feat(openID): second part with a lot of fixes and cleaning

Documentation/SOGoInstallationGuide.asciidoc

@@ -437,8 +437,8 @@ Defaults to `300`.
 
 |S |SOGoAuthenticationType
 |Parameter used to define the way by which users will be authenticated.
-For C.A.S., specify `cas`. For SAML2, specify `saml2`. For anything
-else, leave that value empty.
+For C.A.S., specify `cas`. For SAML2, specify `saml2`. For opendID Connect, specify `openid`.
+For anything else, leave that value empty.
 
 |S |SOGoTrustProxyAuthentication
 |Parameter used to set whether HTTP username should be trusted.
@@ -1559,6 +1559,81 @@ SOGoIMAPCASServiceName should be set to the actual imap service name
 expected by pam_cas, otherwise it will fail to authenticate incoming
 connection properly.
 
+
+Authenticating using OPENID
+~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+SOGo natively supports OPENID authentication. For activating OpenId authentication you need first to make sure that
+_SOGoAuthenticationType_ is set to `openid`,
+_SOGoXSRFValidationEnabled_ is set to `NO` and set the following parameters:
+
+[cols="^4,46,50a"]
+|=======================================================================
+|S |OCSOpenIdURL
+|Parameter used to set the database URL for openID session.
+
+For MariaDB/MySQL, set the database URL to something like: mysql://sogo:sogo@127.0.0.1:3306/sogo/sogo_openid.
+
+
+|S |SOGoOpenIdConfigUrl
+|Parameter used to specify the endpoint of OpenID Provider Configuration, mandatory. For example:
+https://myopenid.net/.well-known/openid-configuration
+
+|S |SOGoOpenIdClient
+|Name of your openid client, mandatory.
+
+|S |SOGoOpenIdClientSecret
+|Secret of your openid client, mandatory
+
+|S |SOGoOpenIdScope
+|Scope or your openid client, mandatory. List of words space separated like this:
+"openid profile email"
+
+|S |SOGoOpenIdEmailParam
+|Name of the parameter from user profile that contains the mail/uid.
+
+Defaults to `email` when unset.
+
+|S |SOGoOpenIdEnableRefreshToken
+|Set to `YES` to Enable the mechanism of refresh token if provided. You may have to configure
+and/or add a value to your scope for it to work.
+
+Defaults to `NO` when unset.
+
+|S |SOGoOpenIdTokenCheckInterval
+|Number of seconds before sogo check again the user's access token validity.
+This is to prevent sogo to do too much request to the openid server.
+
+Defaults to `0` when unset.
+
+|S |SOGoOpenIdLogoutEnabled
+|Allow user to end their openId with the webmail. Meaning that will disconnect them from
+the others applicaitons as well.
+
+Defaults to `NO` when unset.
+|=======================================================================
+
+
+The tricky part shows up for the imap and smtp sever. SOGo doesn't know the password
+of the user and only have its access token. A new auth mechanism has been implemented,
+the https://developers.google.com/gmail/imap/xoauth2-protocol#initial_client_response[xoauth2]
+
+You can set it with the parameter _NGImap4AuthMechanism_ and/or _SOGoSMTPAuthenticationType_
+
+*With dovecot:* +
+Dovecot natively supports xoauth2 and can be figured as such: https://doc.dovecot.org/2.3/configuration_manual/authentication/oauth2/
+
+*With cyrus:* +
+Cyrus doesn't support xoauth2 mechanism and pluggins or homemade solutions must be found. +
+_Please note, as Alinto uses dovecot, we didn't investigate cyrus' case. If one member of the community
+finds a solution, we will be happy to update this documentation._
+
+As you can see, a new database table is used for handling openid session. The table is automaticcaly created when _OCSOpenIdURL_ is set.
+If the user quits the webmail without logging out or trough another application,
+the session will stays in the table and be useless. That's why a new sogo-tool command has been added to clean this table.
+You can put it in a cron to do that periodicly. +
+See _<<sogo-tool-clean-openid-sessions,sogo-tool clean-openid-sessions>>_.
+
 Authenticating using SAML2
 ~~~~~~~~~~~~~~~~~~~~~~~~~~
 
@@ -2113,8 +2188,7 @@ To disable TLS verification for localhost domains, add
 
 |D |SOGoSMTPAuthenticationType
 |Activate SMTP authentication and specifies which type is in use.
-Current, only `PLAIN` is supported and other values will cause
-the authentication to fail.
+Current, Are supported `PLAIN` and 'xoauth2' for openid.
 
 |D |SOGoSMTPMasterUserEnabled
 |Enable specific SMTP user account for system e-mails (notifications, reminders, ...). Default is `NO`.
@@ -2297,6 +2371,7 @@ SASL mechanism. Using `AUTHENTICATE` instead of `LOGIN` is also necessary
 to enable UTF-8 characters in users' passwords. To enable simple use of
 `AUTHENTICATE` for this purpose, set this setting to `plain`. Please note 
 that this feature might be limited at this time.
+Now support `xoauth2` mechanism when using openid. Be sure you imap server undesrtands this mechanism.
 
 |D |NGImap4ConnectionGroupIdPrefix
 |Prefix to prepend to names in IMAP ACL transactions, to indicate the
@@ -3630,6 +3705,22 @@ sogo-tool checkup user1
 sogo-tool checkup -d user1
 ----
 
+
+[[sogo-tool-clean-openid-sessions]]
+
+sogo-tool clean-openid-sessions
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Obviously only usefull if you have set SOGo with openId authentication.
+Will clean all expired openId sessions from the database.
+
+ sogo-tool clean-openid-sessions
+
+Example:
+----
+sogo-tool clean-openid-sessions
+----
+
 sogo-tool cleanup
 ~~~~~~~~~~~~~~~~~
 

Main/SOGo.m

@@ -288,16 +288,16 @@ static BOOL debugLeaks;
 
   e = [urlStrings objectEnumerator];
   while (ok && (tmp = [e nextObject]))
+  {
+    value = [defaults stringForKey: tmp];
+    if (value)
+      [self _checkTableWithCM: cm tableURL: value andType: tmp];
+    else
     {
-      value = [defaults stringForKey: tmp];
-      if (value)
-	  [self _checkTableWithCM: cm tableURL: value andType: tmp];
-      else
-	{
-	  [self errorWithFormat: @"No value specified for '%@'", tmp];
-	  ok = NO;
-	}
+      [self errorWithFormat: @"No value specified for '%@'", tmp];
+      ok = NO;
     }
+  }
 
   if (combined)
     {
@@ -322,9 +322,15 @@ static BOOL debugLeaks;
       
       // Create the email alarms table, if required
       if ([defaults enableEMailAlarms])
-	{
-	  [[fm alarmsFolder] createFolderIfNotExists];
-	}
+      {
+        [[fm alarmsFolder] createFolderIfNotExists];
+      }
+
+      //Create mandatory openId table, if used
+      if([defaults hasOpenIdType])
+      {
+        [[fm openIdFolder] createFolderIfNotExists];
+      }
     }
 
   return ok;

SOPE/GDLContentStore/GCSFolderManager.h

@@ -31,7 +31,7 @@
 */
 
 @class NSString, NSArray, NSURL, NSDictionary, NSException;
-@class GCSChannelManager, GCSAlarmsFolder, GCSAdminFolder, GCSFolder, GCSFolderType, GCSSessionsFolder;
+@class GCSChannelManager, GCSAlarmsFolder, GCSAdminFolder, GCSFolder, GCSFolderType, GCSSessionsFolder, GCSOpenIdFolder;
 
 @interface GCSFolderManager : NSObject
 {
@@ -92,6 +92,9 @@
 /* admin */
 - (GCSAdminFolder *)adminFolder;
 
