config or config per domain
+  if(_domain != nil && [sd doesLoginTypeByDomain])
+  {
+    forDomain = _domain;
+    type = [sd getLoginTypeForDomain: _domain];
+    if(type != nil && [type isEqualToString: @"openid"])
+    {
+      config = [sd getLoginConfigForDomain: _domain];
+      [self initializeWithConfig: config];
+    }
+    else
+    {
+      [self errorWithFormat: @"Missing parameters from sogo.conf"];
+    }
+  }
+  else if ([[self class] checkUserConfig])
   {
     openIdConfigUrl          = [sd openIdConfigUrl];
     openIdScope              = [sd openIdScope];
@@ -86,12 +124,13 @@ static BOOL SOGoOpenIDDebugEnabled = YES;
     openIdEmailParam         = [sd openIdEmailParam];
     openIdEnableRefreshToken = [sd openIdEnableRefreshToken];
     userTokenInterval        = [sd openIdTokenCheckInterval];
+    forDomain = _domain;
 
-    [self _loadSessionFromCache];
+    [self _loadSessionFromCache: _domain];
 
     if(cacheUpdateNeeded)
     {
-      [self fecthConfiguration];
+      [self fecthConfiguration: _domain];
     }
       
   }
@@ -101,6 +140,13 @@ static BOOL SOGoOpenIDDebugEnabled = YES;
   }
 }
 
+- (NSString *) _get_user_domain
+{
+  SOGoUser* user = [[context activeUser] login];
+  NSLog(@"user is %@", user);
+
+}
+
 - (WOResponse *) _performOpenIdRequest: (NSString *) endpoint
                         method: (NSString *) method
                        headers: (NSDictionary *) headers
@@ -112,13 +158,14 @@ static BOOL SOGoOpenIDDebugEnabled = YES;
   WOResponse *response;
   WOHTTPConnection *httpConnection;
   
-
+  
+  [self _get_user_domain];
   url = [NSURL URLWithString: endpoint];
   if (url)
   {
     if(SOGoOpenIDDebugEnabled)
     {
-      NSLog(@"OpenId perform request: %@ %@", method, [endpoint hostlessURL]);
+      NSLog(@"OpenId perform request: %@ %@", method, endpoint);
       NSLog(@"OpenId perform request, headers %@", headers);
       if(body)
         NSLog(@"OpenId perform request: content %@", [[NSString alloc] initWithData:body encoding:NSUTF8StringEncoding]);
@@ -156,13 +203,13 @@ static BOOL SOGoOpenIDDebugEnabled = YES;
   }
 }
 
-- (NSMutableDictionary *) fecthConfiguration
+- (NSMutableDictionary *) fecthConfiguration: (NSString*) _domain
 {
-  NSString *location, *content;
+  NSString *content;
   WOResponse * response;
   NSUInteger status;
   NSMutableDictionary *result;
-  NSDictionary *config;
+  NSDictionary *config, *headers;
   NSURL *url;
 
   result = [NSMutableDictionary dictionary];
@@ -171,9 +218,14 @@ static BOOL SOGoOpenIDDebugEnabled = YES;
   url = [NSURL URLWithString: self->openIdConfigUrl ];
   if (url)
   {
+    if(_domain != nil && [_domain length] > 0)
+      headers = [NSDictionary dictionaryWithObject: _domain forKey: @"sogo-user-domain"];
+    else
+      headers = nil;
+
     response = [self _performOpenIdRequest: self->openIdConfigUrl 
                       method: @"GET"
-                      headers: nil
+                      headers: headers
                         body: nil];
 
