Plugin to reset password

classic Classic list List threaded Threaded
9 messages Options
Reply | Threaded
Open this post in threaded view
|

Plugin to reset password

Andreas Meyer
Hello!

There is no plugin available to let a user reset her password, right?

Kind regards

  Andreas

--
PGP-Fingerprint: D392 5D21 0299 63D7 5BAE 4562 1E56 B2EA 81A2 59F1

_______________________________________________
Roundcube Users mailing list
[hidden email]
http://lists.roundcube.net/mailman/listinfo/users

attachment0 (235 bytes) Download Attachment
Reply | Threaded
Open this post in threaded view
|

Re: Plugin to reset password

Giles Coochey

On 29/04/2019 13:29, Andreas Meyer wrote:
> Hello!
>
> There is no plugin available to let a user reset her password, right?
>
> Kind regards
>
>    Andreas

If you think about this, you'll realise that the answer is no.

Roundcube is simply using the supplied credentials to the IMAP server,
which could be on a completely different machine to the one running
Roundcube.  Therefore, as within the IMAP protocol, there is no API for
changing a user's password Roundcube could not do that by itself.

If you're looking for a user self-service method of changing a password,
then you'll need to look at the authentication method used by your IMAP
server and provide a relevant tool at that end, not on the RoundCube
front-end.

_______________________________________________
Roundcube Users mailing list
[hidden email]
http://lists.roundcube.net/mailman/listinfo/users
Reply | Threaded
Open this post in threaded view
|

Re: Plugin to reset password

Mike Burger
On 2019-04-29 08:51, Giles Coochey wrote:

> On 29/04/2019 13:29, Andreas Meyer wrote:
>> Hello!
>>
>> There is no plugin available to let a user reset her password, right?
>>
>> Kind regards
>>
>>    Andreas
>
> If you think about this, you'll realise that the answer is no.
>
> Roundcube is simply using the supplied credentials to the IMAP server,
> which could be on a completely different machine to the one running
> Roundcube.  Therefore, as within the IMAP protocol, there is no API
> for changing a user's password Roundcube could not do that by itself.
>
> If you're looking for a user self-service method of changing a
> password, then you'll need to look at the authentication method used
> by your IMAP server and provide a relevant tool at that end, not on
> the RoundCube front-end.
Andreas,

As you'll see by way of the two images I've attached, I'm afraid that
the above response is incorrect.

If you can't find it in <path-to-roundcube>/plugins/password, you can
find it at:

https://github.com/roundcube/roundcubemail/tree/master/plugins/password

--
Mike Burger
http://www.bubbanfriends.org

"It's always suicide-mission this, save-the-planet that. No one ever
just stops by to say 'hi' anymore." --Colonel Jack O'Neill, SG1
_______________________________________________
Roundcube Users mailing list
[hidden email]
http://lists.roundcube.net/mailman/listinfo/users

password-plugin-info.png (43K) Download Attachment
password-plugin-functionality.png (30K) Download Attachment
Reply | Threaded
Open this post in threaded view
|

Re: Plugin to reset password

Andreas Meyer
Mike Burger <[hidden email]> schrieb am 29.04.19 um 16:58:12 Uhr:

> On 2019-04-29 08:51, Giles Coochey wrote:
> > On 29/04/2019 13:29, Andreas Meyer wrote:  
> >> Hello!
> >>
> >> There is no plugin available to let a user reset her password, right?
> >>
> >> Kind regards
> >>
> >>    Andreas  
> >
> > If you think about this, you'll realise that the answer is no.
> >
> > Roundcube is simply using the supplied credentials to the IMAP server,
> > which could be on a completely different machine to the one running
> > Roundcube.  Therefore, as within the IMAP protocol, there is no API
> > for changing a user's password Roundcube could not do that by itself.
> >
> > If you're looking for a user self-service method of changing a
> > password, then you'll need to look at the authentication method used
> > by your IMAP server and provide a relevant tool at that end, not on
> > the RoundCube front-end.  
>
> Andreas,
>
> As you'll see by way of the two images I've attached, I'm afraid that
> the above response is incorrect.
>
> If you can't find it in <path-to-roundcube>/plugins/password, you can
> find it at:
>
> https://github.com/roundcube/roundcubemail/tree/master/plugins/password
You're suggestion assumes that one is logged in to change the password.
I was looking for a solution to reset the password if someone forgot it and
can't login anymore.