+/* openid */
+- (GCSOpenIdFolder *) openIdFolder;
+
 /* folder types */
 
 - (GCSFolderType *)folderTypeWithName:(NSString *)_name;

SOPE/GDLContentStore/GCSFolderManager.m

@@ -38,6 +38,7 @@
 #import "EOAdaptorChannel+GCS.h"
 #import "GCSAlarmsFolder.h"
 #import "GCSAdminFolder.h"
+#import "GCSOpenIdFolder.h"
 #import "GCSFolder.h"
 #import "GCSFolderType.h"
 #import "GCSSessionsFolder.h"
@@ -504,6 +505,12 @@ static BOOL       _singleStoreMode           = NO;
   return [GCSAdminFolder adminFolderWithFolderManager: self];
 }
 
+/* openId */
+- (GCSOpenIdFolder *) openIdFolder
+{
+  return [GCSOpenIdFolder openIdFolderWithFolderManager: self];
+}
+
 - (NSString *)generateSQLWhereForInternalNames:(NSArray *)_names
 				    exactMatch:(BOOL)_beExact orDirectSubfolderMatch:(BOOL)_directSubs
 {

SOPE/GDLContentStore/GCSOpenIdFolder.h

@@ -0,0 +1,57 @@
+/* GCSAdminFolder.h - this file is part of $PROJECT_NAME_HERE$
+ *
+ * Copyright (C) 2023 Alinto
+ *
+ * This file is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This file is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING.  If not, write to
+ * the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#ifndef GCSOPENIDFOLDER_H
+#define GCSOPENIDOLDER_H
+
+
+@class NSCalendarDate;
+@class NSException;
+@class NSNumber;
+@class NSString;
+
+@class GCSFolderManager;
+
+@interface GCSOpenIdFolder : NSObject
+{
+  GCSFolderManager *folderManager;
+}
+
++ (id)openIdFolderWithFolderManager:(GCSFolderManager *)newFolderManager;
+
+- (void) setFolderManager: (GCSFolderManager *) newFolderManager;
+
+/* operations */
+
+- (void) createFolderIfNotExists;
+- (BOOL) canConnectStore;
+
+- (NSString *) getRefreshToken: (NSString *) _user_session useOldSession: (BOOL) use_old_session;
+- (NSString *) getNewToken: (NSString *) _old_session;
+- (NSException *) writeOpenIdSession: (NSString *) _user_session
+                  withOldSession: (NSString *) _old_session
+                  withRefreshToken: (NSString *) _refresh_token
+                  withExpire: (NSNumber *) _expire
+                  withRefreshExpire: (NSNumber *) _refresh_expire;
+- (NSException *) deleteOpenIdSessionFor: (NSString *) _user_session;
+
+@end
+
+#endif /* GCSALARMSFOLDER_H */