     if (response)
@@ -185,12 +237,17 @@ static BOOL SOGoOpenIDDebugEnabled = YES;
         config = [content objectFromJSONString];
         self->authorizationEndpoint = [config objectForKey: @"authorization_endpoint"];
         self->tokenEndpoint         = [config objectForKey: @"token_endpoint"];
-        self->introspectionEndpoint = [config objectForKey: @"introspection_endpoint"];
         self->userinfoEndpoint      = [config objectForKey: @"userinfo_endpoint"];
         self->endSessionEndpoint    = [config objectForKey: @"end_session_endpoint"];
-        self->revocationEndpoint    = [config objectForKey: @"revocation_endpoint"];
+
+        //Optionnals?
+        if([config objectForKey: @"introspection_endpoint"])
+          self->introspectionEndpoint = [config objectForKey: @"introspection_endpoint"];
+        if([config objectForKey: @"revocation_endpoint"])
+          self->revocationEndpoint    = [config objectForKey: @"revocation_endpoint"];
+
         openIdSessionIsOK = YES;
-        [self _saveSessionToCache];
+        [self _saveSessionToCache: _domain];
       }
       else
       {
@@ -206,18 +263,29 @@ static BOOL SOGoOpenIDDebugEnabled = YES;
   return result;
 }
 
-+ (SOGoOpenIdSession *) OpenIdSession
++ (SOGoOpenIdSession *) OpenIdSession: (NSString *) _domain
 {
   SOGoOpenIdSession *newSession;
 
   newSession = [self new];
   [newSession autorelease];
-  [newSession initialize];
+  [newSession initialize: _domain];
 
   return newSession;
 }
 
-+ (SOGoOpenIdSession *) OpenIdSessionWithToken: (NSString *) token
++ (SOGoOpenIdSession *) OpenIdSessionWithConfig: (NSDictionary *) _config
+{
+  SOGoOpenIdSession *newSession;
+
+  newSession = [self new];
+  [newSession autorelease];
+  [newSession initializeWithConfig: _config];
+
+  return newSession;
+}
+
++ (SOGoOpenIdSession *) OpenIdSessionWithToken: (NSString *) token domain: (NSString *) _domain
 {
   SOGoOpenIdSession *newSession;
 
@@ -225,7 +293,7 @@ static BOOL SOGoOpenIDDebugEnabled = YES;
     {
       newSession = [self new];
       [newSession autorelease];
-      [newSession initialize];
+      [newSession initialize: _domain];
       
       [newSession setAccessToken: token];
     }
@@ -235,52 +303,90 @@ static BOOL SOGoOpenIDDebugEnabled = YES;
   return newSession;
 }
 
++ (SOGoOpenIdSession *) OpenIdSessionWithTokenAndConfig: (NSString *) token config: (NSDictionary *) _config
+{
+  SOGoOpenIdSession *newSession;
+
+  if (token)
+    {
+      newSession = [self new];
+      [newSession autorelease];
+      [newSession initializeWithConfig: _config];
+      
+      [newSession setAccessToken: token];
+    }
+  else
+    newSession = nil;
+
+  return newSession;
+}
+
+
 - (BOOL) sessionIsOk
 {
   return self->openIdSessionIsOK;
 }
 
-- (void) _loadSessionFromCache
+- (void) _loadSessionFromCache: (NSString*) _domain
 {
   SOGoCache *cache;
-  NSString *jsonSession;
+  NSString *jsonSession, *cacheKey;
   NSDictionary *sessionDict;
 
+  if(_domain != nil && [_domain length] > 0)
+    cacheKey = [self->openIdConfigUrl stringByAppendingFormat: @":%@", _domain];
+  else
+    cacheKey = self->openIdConfigUrl;
+
   cache = [SOGoCache sharedCache];
-  jsonSession = [cache openIdSessionFromServer: self->openIdConfigUrl];
+  jsonSession = [cache openIdSessionFromServer: cacheKey];
   if ([jsonSession length])
   {
     sessionDict = [jsonSession objectFromJSONString];
     ASSIGN (authorizationEndpoint, [sessionDict objectForKey: @"authorization_endpoint"]);
     ASSIGN (tokenEndpoint, [sessionDict objectForKey: @"token_endpoint"]);
-    ASSIGN (introspectionEndpoint, [sessionDict objectForKey: @"introspection_endpoint"]);
     ASSIGN (userinfoEndpoint, [sessionDict objectForKey: @"userinfo_endpoint"]);
     ASSIGN (endSessionEndpoint, [sessionDict objectForKey: @"end_session_endpoint"]);
-    ASSIGN (revocationEndpoint, [sessionDict objectForKey: @"revocation_endpoint"]);
+
+    //Optionnals?
+    if([sessionDict objectForKey: @"introspection_endpoint"])
+      ASSIGN (introspectionEndpoint, [sessionDict objectForKey: @"introspection_endpoint"]);
+    if([sessionDict objectForKey: @"revocation_endpoint"])
+      ASSIGN (revocationEndpoint, [sessionDict objectForKey: @"revocation_endpoint"]);
     openIdSessionIsOK = YES;
   }
   else
     cacheUpdateNeeded = YES;
 }
 
