Admin IMAP groups from different account

Admin IMAP groups from different account

[Kai Großjohann]

People tell me that I shouldn't be reading mail from an admin account
in the Cyrus server.  Hence, I have turned off admin capability from
my normal account.  I have also created a second IMAP account for me
to do IMAP server administration (group permissions, new groups, the
like).

I find that either one feature or the other is missing from Gnus, or
I'm doing things the wrong way.  Can anybody help?

I went into the server buffer and created a new nnimap server; used a
different name.  Added an entry in ~/.authinfo for the new server,
specifying the admin account and password.  So far, so good.  But how
do I actually create new groups and change the ACL on existing groups
without cluttering my normal view of groups?  I tried to browse the
server, but that buffer does not have the necessary commands.  So I
could add a group from the admin server to my normal view then change
the ACL from there.  But this seems clumsy.

kai
-- 
A large number of young women don't trust men with beards.
(BFBS Radio)

Re: Admin IMAP groups from different account

[Simon Josefsson]

Kai.Grossjohann@CS.Uni-Dortmund.DE (Kai Großjohann) writes:

> I find that either one feature or the other is missing from Gnus, or
> I'm doing things the wrong way.

The feature is missing, IMAP ACL editing only work from the group
buffer, it wasn't meant as a IMAP server admin util. You could
probably use `gnus-group-nnimap-edit-acl' as a fundation to build a
`gnus-server-nnimap-edit-acl' (or whatever).

As ACL semantics tend to be defined in almost as many ways as there
are implementations, I'm not sure a new backend function for editing
ACLs would be a better solution -- it would be hard to make it generic
enough to accomodate all ACLs future backends might implement, and
making it match the IMAP semantics seem as much as a workaround as
creating commands which only work for one backend.

Re: Admin IMAP groups from different account

[Amos Gouaux]

>>>>> On 04 Jan 2000 15:25:23 +0100,
>>>>> Simon Josefsson <jas@pdc.kth.se> (sj) writes:

sj> As ACL semantics tend to be defined in almost as many ways as there
sj> are implementations, I'm not sure a new backend function for editing
sj> ACLs would be a better solution -- it would be hard to make it generic
sj> enough to accomodate all ACLs future backends might implement, and
sj> making it match the IMAP semantics seem as much as a workaround as
sj> creating commands which only work for one backend.

Hopefully this will improve.  There is an IETF committee on the IMAP
extensions, which includes quotas and ACLs.  So hopefully we can
eventually get some consistency here.  I'm also hoping that they
separate folder ACLs from message ACLs, so that you can grant
permission to delete messages in a folder, but not the folder
itself--D'OH!  ;-)

Amos

Re: Admin IMAP groups from different account

[Simon Josefsson]

Amos Gouaux <amos+lists.ding@utdallas.edu> writes:

> sj> As ACL semantics tend to be defined in almost as many ways as there
> sj> are implementations, I'm not sure a new backend function for editing
> sj> ACLs would be a better solution -- it would be hard to make it generic
> sj> enough to accomodate all ACLs future backends might implement, and
> sj> making it match the IMAP semantics seem as much as a workaround as
> sj> creating commands which only work for one backend.
> 
> Hopefully this will improve.  There is an IETF committee on the IMAP
> extensions, which includes quotas and ACLs.  So hopefully we can
> eventually get some consistency here.

I'm not sure we should hold our breaths on that, considering the ACL
rfc is 3 years old and there haven't been any updated drafts. ;-)

> I'm also hoping that they separate folder ACLs from message ACLs, so
> that you can grant permission to delete messages in a folder, but
> not the folder itself--D'OH!  ;-)

Let's hope. ACLs pertaining to groups of users would be nice, too.

Re: Admin IMAP groups from different account

[Steve Harris]

Kai Großjohann <Kai.Grossjohann@CS.Uni-Dortmund.DE> writes:

[...]

> Added an entry in ~/.authinfo for the new server, specifying the
> admin account and password.  So far, so good.

Does nnimap still read ~/.authinfo for passwords?

It used to work for me until I upgraded to Gnus v5.8.2, using
'mail-sources' to set up my IMAP source. At first, I tried to leave
off the ':password' argument since it's specified in ~/.authinfo. Gnus
could not log in to the IMAP server. Finally I gave up, put the
':password' argument in, and separated the mail-sources stuff into a
separate file so I could lock down the permissions on it. I never
found a change in the documentation to suggest that this wouldn't work
any longer.

-- 
Steven E. Harris

Re: Admin IMAP groups from different account

[David S. Goldberg]

Uhm.  .authinfo works fine for me.  But nnimap is not a mail-source,
it's a secondary select method, so I suspect your problem lies in
there somewhere.  I just set up nnimap-authinfo-file to point at my
.authinfo file and nnimap is happy with it.  And I probably had to do
that only because my .authinfo has to be somewhere other than my home
directory because AFS's acls are per-directory rather than per-file.
-- 
Dave Goldberg
Post: The Mitre Corporation\MS B325\202 Burlington Rd.\Bedford, MA 01730
Phone: 781-271-3887
Email: dsg@mitre.org

Re: Admin IMAP groups from different account

[Simon Josefsson]

Steve Harris <sharris@primus.com> writes:

> > Added an entry in ~/.authinfo for the new server, specifying the
> > admin account and password.  So far, so good.
> 
> Does nnimap still read ~/.authinfo for passwords?

Yes.

> It used to work for me until I upgraded to Gnus v5.8.2, using
> 'mail-sources' to set up my IMAP source. At first, I tried to leave
> off the ':password' argument since it's specified in ~/.authinfo. Gnus
> could not log in to the IMAP server. Finally I gave up, put the
> ':password' argument in, and separated the mail-sources stuff into a
> separate file so I could lock down the permissions on it. I never
> found a change in the documentation to suggest that this wouldn't work
> any longer.

The IMAP mail-source (!= nnimap) has never supported .authinfo.
Supporting the mail-source credential cache is on the todo-list, but
it doesn't fetch passwords from .authinfo AFAIK.

Re: Admin IMAP groups from different account

[Steve Harris]

Okay, I moved back from 'mail-sources' to nnimap as a secondary select
method and all is well with ~/.authinfo. Now I see that Gnus is no
longer reporting that it's writing copies of the messages when I check
for new messages. It's all making sense now. Thanks for your help.

-- 
Steven E. Harris
Primus Knowledge Solutions, Inc.
http://www.primus.com