  Andreas
--
PGP-Fingerprint: D392 5D21 0299 63D7 5BAE 4562 1E56 B2EA 81A2 59F1

_______________________________________________
Roundcube Users mailing list
[hidden email]
http://lists.roundcube.net/mailman/listinfo/users

attachment0 (235 bytes) Download Attachment
Reply | Threaded
Open this post in threaded view
|

Re: Plugin to reset password

Giles Coochey
In reply to this post by Mike Burger

On 29/04/2019 21:58, Mike Burger wrote:

> On 2019-04-29 08:51, Giles Coochey wrote:
>> On 29/04/2019 13:29, Andreas Meyer wrote:
>>> Hello!
>>>
>>> There is no plugin available to let a user reset her password, right?
>>>
>>> Kind regards
>>>
>>>    Andreas
>>
>> If you think about this, you'll realise that the answer is no.
>>
>> Roundcube is simply using the supplied credentials to the IMAP server,
>> which could be on a completely different machine to the one running
>> Roundcube.  Therefore, as within the IMAP protocol, there is no API
>> for changing a user's password Roundcube could not do that by itself.
>>
>> If you're looking for a user self-service method of changing a
>> password, then you'll need to look at the authentication method used
>> by your IMAP server and provide a relevant tool at that end, not on
>> the RoundCube front-end.
>
> Andreas,
>
> As you'll see by way of the two images I've attached, I'm afraid that
> the above response is incorrect.
>
> If you can't find it in <path-to-roundcube>/plugins/password, you can
> find it at:
>
> https://github.com/roundcube/roundcubemail/tree/master/plugins/password
>
That plugin makes a lot of assumptions (for a lot of use cases it
assumes that RoundCube is installed on the IMAP server systems itself,
which is unlikely, Roundcube is likely to be installed in the DMZ/WEB
tier, whereas mailbox servers are likely to be installed in the APP
tier, fronted by loadbalancers in the DMZ tier), in many use cases it
also requires your to write your own password change module - so at best
it is a skeleton plugin and not ready for easy deployment.
_______________________________________________
Roundcube Users mailing list
[hidden email]
http://lists.roundcube.net/mailman/listinfo/users
Reply | Threaded
Open this post in threaded view
|

Re: Plugin to reset password

Mike Burger
In reply to this post by Mike Burger
This is a very good point...one that can be addressed in its
configuration.

You see, it pays to do a little research prior to attempting to
denigrate someone's contribution to the discussion.

First of all, the password plugin is packaged WITH RCE...as in, in the
tarball.

Second, if you go into the password plugin directory and read the README
file, you'll find that section 2, "Drivers", covers 20 possible
configurations:

  2. Drivers
  2.1.  Database (sql)
  2.2.  Cyrus/SASL (sasl)
  2.3.  Poppassd/Courierpassd (poppassd)
  2.4.  LDAP (ldap)
  2.5.  DirectAdmin Control Panel (directadmin)
  2.6.  cPanel
  2.6.1.  cPanel WHM (cpanel)
  2.6.2.  cPanel Webmail (cpanel_webmail)
  2.7.  XIMSS/Communigate (ximms)
  2.8.  Virtualmin (virtualmin)
  2.9.  hMailServer (hmail)
  2.10. PAM (pam)
  2.11. Chpasswd (chpasswd)
  2.12. LDAP - no PEAR (ldap_simple)
  2.13. XMail (xmail)
  2.14. Pw (pw_usermod)
  2.15. domainFACTORY (domainfactory)
  2.16. DBMail (dbmail)
  2.17. Expect (expect)
  2.18. Samba (smb)
  2.19. Vpopmail daemon (vpopmaild)
  2.20. Plesk (Plesk RPC-API)
  2.21. Kpasswd

On 2019-04-29 17:17, Reindl Harald wrote:

> come on and show me how you imagine that to work on a proper system
> where the webmail runs on a different machine than any mailservice and
> can connect to the mailservice only via SMTP/POP3/IMAP
>
> Am 29.04.19 um 22:58 schrieb Mike Burger:
>> On 2019-04-29 08:51, Giles Coochey wrote:
>>> On 29/04/2019 13:29, Andreas Meyer wrote:
>>>> Hello!
>>>>
>>>> There is no plugin available to let a user reset her password,
>>>> right?
>>>>
>>>> Kind regards
>>>>
>>>>    Andreas
>>>
>>> If you think about this, you'll realise that the answer is no.
>>>
>>> Roundcube is simply using the supplied credentials to the IMAP
>>> server,
>>> which could be on a completely different machine to the one running
>>> Roundcube.  Therefore, as within the IMAP protocol, there is no API
>>> for changing a user's password Roundcube could not do that by itself.
>>>
>>> If you're looking for a user self-service method of changing a
>>> password, then you'll need to look at the authentication method used
>>> by your IMAP server and provide a relevant tool at that end, not on
>>> the RoundCube front-end.
>>
>> Andreas,
>>
>> As you'll see by way of the two images I've attached, I'm afraid that
>> the above response is incorrect.
>>
>> If you can't find it in <path-to-roundcube>/plugins/password, you can
>> find it at:
>>
>> https://github.com/roundcube/roundcubemail/tree/master/plugins/password

--
Mike Burger
http://www.bubbanfriends.org

"It's always suicide-mission this, save-the-planet that. No one ever
just stops by to say 'hi' anymore." --Colonel Jack O'Neill, SG1
_______________________________________________
Roundcube Users mailing list
[hidden email]
http://lists.roundcube.net/mailman/listinfo/users
Reply | Threaded
Open this post in threaded view
|

Re: Plugin to reset password

Mike Burger
In reply to this post by Andreas Meyer
On 2019-04-30 02:04, Andreas Meyer wrote:

> Mike Burger <[hidden email]> schrieb am 29.04.19 um 16:58:12
> Uhr:
>
>> On 2019-04-29 08:51, Giles Coochey wrote:
>> > On 29/04/2019 13:29, Andreas Meyer wrote:
>> >> Hello!
>> >>
>> >> There is no plugin available to let a user reset her password, right?
>> >>
>> >> Kind regards
>> >>
>> >>    Andreas
>> >
>> > If you think about this, you'll realise that the answer is no.
>> >
>> > Roundcube is simply using the supplied credentials to the IMAP server,
>> > which could be on a completely different machine to the one running
>> > Roundcube.  Therefore, as within the IMAP protocol, there is no API
>> > for changing a user's password Roundcube could not do that by itself.
>> >
>> > If you're looking for a user self-service method of changing a
>> > password, then you'll need to look at the authentication method used
>> > by your IMAP server and provide a relevant tool at that end, not on
>> > the RoundCube front-end.
>>
>> Andreas,
>>
>> As you'll see by way of the two images I've attached, I'm afraid that
>> the above response is incorrect.
>>
>> If you can't find it in <path-to-roundcube>/plugins/password, you can
>> find it at:
>>
>> https://github.com/roundcube/roundcubemail/tree/master/plugins/password
>
> You're suggestion assumes that one is logged in to change the password.
> I was looking for a solution to reset the password if someone forgot it
> and
> can't login anymore.

Context is everything and that particular fact was missing from your
initial posing of the question.

You are correct...this particular plugin would not work...you would need
something else. My perusal of the plugin library does not indicate
anything is available.
--
Mike Burger
http://www.bubbanfriends.org

"It's always suicide-mission this, save-the-planet that. No one ever
just stops by to say 'hi' anymore." --Colonel Jack O'Neill, SG1
_______________________________________________
Roundcube Users mailing list
[hidden email]
http://lists.roundcube.net/mailman/listinfo/users
Reply | Threaded
Open this post in threaded view
|

Re: Plugin to reset password

Mike Burger
In reply to this post by Giles Coochey
On 2019-04-30 04:16, Giles Coochey wrote:

> On 29/04/2019 21:58, Mike Burger wrote:
>> On 2019-04-29 08:51, Giles Coochey wrote:
>>> On 29/04/2019 13:29, Andreas Meyer wrote:
>>>> Hello!
>>>>
>>>> There is no plugin available to let a user reset her password,
>>>> right?
>>>>
>>>> Kind regards
>>>>
>>>>    Andreas
>>>
>>> If you think about this, you'll realise that the answer is no.
>>>
>>> Roundcube is simply using the supplied credentials to the IMAP
>>> server,
>>> which could be on a completely different machine to the one running
>>> Roundcube.  Therefore, as within the IMAP protocol, there is no API
>>> for changing a user's password Roundcube could not do that by itself.
>>>
>>> If you're looking for a user self-service method of changing a
>>> password, then you'll need to look at the authentication method used
>>> by your IMAP server and provide a relevant tool at that end, not on
>>> the RoundCube front-end.
>>
>> Andreas,
>>
>> As you'll see by way of the two images I've attached, I'm afraid that
>> the above response is incorrect.
>>
>> If you can't find it in <path-to-roundcube>/plugins/password, you can
>> find it at:
>>
>> https://github.com/roundcube/roundcubemail/tree/master/plugins/password
>>
> That plugin makes a lot of assumptions (for a lot of use cases it
> assumes that RoundCube is installed on the IMAP server systems itself,
> which is unlikely, Roundcube is likely to be installed in the DMZ/WEB
> tier, whereas mailbox servers are likely to be installed in the APP
> tier, fronted by loadbalancers in the DMZ tier), in many use cases it
> also requires your to write your own password change module - so at
> best it is a skeleton plugin and not ready for easy deployment.

As I noted in my reply to Reindl, it pays to do a little research.

First of all, the password plugin is packaged WITH RCE...as in, in the
tarball, and part of the base installation.

Second, if you go into the password plugin directory and peruse the
README file, you'll find that section 2, "Drivers", covers 20 possible
configurations:

  2. Drivers
  2.1.  Database (sql)
  2.2.  Cyrus/SASL (sasl)
  2.3.  Poppassd/Courierpassd (poppassd)
  2.4.  LDAP (ldap)
  2.5.  DirectAdmin Control Panel (directadmin)
  2.6.  cPanel
  2.6.1.  cPanel WHM (cpanel)
  2.6.2.  cPanel Webmail (cpanel_webmail)
  2.7.  XIMSS/Communigate (ximms)
  2.8.  Virtualmin (virtualmin)
  2.9.  hMailServer (hmail)
  2.10. PAM (pam)
  2.11. Chpasswd (chpasswd)
  2.12. LDAP - no PEAR (ldap_simple)
  2.13. XMail (xmail)
  2.14. Pw (pw_usermod)
  2.15. domainFACTORY (domainfactory)
  2.16. DBMail (dbmail)
  2.17. Expect (expect)
  2.18. Samba (smb)
  2.19. Vpopmail daemon (vpopmaild)
  2.20. Plesk (Plesk RPC-API)
  2.21. Kpasswd

This would seem to indicate, at least to me, that the fine folks who
maintain RCE feel that its more than a skeleton plugin and is quite
ready for easy deployment.

--
Mike Burger
http://www.bubbanfriends.org

"It's always suicide-mission this, save-the-planet that. No one ever
just stops by to say 'hi' anymore." --Colonel Jack O'Neill, SG1
_______________________________________________
Roundcube Users mailing list
[hidden email]
http://lists.roundcube.net/mailman/listinfo/users
Reply | Threaded
Open this post in threaded view
|

Re: Plugin to reset password

Andreas Meyer
In reply to this post by Andreas Meyer
I have the password plugin in use for years now with passwords stored in MySQL. I was thinking about something that would send a link to activate a new one. Some days ago a new customer was sitting next to me in front of the screen and he told me he did not write down his password anywhere. Yes, context was clear, I think.
--
Von meinem Mobiltelefon gesendet.
_______________________________________________
Roundcube Users mailing list
[hidden email]
http://lists.roundcube.net/mailman/listinfo/users