-- (void) _saveSessionToCache
+- (void) _saveSessionToCache: (NSString*) _domain
 {
   SOGoCache *cache;
-  NSString *jsonSession;
+  NSString *jsonSession, *cacheKey;
   NSMutableDictionary *sessionDict;
 
   cache = [SOGoCache sharedCache];
   sessionDict = [NSMutableDictionary dictionary];
   [sessionDict setObject: authorizationEndpoint forKey: @"authorization_endpoint"];
   [sessionDict setObject: tokenEndpoint forKey: @"token_endpoint"];
-  [sessionDict setObject: introspectionEndpoint forKey: @"introspection_endpoint"];
   [sessionDict setObject: userinfoEndpoint forKey: @"userinfo_endpoint"];
   [sessionDict setObject: endSessionEndpoint forKey: @"end_session_endpoint"];
-  [sessionDict setObject: revocationEndpoint forKey: @"revocation_endpoint"];
+
+  //Optionnals?
+  if(introspectionEndpoint)
+    [sessionDict setObject: introspectionEndpoint forKey: @"introspection_endpoint"];
+  if(revocationEndpoint)
+    [sessionDict setObject: revocationEndpoint forKey: @"revocation_endpoint"];
 
   jsonSession = [sessionDict jsonRepresentation];
+
+  if(_domain != nil && [_domain length] > 0)
+    cacheKey = [self->openIdConfigUrl stringByAppendingFormat: @":%@", _domain];
+  else
+    cacheKey = self->openIdConfigUrl;
+
   [cache setOpenIdSession: jsonSession
-         forServer: self->openIdConfigUrl];
+                forServer: cacheKey];
 }
 
 
@@ -332,6 +438,8 @@ static BOOL SOGoOpenIDDebugEnabled = YES;
   logUrl = [logUrl stringByAppendingString: @"&response_type=code"];
   logUrl = [logUrl stringByAppendingFormat: @"&client_id=%@", self->openIdClient];
   logUrl = [logUrl stringByAppendingFormat: @"&redirect_uri=%@", oldLocation];
+  if(self->forDomain != nil && [self->forDomain length] > 0)
+    logUrl = [logUrl stringByAppendingFormat: @"&sogo_domain=%@", forDomain];
   // logurl = [self->logurl stringByAppendingFormat: @"&state=%@", state];
 
   return logUrl;
@@ -397,7 +505,11 @@ static BOOL SOGoOpenIDDebugEnabled = YES;
     form = [form stringByAppendingFormat: @"&client_secret=%@", self->openIdClientSecret];
     form = [form stringByAppendingFormat: @"&client_id=%@", self->openIdClient];
 
-    headers = [NSDictionary dictionaryWithObject: @"application/x-www-form-urlencoded"  forKey: @"content-type"];
+    if(self->forDomain != nil && [self->forDomain length] > 0)
+      headers = [NSDictionary dictionaryWithObjectsAndKeys: @"application/x-www-form-urlencoded", @"content-type",
+                                                                self->forDomain, @"sogo-user-domain", nil];
+    else
+      headers = [NSDictionary dictionaryWithObject: @"application/x-www-form-urlencoded"  forKey: @"content-type"];
     
     response = [self _performOpenIdRequest: location
                       method: @"POST"
@@ -467,7 +579,11 @@ static BOOL SOGoOpenIDDebugEnabled = YES;
     form = [form stringByAppendingFormat: @"&client_secret=%@", self->openIdClientSecret];
     form = [form stringByAppendingFormat: @"&client_id=%@", self->openIdClient];
 