SOPE/GDLContentStore/GCSOpenIdFolder.m

@@ -0,0 +1,363 @@
+/* GCSAdminFolder.m - this file is part of SOGo
+ *
+ * Copyright (C) 2023 Alinto
+ *
+ * This file is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This file is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING.  If not, write to
+ * the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+
+#import <NGExtensions/NSObject+Logs.h>
+#import <NGExtensions/NSNull+misc.h>
+
+#import <GDLAccess/EOAdaptorContext.h>
+#import <GDLAccess/EOAttribute.h>
+#import <GDLAccess/EOEntity.h>
+#import <GDLAccess/EOSQLQualifier.h>
+
+#import "EOQualifier+GCS.h"
+#import "GCSChannelManager.h"
+#import "GCSFolderManager.h"
+#import "GCSSpecialQueries.h"
+#import "NSURL+GCS.h"
+
+#import "GCSOpenIdFolder.h"
+
+static NSString *openIdFolderURLString = nil;
+
+#warning GCSOpenIdFolder should share a common ancestor with GCSFolder
+
+@implementation GCSOpenIdFolder
+
++ (void) initialize
+{
+  NSUserDefaults *ud;
+
+  if (!openIdFolderURLString)
+  {
+    ud = [NSUserDefaults standardUserDefaults];
+    ASSIGN (openIdFolderURLString, [ud stringForKey: @"OCSOpenIdURL"]);
+  }
+}
+  
++ (id) openIdFolderWithFolderManager: (GCSFolderManager *) newFolderManager
+{
+  GCSOpenIdFolder *newFolder;
+
+  if (openIdFolderURLString)
+    {
+      newFolder = [self new];
+      [newFolder autorelease];
+      [newFolder setFolderManager: newFolderManager];
+    }
+  else
+    {
+      [self errorWithFormat: @"'OCSOpenIdURL' is not set"];
+      newFolder = nil;
+    }
+
+  return newFolder;
+}
+
+- (void) setFolderManager: (GCSFolderManager *) newFolderManager
+{
+  ASSIGN (folderManager, newFolderManager);
+}
+
+/* accessors */
+
+- (NSURL *) _location
+{
+  NSURL *location;
+
+  if (openIdFolderURLString)
+    location = [NSURL URLWithString: openIdFolderURLString];
+  else
+    {
+      [self warnWithFormat: @"'OCSOpenIdURL' is not set"];
+      location = nil;
+    }
+
+  return location;
+}
+
+- (GCSChannelManager *) _channelManager
+{
+  return [folderManager channelManager];
+}
+
+- (NSString *) _storeTableName
+{
+  return [[self _location] gcsTableName];
+}
+
+- (EOEntity *) _storeTableEntityForChannel: (EOAdaptorChannel *) tc
+{
+  static EOEntity *entity = nil;
+  EOAttribute *attribute;
+  NSString *tableName;
+  NSString *columns[] = {@"c_user_session", @"c_old_session", @"c_session_started", @"c_refresh_token", @"c_access_token_expires_in", @"c_refresh_token_expires_in", nil };
+  NSString **column;
+  NSMutableArray *keys;
+  NSDictionary *types;
+  
+  if (!entity)
+    {
+      entity = [EOEntity new];
+      tableName = [self _storeTableName];
+      [entity setName: tableName];
+      [entity setExternalName: tableName];
+
+      types = [[tc specialQueries] openIdAttributeTypes];
+
+      column = columns;
+      while (*column)
+        {
+          attribute = [EOAttribute new];
+          [attribute setName: *column];
+          [attribute setColumnName: *column];
+          [attribute setExternalType: [types objectForKey: *column]];
+          [entity addAttribute: attribute];
+          [attribute release];
+          column++;
+        }
+
+      keys = [NSMutableArray arrayWithCapacity: 1];
+      [keys addObject: [entity attributeNamed: @"c_user_session"]];
+      [entity setPrimaryKeyAttributes: keys];
+
+      keys = [NSMutableArray arrayWithCapacity: 5];
+      [keys addObject: [entity attributeNamed: @"c_old_session"]];
+      [keys addObject: [entity attributeNamed: @"c_session_started"]];
+      [keys addObject: [entity attributeNamed: @"c_refresh_token"]];
+      [keys addObject: [entity attributeNamed: @"c_access_token_expires_in"]];
+      [keys addObject: [entity attributeNamed: @"c_refresh_token_expires_in"]];
+      [entity setClassProperties: keys];
+      [entity setAttributesUsedForLocking: [NSArray array]];
+    }
+
+  return entity;
+}
+
+/* connection */
+
+- (EOAdaptorChannel *) _acquireStoreChannel
+{
+  return [[self _channelManager] acquireOpenChannelForURL: [self _location]];
+}
+
+- (void) _releaseChannel: (EOAdaptorChannel *) _channel
+{
+  [[self _channelManager] releaseChannel:_channel  immediately: YES];
+}
+
+- (BOOL) canConnectStore
+{
+  return [[self _channelManager] canConnect:[self _location]];
+}
+
+- (void) createFolderIfNotExists
+{
+  EOAdaptorChannel *tc;
+  NSString *sql, *tableName;
+  GCSSpecialQueries *queries;
+
+  tc = [self _acquireStoreChannel];
+  tableName = [self _storeTableName];
+
+  queries = [tc specialQueries];
+
+  sql = [NSString stringWithFormat: @"SELECT 1 FROM %@ WHERE 1 = 2", tableName];
+  if ([tc evaluateExpressionX: sql])
+  {
+    sql = [queries createOpenIdFolderWithName: tableName];
+    if (![tc evaluateExpressionX: sql])
+      [self logWithFormat: @"openid folder table '%@' successfully created!", tableName];
+  }
+  else
+    [tc cancelFetch];
+
+  [self _releaseChannel: tc];
+}
+
+/* operations */
+
+/* table has the following fields:
+    c_user_session              varchar(255)  NOT NULL,
+    c_session_started           int(11)       NOT NULL,
+    c_refresh_token             varchar(4096) DEFAULT '',
+    c_access_token_expires_in    int(11)       NOT NULL,
+    c_refresh_token_expires_in  int(11)       DEFAULT NULL,
+*/
+
+- (NSDictionary *) recordForSession: (NSString *) _user_session useOldSession: (BOOL) use_old_session
+{
+  EOAdaptorChannel *tc;
+  EOAdaptorContext *context;
+  NSException *error;
+  NSArray *attrs;
+  NSDictionary *record;
+  EOEntity *entity;
+  EOSQLQualifier *qualifier;
+
+  record = nil;
+
+  tc = [self _acquireStoreChannel];
+  if (tc)
+  {
+    context   = [tc adaptorContext];
+    entity    = [self _storeTableEntityForChannel: tc];
+    if(!use_old_session)
+      qualifier = [[EOSQLQualifier alloc] initWithEntity: entity
+                                         qualifierFormat: @"c_user_session='%@'", _user_session];
+    else
+      qualifier = [[EOSQLQualifier alloc] initWithEntity: entity
+                                         qualifierFormat: @"c_old_session='%@'", _user_session];
+    [qualifier autorelease];
+
+    [context beginTransaction];
+    error = [tc selectAttributesX: [entity attributesUsedForFetch]
+              describedByQualifier: qualifier
+                        fetchOrder: nil
+                              lock: NO];
+    if (error)
+      [self errorWithFormat:@"%s: cannot execute fetch: %@", __PRETTY_FUNCTION__, error];
+    else
+    {
+      attrs = [tc describeResults: NO];
+      record = [tc fetchAttributes: attrs withZone: NULL];
+      [tc cancelFetch];
+    }
+    [context rollbackTransaction];
+    [self _releaseChannel: tc];
+  }
+
+  return record;
+}
+
+- (NSString *) getRefreshToken: (NSString *) _user_session
+{
+  NSDictionary *r;
+
+  r = [self recordForSession: _user_session useOldSession: NO];
+  if (r && [r objectForKey:@"c_refresh_token"])
+    return [r objectForKey:@"c_refresh_token"];
+
+  return nil;
+}
+
+- (NSString *) getNewToken: (NSString *) _old_session
+{
+  NSDictionary *r;
+  r = [self recordForSession: _old_session useOldSession: YES];
+  if (r && [r objectForKey:@"c_user_session"])
+    return [r objectForKey:@"c_user_session"];
+
+  return nil;
+}
+
+
+- (NSException *) writeOpenIdSession: (NSString *) _user_session
+                  withOldSession: (NSString *) _old_session
+                  withRefreshToken: (NSString *) _refresh_token
+                  withExpire: (NSNumber *) _expire
+                  withRefreshExpire: (NSNumber *) _refresh_expire
+{
+  NSDictionary *record, *newRecord;
+  NSException *error;
+  NSCalendarDate *nowDate;
+  int now, nowExpire, nowRefreshExpire;
+  EOAdaptorChannel *tc;
+  EOAdaptorContext *context;
+  EOEntity *entity;
+  EOSQLQualifier *qualifier;
+
+  error = nil;
+  tc = [self _acquireStoreChannel];
+  if (tc)
+  {
+    context = [tc adaptorContext];
+
+    nowDate = [NSCalendarDate date];
+    now = (nowDate ? (int)[nowDate timeIntervalSince1970] : 0);
+    nowExpire = now + [_expire intValue];
+    if(_refresh_expire)
+      nowRefreshExpire = now + [_refresh_expire intValue];
+    else
+      nowRefreshExpire = -1;
+    if(!_old_session)
+      _old_session = @"";
+
+    newRecord = [NSDictionary dictionaryWithObjectsAndKeys: _user_session, @"c_user_session",
+                      _old_session, @"c_old_session",
+                      [NSNumber numberWithInt:now], @"c_session_started",
+                      _refresh_token, @"c_refresh_token",
+                      [NSNumber numberWithInt:nowExpire] , @"c_access_token_expires_in",
+                      [NSNumber numberWithInt:nowRefreshExpire] , @"c_refresh_token_expires_in",
+                      nil];
+    record = [self recordForSession: _user_session useOldSession: NO];
+    entity = [self _storeTableEntityForChannel: tc];
+    [context beginTransaction];
+    if (!record)
+    {
+      //If the session already exist no need to update it as it is unique
+      error = [tc insertRowX: newRecord forEntity: entity];
+    }
+      
+    if (error)
+    {
+      [context rollbackTransaction];
+      [self errorWithFormat:@"%s: cannot write record: %@",  __PRETTY_FUNCTION__, error];
+    }
+    else
+      [context commitTransaction];
+    [self _releaseChannel: tc];
+  }
+  return error;
+}
+
+- (NSException *) deleteOpenIdSessionFor: (NSString *) _user_session
+{
+  EOAdaptorChannel *tc;
+  EOAdaptorContext *context;
+  EOEntity *entity;
+  EOSQLQualifier *qualifier;
+  NSException *error;
+
+  error = nil;
+  tc = [self _acquireStoreChannel];
+  if (tc)
+  {
+    context = [tc adaptorContext];
+    entity = [self _storeTableEntityForChannel: tc];
+    qualifier = [[EOSQLQualifier alloc] initWithEntity: entity
+                                        qualifierFormat: @"c_user_session='%@'",_user_session];
+    [qualifier autorelease];
+    [context beginTransaction];
+    error = [tc deleteRowsDescribedByQualifierX: qualifier];
+    if (error)
+    {
+      [context rollbackTransaction];
+      [self errorWithFormat:@"%s: cannot delete record: %@", __PRETTY_FUNCTION__, error];
+    }
+    else
+      [context commitTransaction];
+    [self _releaseChannel: tc];
+  }
+  
+  return error;
+}
+
+@end

SOPE/GDLContentStore/GCSSpecialQueries.h

@@ -42,6 +42,9 @@
 - (NSString *)createAdminFolderWithName:(NSString *)tableName;
 - (NSDictionary *)adminAttributeTypes;
 
+- (NSString *)createOpenIdFolderWithName:(NSString *)tableName;
+- (NSDictionary *)openIdAttributeTypes;
+
 - (NSString *) updateCPathInFolderInfo:(NSString *)tableName
 withCPath2:(NSString *)c_path2;
 

SOPE/GDLContentStore/GCSSpecialQueries.m

@@ -95,6 +95,21 @@
   return nil;
 }
 
+- (NSString *) createOpenIdFolderWithName: (NSString *) tableName
+{
+  [self subclassResponsibility: _cmd];
+
+  return nil;
+}
+
+- (NSDictionary *) openIdAttributeTypes
+{
+  [self subclassResponsibility: _cmd];
+
+  return nil;
+}
+
+
 - (NSString *) createFolderTableWithName: (NSString *) tableName
 {
   [self subclassResponsibility: _cmd];
@@ -195,6 +210,38 @@
   return types;
 }
 