-    headers = [NSDictionary dictionaryWithObject: @"application/x-www-form-urlencoded"  forKey: @"content-type"];
+    if(self->forDomain != nil && [self->forDomain length] > 0)
+      headers = [NSDictionary dictionaryWithObjectsAndKeys: @"application/x-www-form-urlencoded", @"content-type",
+                                                                self->forDomain, @"sogo-user-domain", nil];
+    else
+      headers = [NSDictionary dictionaryWithObject: @"application/x-www-form-urlencoded"  forKey: @"content-type"];
     
     response = [self _performOpenIdRequest: location
                       method: @"POST"
@@ -525,7 +641,12 @@ static BOOL SOGoOpenIDDebugEnabled = YES;
   if (url)
   {
     auth = [NSString stringWithFormat: @"Bearer %@", self->accessToken];
-    headers = [NSDictionary dictionaryWithObject: auth forKey: @"authorization"];
+    if(self->forDomain != nil && [self->forDomain length] > 0)
+      headers = [NSDictionary dictionaryWithObjectsAndKeys: @"application/x-www-form-urlencoded", @"content-type",
+                                                                self->forDomain, @"sogo-user-domain",
+                                                                auth, @"authorization", nil];
+    else
+      headers = [NSDictionary dictionaryWithObject: auth forKey: @"authorization"];
 
     response = [self _performOpenIdRequest: location
                        method: @"GET"
@@ -646,7 +767,7 @@ static BOOL SOGoOpenIDDebugEnabled = YES;
   return @"anonymous";
 }
 
-- (BOOL) login: (NSString *) email
+- (NSString *) login: (NSString *) email
 {
   //Check if we need to fetch userinfo
   if(self->userTokenInterval > 0 && [self _loadUserFromCache: email])

SoObjects/SOGo/SOGoSession.m

@@ -247,12 +247,20 @@
 			      usingKey: theKey];
   
   r = [decodedValue rangeOfString: @":"];
-  *theLogin = [decodedValue substringToIndex: r.location];
-  *thePassword = [decodedValue substringFromIndex: r.location+1];
+  if (r.location != NSNotFound) 
+  {
+    *theLogin = [decodedValue substringToIndex: r.location];
+    *thePassword = [decodedValue substringFromIndex: r.location+1];
+  }
+  else
+  {
+    *theLogin = nil;
+    *thePassword = nil;
+  }
   *theDomain = nil;
-  
+
   sd = [SOGoSystemDefaults sharedSystemDefaults];
-  if ([sd enableDomainBasedUID])
+  if (*theLogin &&[sd enableDomainBasedUID])
     {
       r = [*theLogin rangeOfString: @"@" options: NSBackwardsSearch];
       if (r.location != NSNotFound)

SoObjects/SOGo/SOGoSieveManager.m

@@ -28,6 +28,7 @@
 #import <SOGo/NSDictionary+Utilities.h>
 #import <SOGo/NSString+Utilities.h>
 #import <SOGo/SOGoDomainDefaults.h>
+#import <SOGo/SOGoSystemDefaults.h>
 #import <SOGo/SOGoUser.h>
 #import <SOGo/SOGoTextTemplateFile.h>
 
@@ -697,8 +698,11 @@ static NSString *sieveScriptName = @"sogo";
   NSDictionary *result;
   NSString *login, *authname, *password;
   SOGoDomainDefaults *dd;
+  SOGoSystemDefaults *sd;
   NGSieveClient *client;
   NSString *sieveServer, *sieveScheme, *sieveQuery, *imapServer;
+  NSString *imapAuthMech, *userDomain;
+  NSRange r;
   NSURL *url, *cUrl;
   int sievePort;
   BOOL connected;
@@ -773,7 +777,20 @@ static NSString *sieveScriptName = @"sogo";
   url = [NSURL URLWithString: [NSString stringWithFormat: @"%@://%@:%d%@",
                                sieveScheme, sieveServer, sievePort, sieveQuery]];
 