+- (NSString *) createOpenIdFolderWithName: (NSString *) tableName
+{
+  static NSString *sqlFolderFormat
+    = (@"CREATE TABLE %@ (" 
+       @" c_user_session VARCHAR(4096) NOT NULL,"
+       @" c_old_session VARCHAR(4096) NULL,"
+       @" c_session_started INT4 NOT NULL,"
+       @" c_refresh_token VARCHAR(4096) NULL,"
+       @" c_access_token_expires_in INT4 NOT NULL,"
+       @" c_refresh_token_expires_in INT4 NULL)");
+
+  return [NSString stringWithFormat: sqlFolderFormat, tableName];
+}
+
+- (NSDictionary *) openIdAttributeTypes
+{
+  static NSMutableDictionary *types = nil;
+
+  if (!types)
+    {
+      types = [NSMutableDictionary new];
+      [types setObject: @"varchar" forKey: @"c_user_session"];
+      [types setObject: @"varchar" forKey: @"c_old_session"];
+      [types setObject: @"int" forKey: @"c_session_started"];
+      [types setObject: @"varchar" forKey: @"c_refresh_token"];
+      [types setObject: @"int" forKey: @"c_access_token_expires_in"];
+      [types setObject: @"int" forKey: @"c_refresh_token_expires_in"];
+    }
+
+  return types;
+}
+
 - (NSString *) createFolderTableWithName: (NSString *) tableName
 {
   static NSString *sqlFolderFormat
@@ -324,6 +371,38 @@
   return types;
 }
 
+- (NSString *) createOpenIdFolderWithName: (NSString *) tableName
+{
+  static NSString *sqlFolderFormat
+    = (@"CREATE TABLE %@ (" 
+       @" c_user_session VARCHAR(4096) NOT NULL,"
+       @" c_old_session VARCHAR(4096) NULL,"
+       @" c_session_started INT4 NOT NULL,"
+       @" c_refresh_token VARCHAR(4096) NULL,"
+       @" c_access_token_expires_in INT4 NOT NULL,"
+       @" c_refresh_token_expires_in INT4 NULL)");
+
+  return [NSString stringWithFormat: sqlFolderFormat, tableName];
+}
+
+- (NSDictionary *) openIdAttributeTypes
+{
+  static NSMutableDictionary *types = nil;
+
+  if (!types)
+    {
+      types = [NSMutableDictionary new];
+      [types setObject: @"varchar" forKey: @"c_user_session"];
+      [types setObject: @"varchar" forKey: @"c_old_session"];
+      [types setObject: @"int" forKey: @"c_session_started"];
+      [types setObject: @"varchar" forKey: @"c_refresh_token"];
+      [types setObject: @"int" forKey: @"c_access_token_expires_in"];
+      [types setObject: @"int" forKey: @"c_refresh_token_expires_in"];
+    }
+
+  return types;
+}
+
 - (NSString *) createFolderTableWithName: (NSString *) tableName
 {
   static NSString *sqlFolderFormat
@@ -453,6 +532,38 @@
   return types;
 }
 
+- (NSString *) createOpenIdFolderWithName: (NSString *) tableName
+{
+  static NSString *sqlFolderFormat
+    = (@"CREATE TABLE %@ (" 
+       @" c_user_session VARCHAR2(4096) NOT NULL,"
+       @" c_old_session VARCHAR2(4096) NULL,"
+       @" c_session_started INTEGER NOT NULL,"
+       @" c_refresh_token VARCHAR2(4096) NULL,"
+       @" c_access_token_expires_in INTEGER NOT NULL,"
+       @" c_refresh_token_expires_in INTEGER NULL)");
+
+  return [NSString stringWithFormat: sqlFolderFormat, tableName];
+}
+
+- (NSDictionary *) openIdAttributeTypes
+{
+  static NSMutableDictionary *types = nil;
+
+  if (!types)
+    {
+      types = [NSMutableDictionary new];
+      [types setObject: @"varchar2" forKey: @"c_user_session"];
+      [types setObject: @"varchar2" forKey: @"c_old_session"];
+      [types setObject: @"integer" forKey: @"c_session_started"];
+      [types setObject: @"varchar2" forKey: @"c_refresh_token"];
+      [types setObject: @"integer" forKey: @"c_access_token_expires_in"];
+      [types setObject: @"integer" forKey: @"c_refresh_token_expires_in"];
+    }
+
+  return types;
+}
+
 - (NSString *) createFolderTableWithName: (NSString *) tableName
 {
   static NSString *sqlFolderFormat

SOPE/GDLContentStore/GNUmakefile

@@ -28,13 +28,14 @@ libGDLContentStore_HEADER_FILES +=		\
 	GCSAdminFolder.h			\
 	GCSContext.h				\
 	GCSFieldInfo.h				\
-	GCSFolder.h				\
+	GCSFolder.h				    \
 	GCSFolderManager.h			\
 	GCSFolderType.h				\
 	GCSChannelManager.h			\
+	GCSOpenIdFolder.h           \
 	GCSSessionsFolder.h			\
 	GCSSpecialQueries.h			\
-	GCSStringFormatter.h			\
+	GCSStringFormatter.h		\
 
 libGDLContentStore_OBJC_FILES +=		\
 	NSURL+GCS.m				\
@@ -45,13 +46,14 @@ libGDLContentStore_OBJC_FILES +=		\
 	GCSAdminFolder.m			\
 	GCSContext.m				\
 	GCSFieldInfo.m				\
-	GCSFolder.m				\
+	GCSFolder.m				    \
 	GCSFolderManager.m			\
 	GCSFolderType.m				\
 	GCSChannelManager.m			\
+	GCSOpenIdFolder.m           \
 	GCSSessionsFolder.m			\
 	GCSSpecialQueries.m			\
-	GCSStringFormatter.m			\
+	GCSStringFormatter.m	    \
 
 # framework support
 

Scripts/mysql-utf8mb4.sql

@@ -165,6 +165,16 @@ CREATE TABLE sogo_admin (
 	PRIMARY KEY (c_key)
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC;
 
+CREATE TABLE sogo_opend_id (
+	c_user_session              varchar(4096) NOT NULL,
+	c_old_session              varchar(4096) DEFAULT '',
+	c_session_started           int(11)       NOT NULL,
+	c_refresh_token             varchar(4096) DEFAULT '',
+	c_access_token_expires_in    int(11)       NOT NULL,
+	c_refresh_token_expires_in  int(11)       DEFAULT NULL,
+	PRIMARY KEY (c_user_session)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC;
+
 CREATE TABLE sogo_user_profile (
 	c_uid      varchar(255) NOT NULL,
 	c_defaults longtext,

SoObjects/Mailer/SOGoMailBaseObject.m

@@ -132,14 +132,24 @@
 
 - (NGImap4ConnectionManager *) mailManager
 {
-  return [NGImap4ConnectionManager defaultConnectionManager];
+  SOGoSystemDefaults *sd;
+  NSString *imapAuthMech, *domain;
+
+  domain = [[[self context] activeUser] loginDomain];
+  sd = [SOGoSystemDefaults sharedSystemDefaults];
+  if([sd doesLoginTypeByDomain])
+    imapAuthMech = [sd getImapAuthMechForDomain: domain];
+  else
+    imapAuthMech = nil;
+
+  return [NGImap4ConnectionManager defaultConnectionManager: imapAuthMech];
 }
 
 - (NGImap4Connection *) _createIMAP4Connection
 {
   NGImap4ConnectionManager *manager;
   NGImap4Connection *newConnection;
-  NSString *password;
+  NSString *password, *domain;
   NGInternetSocketAddress *host;
   SOGoSystemDefaults *sd;
   BOOL usesSSO;
@@ -152,12 +162,15 @@
   host = [NGInternetSocketAddress addressWithPort:0 onHost:[[self imap4URL] host]];
 
   sd = [SOGoSystemDefaults sharedSystemDefaults];
-  usesSSO = [[sd authenticationType] isEqualToString: @"cas"] || [[sd authenticationType] isEqualToString: @"saml2"];
+
+  domain = [[[self context] activeUser] loginDomain];
+  usesSSO = [sd isSsoUsed: domain];
 
   if (![[[self mailAccountFolder] nameInContainer] isEqualToString: @"0"] &&
       usesSSO &&
       [host isLocalhost])
     {
+      //
       [self errorWithFormat: @"Trying to use localhost for additional IMAP account - aborting."];
       return nil;
     }
@@ -227,19 +240,17 @@
       login = [[[self context] activeUser] login];
 
       if (!login)
-	login = [[[[self container] context] activeUser] login];
+	      login = [[[[self container] context] activeUser] login];
 
-      cacheKey = [NSString stringWithFormat: @"%@+%@",
-			   login,
-			   [[self mailAccountFolder] nameInContainer]];
+      cacheKey = [NSString stringWithFormat: @"%@+%@", login, [[self mailAccountFolder] nameInContainer]];
       imap4 = [sogoCache imap4ConnectionForKey: cacheKey];
       if (!imap4)
-        {
-          imap4 = [self _createIMAP4Connection];
-	  [sogoCache registerIMAP4Connection: imap4
-				      forKey: cacheKey];
-        }
-      [imap4 retain];
+      {
+        imap4 = [self _createIMAP4Connection];
+        [sogoCache registerIMAP4Connection: imap4
+                                    forKey: cacheKey];
+      }
+    [imap4 retain];
     }
 
    // Connection broken, try to reconnect

SoObjects/SOGo/GNUmakefile

@@ -69,6 +69,7 @@ SOGo_HEADER_FILES = \
 	SOGoAuthenticator.h		\
 	SOGoSession.h			\
 	SOGoCASSession.h		\
+	SOGoOpenIdSession.h		\
 	SOGoDAVAuthenticator.h		\
 	SOGoProxyAuthenticator.h	\
 	SOGoStaticAuthenticator.h	\
@@ -161,6 +162,7 @@ SOGo_OBJC_FILES = \
 	\
 	SOGoSession.m			\
 	SOGoCASSession.m		\
+	SOGoOpenIdSession.m   \
 	SOGoDAVAuthenticator.m		\
 	SOGoProxyAuthenticator.m	\
 	SOGoStaticAuthenticator.m	\

SoObjects/SOGo/GNUmakefile.preamble

@@ -17,6 +17,7 @@ SOGo_LIBRARIES_DEPEND_UPON += \
         -Wl,--no-as-needed \
 	-L../../SOPE/NGCards/$(GNUSTEP_OBJ_DIR)/ \
 	-lmemcached		\
+	-lcurl \
 	-lGDLAccess		\
 	-lNGObjWeb		\
 	-lNGCards		\

SoObjects/SOGo/NSDictionary+Utilities.m

@@ -95,6 +95,7 @@
   return keysWithFormat;
 }
 
+
 - (NSComparisonResult) caseInsensitiveDisplayNameCompare: (NSDictionary *) theDictionary
 {
   return [[self objectForKey: @"cn"] caseInsensitiveCompare: [theDictionary objectForKey: @"cn"]];

SoObjects/SOGo/NSString+Utilities.m

@@ -80,7 +80,10 @@ static int cssEscapingCount;
     {
       hostR = [self rangeOfString: @"://"];
       locationR = [[self substringFromIndex: (hostR.location + hostR.length)] rangeOfString: @"/"];
-      newURL = [self substringFromIndex: (hostR.location + hostR.length + locationR.location)];
+      if(locationR.location != NSNotFound)
+        newURL = [self substringFromIndex: (hostR.location + hostR.length + locationR.location)];
+      else
+        newURL = @"";
     }
 
   return newURL;

SoObjects/SOGo/SOGoCache.h

@@ -119,6 +119,13 @@
 
 - (void) removeCASSessionWithTicket: (NSString *) ticket;
 
+// OpenId Support
+- (NSString *) openIdSessionFromServer: (NSString *) endpoint;
+- (void) setOpenIdSession: (NSString *) openIdSession
+         forServer: (NSString *) endpoint;
+- (NSString *) userOpendIdSessionFromServer: (NSString *) endpoint;
+- (void) setUserOpendIdSessionFromServer: (NSString *) endpoint
+                          nextCheckAfter: (NSString *) nextCheck;
 //
 // SAML2 support
 //

SoObjects/SOGo/SOGoCache.m

@@ -683,6 +683,32 @@ static memcached_st *handle = NULL;
     }
 }
 
+
+// OpenId support
+
+- (NSString *) openIdSessionFromServer: (NSString *) endpoint
+{
+  return [self valueForKey: [NSString stringWithFormat: @"openId:%@", endpoint]];
+}
+
+- (void) setOpenIdSession: (NSString *) openIdSession
+         forServer: (NSString *) endpoint
+{
+  [self setValue: openIdSession
+          forKey: [NSString stringWithFormat: @"openId:%@", endpoint]];
+}
+
+- (NSString *) userOpendIdSessionFromServer: (NSString *) identifier
+{
+  return [self valueForKey: [NSString stringWithFormat: @"userOpenId:%@", identifier]];
+}
+- (void) setUserOpendIdSessionFromServer: (NSString *) identifier
+                  nextCheckAfter: (NSString *) nextCheck
+{
+    [self setValue: nextCheck
+          forKey: [NSString stringWithFormat: @"userOpenId:%@", identifier]];
+}
+
 //
 // SAML2 support
 //

SoObjects/SOGo/SOGoDAVAuthenticator.m

@@ -141,6 +141,7 @@
   return password;
 }
 
+
 /* create SOGoUser */
 
 - (SOGoUser *) userInContext: (WOContext *)_ctx

SoObjects/SOGo/SOGoDefaultsSource.h

@@ -62,6 +62,7 @@ extern NSString *SOGoDefaultsSourceUnmutableSource;
 
 - (void) setBool: (BOOL) value forKey: (NSString *) key;
 - (BOOL) boolForKey: (NSString *) key;
+- (BOOL) boolForKey: (NSString *) key andDict: (NSDictionary*) _dict;
 
 - (void) setFloat: (float) value forKey: (NSString *) key;
 - (float) floatForKey: (NSString *) key;

SoObjects/SOGo/SOGoDefaultsSource.m

@@ -164,6 +164,29 @@ static Class NSStringKlass = Nil;
   return value;
 }
 
+- (BOOL) boolForKey: (NSString *) key andDict: (NSDictionary*) _dict
+{
+  id boolForKey;
+  BOOL value;
+
+  boolForKey = [_dict objectForKey: key];
+  if (boolForKey)
+    {
+      if ([boolForKey respondsToSelector: @selector (boolValue)])
+        value = [boolForKey boolValue];
+      else
+        {
+          [self warnWithFormat: @"expected a boolean for '%@' (ignored)",
+                key];
+          value = NO;
+        }
+    }
+  else
+    value = NO;
+
+  return value;
+}
+
 - (void) setFloat: (float) value
 	   forKey: (NSString *) key
 {

SoObjects/SOGo/SOGoMailer.h

@@ -25,6 +25,7 @@
 @class NSArray;
 @class NSException;
 @class NSString;
+@class NSDictionary;
 
 @class WOContext;
 @class SOGoDomainDefaults;