-  client = [[NGSieveClient alloc] initWithURL: url];
+  //In case of differrent auth method for different domain, check it
+  sd = [SOGoSystemDefaults sharedSystemDefaults];
+  imapAuthMech = nil;
+  if([sd doesLoginTypeByDomain])
+  {
+    r = [theUsername rangeOfString: @"@"];
+    if (r.location != NSNotFound)
+    {
+      userDomain = [theUsername substringFromIndex: r.location+1];
+      imapAuthMech = [sd getImapAuthMechForDomain: userDomain];
+    }
+  }
+
+  client = [[NGSieveClient alloc] initWithURL: url andAuthMech: imapAuthMech];
 
   if (!client) {
     [self errorWithFormat: @"Sieve connection failed on %@", [url description]];

SoObjects/SOGo/SOGoSystemDefaults.h

@@ -36,6 +36,11 @@ static const NSString *kDisableSharingCalendar = @"Calendar";
 + (SOGoSystemDefaults *) sharedSystemDefaults;
 
 - (NSArray *) domainIds;
+- (BOOL) doesLoginTypeByDomain;
+- (NSString *) getLoginTypeForDomain: (NSString*) _domain;
+- (NSString *) getLoginConfigForDomain: (NSDictionary*) _domain;
+- (NSString *) getImapAuthMechForDomain: (NSString*) _domain;
+- (NSString *) getSmtpAuthMechForDomain: (NSString*) _domain;
 - (BOOL) forbidUnknownDomainsAuth;
 - (NSArray *) domainsAllowed;
 - (BOOL) enableDomainBasedUID;
@@ -89,7 +94,7 @@ NSComparisonResult languageSort(id el1, id el2, void *context);
 - (NSString *) loginSuffix;
 
 - (NSString *) authenticationType;
-- (BOOL) isSsoUsed;
+- (BOOL) isSsoUsed: (NSString *) domain;
 - (NSString *) davAuthenticationType;
 
 - (NSString *) CASServiceURL;
@@ -101,7 +106,7 @@ NSComparisonResult languageSort(id el1, id el2, void *context);
 - (NSString *) openIdClientSecret;
 - (NSString *) openIdEmailParam;
 - (BOOL) openIdEnableRefreshToken;
-- (BOOL) openIdLogoutEnabled;
+- (BOOL) openIdLogoutEnabled: (NSString *) _domain;
 - (int) openIdTokenCheckInterval;
 
 - (NSString *) SAML2PrivateKeyLocation;

SoObjects/SOGo/SOGoSystemDefaults.m

@@ -262,6 +262,143 @@ _injectConfigurationFromFile (NSMutableDictionary *defaultsDict,
   return [domains allKeys];
 }
 
+- (BOOL) doesLoginTypeByDomain
+{
+  return ([self dictionaryForKey: @"SOGoLoginTypeByDomain"] != nil);
+}
+
+- (NSString *) getLoginTypeForDomain: (NSString*) _domain
+{
+  NSDictionary *domains, *config;
+  NSString *type;
+  if(![self doesLoginTypeByDomain])
+    return nil;
+  domains = [self dictionaryForKey: @"SOGoLoginTypeByDomain"];
+  if([domains objectForKey: _domain])
+  {
+    config = [domains objectForKey: _domain];
+  }
+  else if([domains objectForKey: @"login_default"])
+  {
+    config = [domains objectForKey: @"login_default"];
+  }
+  else
+    return nil;
+
+  if((type = [config objectForKey: @"type"]))
+  {
+    return type;
+  }
+  else
+    return nil;
+}
+
+- (NSString *) getImapAuthMechForDomain: (NSString*) _domain
+{
+  NSDictionary *domains, *config;
+  NSString *type;
+
+  if(![self doesLoginTypeByDomain])
+    return nil;
+
+  domains = [self dictionaryForKey: @"SOGoLoginTypeByDomain"];
+
+  if([domains objectForKey: _domain])
+  {
+    config = [domains objectForKey: _domain];
+  }
+  else if([domains objectForKey: @"login_default"])
+  {
+    config = [domains objectForKey: @"login_default"];
+  }
+  else
+    return nil;
+
+  if((type = [config objectForKey: @"imapAuthMech"]))
+  {
+    return type;
+  }
+  else
+    return nil;
+}
+
+- (NSString *) getSmtpAuthMechForDomain: (NSString*) _domain
+{
+  NSDictionary *domains, *config;
+  NSString *type;
+  
+  if(![self doesLoginTypeByDomain])
+    return nil;
+
+  domains = [self dictionaryForKey: @"SOGoLoginTypeByDomain"];
+
+  if([domains objectForKey: _domain])
+  {
+    config = [domains objectForKey: _domain];
+  }
+  else if([domains objectForKey: @"login_default"])
+  {
+    config = [domains objectForKey: @"login_default"];
+  }
+  else
+    return nil;
+
+  if((type = [config objectForKey: @"smtpAuthMech"]))
+  {
+    return type;
+  }
+  else
+    return nil;
+}
+
+- (NSString *) getLoginConfigForDomain: (NSDictionary*) _domain
+{
+  NSDictionary *domains, *config;
+  if(![self doesLoginTypeByDomain])
+    return nil;
+  domains = [self dictionaryForKey: @"SOGoLoginTypeByDomain"];
+  if([domains objectForKey: _domain])
+  {
+    config = [domains objectForKey: _domain];
+  }
+  else if([domains objectForKey: @"login_default"])
+  {
+    config = [domains objectForKey: @"login_default"];
+  }
+  
+  if(config)
+    return config;
+  else
+    return nil;
+}
+
+- (BOOL) hasOpenIdType
+{
+  if([self doesLoginTypeByDomain])
+  {
+    NSDictionary *domainsConfig;
+    NSEnumerator *e; 
+    NSString *domain, *type;
+    if(![self doesLoginTypeByDomain])
+      return NO;
+    domainsConfig = [self dictionaryForKey: @"SOGoLoginTypeByDomain"];
+    e = [domainsConfig keyEnumerator];
+    while((domain = [e nextObject]))
+    {
+      if((type = [[domainsConfig objectForKey: domain] objectForKey: @"type"]))
+      {
+        if([type isEqualToString: @"openid"])
+          return YES;
+      }
+    }
+    return NO;
+  }
+  else
+    return [[self authenticationType] isEqualToString: @"openid"];
+
+}
+
+
 - (BOOL) enableDomainBasedUID
 {
   return [self boolForKey: @"SOGoEnableDomainBasedUID"];
@@ -582,11 +719,13 @@ NSComparisonResult languageSort(id el1, id el2, void *context)
   return [[self stringForKey: @"SOGoAuthenticationType"] lowercaseString];
 }
 
-- (BOOL) isSsoUsed
+- (BOOL) isSsoUsed: (NSString *) domain
 {
   NSString* authType;
-  authType = [self authenticationType];
 
+  authType = [self getLoginTypeForDomain: domain];
+  if(!authType)
+    authType = [self authenticationType];
   return ([authType isEqualToString: @"cas"] || [authType isEqualToString: @"saml2"] || [authType isEqualToString: @"openid"]);
 }
 
@@ -635,8 +774,20 @@ NSComparisonResult languageSort(id el1, id el2, void *context)
   return emailParam;
 }
 
-- (BOOL) openIdLogoutEnabled
+- (BOOL) openIdLogoutEnabled: (NSString *) _domain
 {
+  if(_domain && [self doesLoginTypeByDomain])
+  {
+    NSDictionary *config;
+    NSString *type;
+    id value;
+    if((config = [self getLoginConfigForDomain: _domain]))
+    {
+      if((type = [config objectForKey: @"type"]) && [type isEqualToString:@"openid"])
+        return [self boolForKey: @"SOGoOpenIdLogoutEnabled" andDict: config];
+    }
+    return NO;
+  }
   return [self boolForKey: @"SOGoOpenIdLogoutEnabled"];
 }
 