SoObjects/SOGo/SOGoMailer.m

@@ -31,6 +31,7 @@
 #import "NSString+Utilities.h"
 #import "SOGoStaticAuthenticator.h"
 #import "SOGoEmptyAuthenticator.h"
+#import "SOGoWebAuthenticator.h"
 #import "SOGoSystemDefaults.h"
 #import "SOGoUser.h"
 #import "SOGoUserManager.h"
@@ -265,7 +266,8 @@
                       inContext: (WOContext *) woContext
                   systemMessage: (BOOL) isSystemMessage
 {
-  NSString *currentTo, *login, *password;
+  NSString *currentTo, *login, *password, *encryption, *protocol, *server;
+  NSString * smtpAuthMethod;
   NSDictionary *currentAcount;
   NSMutableArray *toErrors;
   NSEnumerator *addresses;
@@ -273,6 +275,7 @@
   NSException *result;
   NSURL * smtpUrl;
   SOGoUser* user;
+  SOGoSystemDefaults *sd;
   BOOL doSmtpAuth;
 
   result = nil;
@@ -288,12 +291,30 @@
   currentAcount = [[user mailAccounts] objectAtIndex: userId];
 
   //Check if we do an smtp authentication
-  doSmtpAuth = [authenticationType isEqualToString: @"plain"] && ![authenticator isKindOfClass: [SOGoEmptyAuthenticator class]];
+  smtpAuthMethod = authenticationType;
+  doSmtpAuth = ([smtpAuthMethod isEqualToString: @"plain"] || [smtpAuthMethod isEqualToString: @"xoauth2"]) 
+                                            && ![authenticator isKindOfClass: [SOGoEmptyAuthenticator class]];
   if(!doSmtpAuth && userId > 0)
   {
     doSmtpAuth = [currentAcount objectForKey: @"smtpAuth"] ? [[currentAcount objectForKey: @"smtpAuth"] boolValue] : NO;
   }
 
+  sd = [SOGoSystemDefaults sharedSystemDefaults];
+  if(userId == 0 && [sd doesLoginTypeByDomain] && [authenticator isKindOfClass: [SOGoWebAuthenticator class]])
+  {
+    //Check if the authentication depends on the domain, only for webmail requets not for dav...
+    NSString *username, *_domain;
+    NSRange r;
+
+    username = [currentAcount objectForKey: @"userName"];
+    r = [username rangeOfString: @"@"];
+    if (r.location != NSNotFound)
+    {
+      _domain = [username substringFromIndex: r.location+1];
+      smtpAuthMethod = [sd getSmtpAuthMechForDomain: _domain];
+    }
+  }
+
   NS_DURING
     {
       [client connect];
@@ -304,6 +325,7 @@
           {
             login = [currentAcount objectForKey: @"userName"];
             password = [currentAcount objectForKey: @"password"];
+            smtpAuthMethod = "plain"; //Only support plain for auxiliary account
           }
           else
           {
@@ -315,15 +337,27 @@
                         getExternalLoginForUID: [[authenticator userInContext: woContext] loginInDomain]
                                       inDomain: [[authenticator userInContext: woContext] domain]];
 
-            password = [authenticator passwordInContext: woContext];
+            encryption = [currentAcount objectForKey: @"encryption"];
+            protocol = @"imap";
+            if ([encryption isEqualToString: @"ssl"] || [encryption isEqualToString: @"tls"])
+              protocol = @"imaps";
+            server = [NSString stringWithFormat: @"%@://%@", protocol, [currentAcount objectForKey: @"serverName"]];
+            if([authenticator isKindOfClass: [SOGoWebAuthenticator class]])
+              password = [authenticator smtpPasswordInContext: woContext forURL: server];
+            else
+            {
+              password = [authenticator passwordInContext: woContext];
+              smtpAuthMethod = @"plain"; //is a dav or activesync request, only support plain method
+            }
           }
 
 
           if (isSystemMessage 
               && ![[[SOGoUserManager sharedUserManager] getEmailForUID: [[authenticator userInContext: woContext] loginInDomain]] isEqualToString: sender] 
               && smtpMasterUserEnabled) {
-            if (![client plainAuthenticateUser: smtpMasterUserUsername
-                                   withPassword: smtpMasterUserPassword]) {
+            if (![client authenticateUser: smtpMasterUserUsername
+                                  withPassword: smtpMasterUserPassword
+                                    withMethod: smtpAuthMethod]) {
               result = [NSException exceptionWithHTTPStatus: 500
                                                    reason: @"cannot send message:"
                                   @" (smtp) authentication failure"];
@@ -334,8 +368,9 @@
           {
             if ([login length] == 0
               || [login isEqualToString: @"anonymous"]
-              || ![client plainAuthenticateUser: login
-                                   withPassword: password])
+              || ![client authenticateUser: login
+                                   withPassword: password
+                                     withMethod: smtpAuthMethod])
               result = [NSException exceptionWithHTTPStatus: 500
                                                     reason: @"cannot send message:"
                                     @" (smtp) authentication failure"];

SoObjects/SOGo/SOGoOpenIdSession.h

@@ -0,0 +1,104 @@
+/* SOGoCASSession.h - this file is part of SOGo
+ *
+ * Copyright (C) 2000-2023 Alinto.
+ *
+ * This file is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This file is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING.  If not, write to
+ * the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#ifndef SOGOOPENIDSESSION_H
+#define SOGOOPENIDSESSION_H
+
+/* implementation of the OpenId Connect as required for a client/proxy:
+   https://openid.net/developers/how-connect-works/ */
+
+#import <NGObjWeb/WOResponse.h>
+#import <SOGo/SOGoObject.h>
+
+
+@class NSString;
+@class NSMutableDictionary;
+@class NSURL;
+@class NSJSONSerialization;
+
+
+@interface SOGoOpenIdSession : SOGoObject
+{
+  //For cache
+  BOOL cacheUpdateNeeded;
+  int userTokenInterval;
+
+  //From sogo.conf
+  BOOL openIdSessionIsOK;
+  NSString *openIdConfigUrl;
+  NSString *openIdScope;
+  NSString *openIdClient;
+  NSString *openIdClientSecret;
+  NSString *openIdEmailParam;
+  BOOL openIdEnableRefreshToken;
+  BOOL sendDomainInfo;
+
+  NSString *forDomain;
+
+
+  //From request to well-known/configuration
+  NSString *authorizationEndpoint;
+  NSString *tokenEndpoint;
+  NSString *introspectionEndpoint;
+  NSString *userinfoEndpoint;
+  NSString *endSessionEndpoint;
+  NSString *revocationEndpoint;
+
+  //Access token
+  NSString *accessToken;
+  NSString *refreshToken;
+  NSString *idToken;
+  NSString *tokenType;
+  NSNumber *expiresIn;
+  NSNumber *refreshExpiresIn;
+}
+
++ (BOOL) checkUserConfig;
++ (SOGoOpenIdSession *) OpenIdSession: (NSString *) _domain;
++ (SOGoOpenIdSession *) OpenIdSessionWithConfig: (NSDictionary *) _config;
++ (SOGoOpenIdSession *) OpenIdSessionWithToken: (NSString *) token domain: (NSString *) _domain;
++ (SOGoOpenIdSession *) OpenIdSessionWithTokenAndConfig: (NSString *) token config: (NSDictionary *) _config;
++ (void) deleteValueForSessionKey: (NSString *) theSessionKey;
+
+- (void) initialize;
+- (void) initializeWithConfig: (NSDictionary *) _config;
+- (BOOL) sessionIsOK;
+- (WOResponse *) _performOpenIdRequest: (NSString *) endpoint
+                        method: (NSString *) method
+                       headers: (NSDictionary *) headers
+                          body: (NSData *) body;
+- (NSMutableDictionary *) fecthConfiguration: (NSString *) _domain;
+- (void) setAccessToken;
+- (NSString *) getRefreshToken; 
+- (NSString *) getToken;
+- (NSString *) getCurrentToken; 
+- (NSString *) loginUrl: (NSString *) oldLocation;
+- (NSMutableDictionary *) fetchToken: (NSString *) code redirect: (NSString *) oldLocation;
+
+- (NSString *) logoutUrl;
+- (NSMutableDictionary *) fetchUserInfo;
+- (NSString *) _login;
+- (NSString *) login: (NSString *) identifier;
+
+
+@end
+
+
+#endif /* SOGOOPENIDSESSION_H */