SoObjects/SOGo/SOGoUser.h

@@ -91,6 +91,7 @@
 
 /* properties */
 - (NSString *) domain;
+- (NSString *) loginDomain;
 - (id <SOGoSource>) authenticationSource;
 
 - (NSArray *) allEmails;

SoObjects/SOGo/SOGoUser.m

@@ -301,6 +301,19 @@ static const NSString *kEncryptedUserNamePrefix = @"uenc";
   return [self _fetchFieldForUser: @"c_domain"];
 }
 
+- (NSString *) loginDomain
+{
+    NSRange r;
+    NSString *domain = nil;
+    r = [self->login rangeOfString: @"@"];
+    if (r.location != NSNotFound)
+    {
+        domain = [self->login substringFromIndex: r.location+1];
+    }
+    return domain;
+}
+
+
 - (id <SOGoSource>) authenticationSource
 {
   NSString *sourceID;

SoObjects/SOGo/SOGoUserManager.m

@@ -587,6 +587,7 @@ static const NSString *kObfuscatedSecondaryEmailKey = @"obfuscatedSecondaryEmail
   sd = [SOGoSystemDefaults sharedSystemDefaults];
 
   username = _login;
+  NSLog(@"D login are %@", _login);
 
   if (*_domain && ![*_domain isKindOfClass: NSNullK])
     {

SoObjects/SOGo/SOGoWebAuthenticator.m

@@ -134,11 +134,36 @@
   SOGoOpenIdSession * openIdSession;
   SOGoSystemDefaults *sd;
   NSString *authenticationType;
+  NSString* loginDomain;
   BOOL rc;
 
   sd = [SOGoSystemDefaults sharedSystemDefaults];
+  
+  NSLog(@"B Credentials are %@", _login);
+  //Basic check
+  if(!_login)
+    return NO;
+  if(_login && [_login length] == 0)
+    return NO;
+
+  loginDomain = nil;
+  if(*_domain == nil || [*_domain length] == 0)
+  {
+      NSRange r;
+      r = [_login rangeOfString: @"@"];
+      if (r.location != NSNotFound)
+      {
+        loginDomain = [_login substringFromIndex: r.location+1];
+      }
+  }
+  if(loginDomain)
+    NSLog(@"C domain are %@", loginDomain);
+
+  if([sd doesLoginTypeByDomain])
+    authenticationType = [sd getLoginTypeForDomain: loginDomain];
+  else
+    authenticationType = [sd authenticationType];
 
-  authenticationType = [sd authenticationType];
   if ([authenticationType isEqualToString: @"cas"])
     {
       casSession = [SOGoCASSession CASSessionWithIdentifier: _pwd fromProxy: NO];
@@ -149,7 +174,7 @@
     }
   else if ([authenticationType isEqualToString: @"openid"])
   {
-    openIdSession = [SOGoOpenIdSession OpenIdSessionWithToken: _pwd];
+    openIdSession = [SOGoOpenIdSession OpenIdSessionWithToken: _pwd domain: loginDomain];
     if (openIdSession)
       rc = [[openIdSession login: _login] isEqualToString: _login];
     else
@@ -173,9 +198,8 @@
                                                   domain: _domain
                                                     perr: _perr
                                                   expire: _expire
-                                                   grace: _grace
+                                                  grace: _grace
                                                 useCache: _useCache];
-  
   //[self logWithFormat: @"Checked login with ppolicy enabled: %d %d %d", *_perr, *_expire, *_grace];
   
   // It's important to return the real value here. The callee will handle
@@ -249,12 +273,15 @@
   
   sessionKey = [creds objectAtIndex:1];
   
+  NSLog(@"AAAA decodevalue for");
   [SOGoSession decodeValue: [SOGoSession valueForSessionKey: sessionKey]
                   usingKey: userKey
                      login: &login
                     domain: &domain
                   password: &pwd];
   
+  NSLog(@"A Credentials are %@", login);
+
   if (![self checkLogin: login
                password: pwd
                  domain: &domain
@@ -276,32 +303,42 @@
 {
   NSString *authType, *password;
   SOGoSystemDefaults *sd;
+  SOGoUser *user;
+  NSRange r;
+  NSString *loginDomain, *login;
  
   password = [self passwordInContext: context];
   if ([password length])
     {
+      user = [self userInContext: context];
+      login = [user loginInDomain];
+      r = [login rangeOfString: @"@"];
+      if (r.location != NSNotFound)
+        loginDomain = [login substringFromIndex: r.location+1];
+      else
+        loginDomain = nil;
+
       sd = [SOGoSystemDefaults sharedSystemDefaults];
-      authType = [sd authenticationType];
+      if([sd doesLoginTypeByDomain])
+        authType = [sd getLoginTypeForDomain: loginDomain];
+      else
+        authType = [sd authenticationType];
+
       if ([authType isEqualToString: @"cas"])
         {
           SOGoCASSession *session;
-          SOGoUser *user;
           NSString *service, *scheme;
 
           session = [SOGoCASSession CASSessionWithIdentifier: password
                                                    fromProxy: NO];
-
-          user = [self userInContext: context];
           // Try configured CAS service name first
           service = [[user domainDefaults] imapCASServiceName];
           if (!service)
             {
               // We must NOT assume the scheme exists
               scheme = [server scheme];
-
               if (!scheme)
                 scheme = @"imap";
-
               service = [NSString stringWithFormat: @"%@://%@",
                          scheme, [server host]];
             }
@@ -310,17 +347,16 @@
             [session invalidateTicketForService: service];
 
           password = [session ticketForService: service];
-
           if ([password length] || renew)
             [session updateCache];
         }
       else if ([authType isEqualToString: @"openid"])
       {
         SOGoOpenIdSession* session;
-        NSString* currentToken;
+
         //If the token has been refresh during the request, we need to use the new access_token
         //as the one from the cookie is no more valid
-        session = [SOGoOpenIdSession OpenIdSessionWithToken: password];
+        session = [SOGoOpenIdSession OpenIdSessionWithToken: password domain: loginDomain];
         password = [session getCurrentToken];
       }
 #if defined(SAML2_CONFIG)
@@ -453,21 +489,36 @@
 {
   NSArray *listCookies = nil;
   SOGoSystemDefaults *sd;
-  NSString *authType;
+  NSString *authType, *username, *login, *loginDomain;
+  NSRange r;
+  SOGoUser *user;
+
+  user = [self userInContext: _ctx];
+  login = [user loginDomain];
+  r = [login rangeOfString: @"@"];
+  if (r.location != NSNotFound)
+    loginDomain = [login substringFromIndex: r.location+1];
+  else
+    loginDomain = nil;
 
   sd = [SOGoSystemDefaults sharedSystemDefaults];
-  authType = [sd authenticationType];
+  if(loginDomain && [sd doesLoginTypeByDomain])
+    authType = [sd getLoginTypeForDomain: loginDomain];
+  else
+    authType = [sd authenticationType];
   if([authType isEqualToString:@"openid"] && [sd openIdEnableRefreshToken])
   {
-    NSString *currentPassword, *newPassword, *username;
+    NSString *currentPassword, *newPassword;
     SOGoOpenIdSession *openIdSession;
-
     WOCookie* newCookie;
+
+
     currentPassword = [self passwordInContext: _ctx];
     newPassword = [self imapPasswordInContext: _ctx forURL: nil forceRenew: NO];
     if(currentPassword && newPassword && ![newPassword isEqualToString: currentPassword])
     {
-      openIdSession = [SOGoOpenIdSession OpenIdSessionWithToken: newPassword];
+
+      openIdSession = [SOGoOpenIdSession OpenIdSessionWithToken: newPassword domain: loginDomain];
       if (openIdSession)
         username = [openIdSession login: @""]; //Force to refresh the name
       else