SoObjects/SOGo/SOGoOpenIdSession.m

@@ -0,0 +1,785 @@
+/* SOGoCASSession.m - this file is part of SOGo
+ *
+ * Copyright (C) 2010-2014 Inverse inc.
+ *
+ * This file is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This file is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING.  If not, write to
+ * the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#import <NGObjWeb/WOHTTPConnection.h>
+#import <NGObjWeb/WORequest.h>
+#import <NGObjWeb/WOResponse.h>
+#import <NGExtensions/NSObject+Logs.h>
+
+#import <SOGo/SOGoUser.h>
+
+
+#import <GDLContentStore/GCSOpenIdFolder.h>
+#import <GDLContentStore/GCSFolderManager.h>
+
+#import "NSDictionary+Utilities.h"
+#import "NSString+Utilities.h"
+#import "SOGoCache.h"
+#import "SOGoSystemDefaults.h"
+
+#import "SOGoOpenIdSession.h"
+
+static BOOL SOGoOpenIDDebugEnabled = YES;
+
+@implementation SOGoOpenIdSession
+
+/// Check if all required parameters to set up a OpenIdSession are in sogo.conf
+
++ (BOOL) checkUserConfig
+{
+  SOGoSystemDefaults *sd;
+
+  if(nil == [[GCSFolderManager defaultFolderManager] openIdFolder])
+  {
+    [self errorWithFormat: @"Something wrong with the table defined by OCSOpenIdURL"];
+    return NO;
+  }
+  sd = [SOGoSystemDefaults sharedSystemDefaults];
+  return ([sd openIdConfigUrl] && [sd openIdScope]  && [sd openIdClient]  && [sd openIdClientSecret]);
+}
+
+- (void) initializeWithConfig: (NSDictionary *) _config
+{
+  SOGoSystemDefaults *sd;
+  id refreshTokenBool, domainInfo;
+
+  if([_config objectForKey: @"SOGoOpenIdConfigUrl"] &&
+      [_config objectForKey: @"SOGoOpenIdScope"] &&
+      [_config objectForKey: @"SOGoOpenIdClient"] &&
+      [_config objectForKey: @"SOGoOpenIdClientSecret"])
+  {
+    openIdConfigUrl          = [_config objectForKey: @"SOGoOpenIdConfigUrl"];
+    openIdScope              = [_config objectForKey: @"SOGoOpenIdScope"];
+    openIdClient             = [_config objectForKey: @"SOGoOpenIdClient"];
+    openIdClientSecret       = [_config objectForKey: @"SOGoOpenIdClientSecret"];
+    openIdEmailParam         = [_config objectForKey: @"SOGoOpenIdEmailParam"];
+
+    openIdEnableRefreshToken = NO;
+    refreshTokenBool = [_config objectForKey: @"SOGoOpenIdEnableRefreshToken"];
+    if (refreshTokenBool && [refreshTokenBool respondsToSelector: @selector (boolValue)])
+        openIdEnableRefreshToken = [refreshTokenBool boolValue];
+
+    sendDomainInfo = NO;
+    domainInfo = [_config objectForKey: @"SOGoOpenIdSendDomainInfo"];
+    if (domainInfo && [domainInfo respondsToSelector: @selector (boolValue)])
+        sendDomainInfo = [domainInfo boolValue];
+
+      
+    userTokenInterval        = [_config objectForKey: @"SOGoOpenIdTokenCheckInterval"];
+    [self _loadSessionFromCache: forDomain];
+
+    if(cacheUpdateNeeded)
+    {
+      [self fecthConfiguration: forDomain];
+    }
+  }
+  else
+  {
+    [self errorWithFormat: @"Missing parameters from sogo.conf"];
+  }
+}
+
+- (void) initialize: (NSString*) _domain
+{
+  SOGoSystemDefaults *sd;
+  NSDictionary *config;
+  NSString *type;
+
+  sd = [SOGoSystemDefaults sharedSystemDefaults];
+  SOGoOpenIDDebugEnabled = [sd openIdDebugEnabled];
+  openIdSessionIsOK = NO;
+
+  //Check if there is a root config or config per domain
+  if(_domain != nil && [sd doesLoginTypeByDomain])
+  {
+    forDomain = _domain;
+    type = [sd getLoginTypeForDomain: _domain];
+    if(type != nil && [type isEqualToString: @"openid"])
+    {
+      config = [sd getLoginConfigForDomain: _domain];
+      [self initializeWithConfig: config];
+    }
+    else
+    {
+      [self errorWithFormat: @"Missing parameters from sogo.conf"];
+    }
+  }
+  else if ([[self class] checkUserConfig])
+  {
+    openIdConfigUrl          = [sd openIdConfigUrl];
+    openIdScope              = [sd openIdScope];
+    openIdClient             = [sd openIdClient];
+    openIdClientSecret       = [sd openIdClientSecret];
+    openIdEmailParam         = [sd openIdEmailParam];
+    openIdEnableRefreshToken = [sd openIdEnableRefreshToken];
+    userTokenInterval        = [sd openIdTokenCheckInterval];
+    sendDomainInfo           = [sd openIdSendDomainInfo];
+    forDomain = _domain;
+
+    [self _loadSessionFromCache: _domain];
+
+    if(cacheUpdateNeeded)
+    {
+      [self fecthConfiguration: _domain];
+    }
+      
+  }
+  else
+  {
+    [self errorWithFormat: @"Missing parameters from sogo.conf"];
+  }
+}
+
+
+- (WOResponse *) _performOpenIdRequest: (NSString *) endpoint
+                        method: (NSString *) method
+                       headers: (NSDictionary *) headers
+                          body: (NSData *) body
+{
+  NSURL *url;
+  NSUInteger status;
+  WORequest *request;
+  WOResponse *response;
+  WOHTTPConnection *httpConnection;
+  
+  
+  url = [NSURL URLWithString: endpoint];
+  if (url)
+  {
+    if(SOGoOpenIDDebugEnabled)
+    {
+      NSLog(@"OpenId perform request: %@ %@", method, endpoint);
+      NSLog(@"OpenId perform request, headers %@", headers);
+      // if(body)
+      //   NSLog(@"OpenId perform request: content %@", [[NSString alloc] initWithData:body encoding:NSUTF8StringEncoding]);
+    }
+      
+    httpConnection = [[WOHTTPConnection alloc] initWithURL: url];
+    [httpConnection autorelease];
+
+    request = [[WORequest alloc] initWithMethod: method
+                                            uri: [endpoint hostlessURL]
+                                    httpVersion: @"HTTP/1.1"
+                                        headers: headers content: body
+                                        userInfo: nil];
+    [request autorelease];
+    [httpConnection sendRequest: request];
+    response = [httpConnection readResponse];
+    status = [response status];
+    if(status >= 200 && status <500 && status != 404)
+      return response;
+    else if (status == 404)
+    {
+      [self errorWithFormat: @"OpenID endpoint not found (404): %@", endpoint];
+      return nil; 
+    }
+    else
+    {
+      [self errorWithFormat: @"OpenID server internal error during %@: %@", endpoint, response];
+      return nil;
+    }
+  }
+  else
+  {
+    [self errorWithFormat: @"OpenID can't handle endpoint (not a url): '%@'", endpoint];
+    return nil;
+  }
+}
+
+- (NSMutableDictionary *) fecthConfiguration: (NSString*) _domain
+{
+  NSString *content;
+  WOResponse * response;
+  NSUInteger status;
+  NSMutableDictionary *result;
+  NSDictionary *config, *headers;
+  NSURL *url;
+
+  result = [NSMutableDictionary dictionary];
+  [result setObject: self->openIdConfigUrl  forKey: @"url"];
+
+  url = [NSURL URLWithString: self->openIdConfigUrl ];
+  if (url)
+  {
+    if(self->sendDomainInfo && _domain != nil && [_domain length] > 0)
+      headers = [NSDictionary dictionaryWithObject: _domain forKey: @"sogo-user-domain"];
+    else
+      headers = nil;
+
+    response = [self _performOpenIdRequest: self->openIdConfigUrl 
+                      method: @"GET"
+                      headers: headers
+                        body: nil];
+
+    if (response)
+    {
+      status = [response status];
+      if(status >= 200 && status <300)
+      {
+        content = [response contentString];
+        config = [content objectFromJSONString];
+        self->authorizationEndpoint = [config objectForKey: @"authorization_endpoint"];
+        self->tokenEndpoint         = [config objectForKey: @"token_endpoint"];
+        self->userinfoEndpoint      = [config objectForKey: @"userinfo_endpoint"];
+        self->endSessionEndpoint    = [config objectForKey: @"end_session_endpoint"];
+
+        //Optionnals?
+        if([config objectForKey: @"introspection_endpoint"])
+          self->introspectionEndpoint = [config objectForKey: @"introspection_endpoint"];
+        if([config objectForKey: @"revocation_endpoint"])
+          self->revocationEndpoint    = [config objectForKey: @"revocation_endpoint"];
+
+        openIdSessionIsOK = YES;
+        [self _saveSessionToCache: _domain];
+      }
+      else
+      {
+        [self logWithFormat: @"Error during fetching the configuration (status %d), response: %@", status, response];
+      }
+    }
+    else
+      [result setObject: @"http-error" forKey: @"error"];
+  }
+  else
+    [result setObject: @"invalid-url" forKey: @"error"];
+  
+  return result;
+}
+
++ (SOGoOpenIdSession *) OpenIdSession: (NSString *) _domain
+{
+  SOGoOpenIdSession *newSession;
+
+  newSession = [self new];
+  [newSession autorelease];
+  [newSession initialize: _domain];
+
+  return newSession;
+}
+
++ (SOGoOpenIdSession *) OpenIdSessionWithConfig: (NSDictionary *) _config
+{
+  SOGoOpenIdSession *newSession;
+
+  newSession = [self new];
+  [newSession autorelease];
+  [newSession initializeWithConfig: _config];
+
+  return newSession;
+}
+
++ (SOGoOpenIdSession *) OpenIdSessionWithToken: (NSString *) token domain: (NSString *) _domain
+{
+  SOGoOpenIdSession *newSession;
+
+  if (token)
+    {
+      newSession = [self new];
+      [newSession autorelease];
+      [newSession initialize: _domain];
+      
+      [newSession setAccessToken: token];
+    }
+  else
+    newSession = nil;
+
+  return newSession;
+}
+
++ (SOGoOpenIdSession *) OpenIdSessionWithTokenAndConfig: (NSString *) token config: (NSDictionary *) _config
+{
+  SOGoOpenIdSession *newSession;
+
+  if (token)
+    {
+      newSession = [self new];
+      [newSession autorelease];
+      [newSession initializeWithConfig: _config];
+      
+      [newSession setAccessToken: token];
+    }
+  else
+    newSession = nil;
+
+  return newSession;
+}
+
+
+- (BOOL) sessionIsOk
+{
+  return self->openIdSessionIsOK;
+}
+
+- (void) _loadSessionFromCache: (NSString*) _domain
+{
+  SOGoCache *cache;
+  NSString *jsonSession, *cacheKey;
+  NSDictionary *sessionDict;
+
+  if(_domain != nil && [_domain length] > 0)
+    cacheKey = [self->openIdConfigUrl stringByAppendingFormat: @":%@", _domain];
+  else
+    cacheKey = self->openIdConfigUrl;
+
+  cache = [SOGoCache sharedCache];
+  jsonSession = [cache openIdSessionFromServer: cacheKey];
+  if ([jsonSession length])
+  {
+    sessionDict = [jsonSession objectFromJSONString];
+    ASSIGN (authorizationEndpoint, [sessionDict objectForKey: @"authorization_endpoint"]);
+    ASSIGN (tokenEndpoint, [sessionDict objectForKey: @"token_endpoint"]);
+    ASSIGN (userinfoEndpoint, [sessionDict objectForKey: @"userinfo_endpoint"]);
+    ASSIGN (endSessionEndpoint, [sessionDict objectForKey: @"end_session_endpoint"]);
+
+    //Optionnals?
+    if([sessionDict objectForKey: @"introspection_endpoint"])
+      ASSIGN (introspectionEndpoint, [sessionDict objectForKey: @"introspection_endpoint"]);
+    if([sessionDict objectForKey: @"revocation_endpoint"])
+      ASSIGN (revocationEndpoint, [sessionDict objectForKey: @"revocation_endpoint"]);
+    openIdSessionIsOK = YES;
+  }
+  else
+    cacheUpdateNeeded = YES;
+}
+
+- (void) _saveSessionToCache: (NSString*) _domain
+{
+  SOGoCache *cache;
+  NSString *jsonSession, *cacheKey;
+  NSMutableDictionary *sessionDict;
+
+  cache = [SOGoCache sharedCache];
+  sessionDict = [NSMutableDictionary dictionary];
+  [sessionDict setObject: authorizationEndpoint forKey: @"authorization_endpoint"];
+  [sessionDict setObject: tokenEndpoint forKey: @"token_endpoint"];
+  [sessionDict setObject: userinfoEndpoint forKey: @"userinfo_endpoint"];
+  [sessionDict setObject: endSessionEndpoint forKey: @"end_session_endpoint"];
+
+  //Optionnals?
+  if(introspectionEndpoint)
+    [sessionDict setObject: introspectionEndpoint forKey: @"introspection_endpoint"];
+  if(revocationEndpoint)
+    [sessionDict setObject: revocationEndpoint forKey: @"revocation_endpoint"];
+
+  jsonSession = [sessionDict jsonRepresentation];
+
+  if(_domain != nil && [_domain length] > 0)
+    cacheKey = [self->openIdConfigUrl stringByAppendingFormat: @":%@", _domain];
+  else
+    cacheKey = self->openIdConfigUrl;
+
+  [cache setOpenIdSession: jsonSession
+                forServer: cacheKey];
+}
+
+
+- (BOOL) _loadUserFromCache: (NSString *) email
+{
+  /*
+  Return NO if the user token must be check again, YES the user is valid for now
+  */
+  SOGoCache *cache;
+  NSString *identifier, *nextCheck;
+  NSTimeInterval nextCheckTime, timeNow;
+
+  identifier = [self->openIdClient stringByAppendingString: email];
+
+  cache = [SOGoCache sharedCache];
+  nextCheck = [cache userOpendIdSessionFromServer: identifier];
+  if ([nextCheck length])
+  {
+    timeNow = [[NSDate date] timeIntervalSince1970];
+    nextCheckTime = [nextCheck doubleValue];
+    if(timeNow > nextCheckTime)
+      return NO;
+    else
+      return YES;
+  }
+  else
+    return NO;
+}
+
+- (void) _saveUserToCache: (NSString *) email
+{
+  SOGoCache *cache;
+  NSString *identifier, *nextCheck;
+  NSTimeInterval nextCheckTime;
+
+  identifier    = [self->openIdClient stringByAppendingString: email];
+  nextCheckTime = [[NSDate date] timeIntervalSince1970] + self->userTokenInterval;
+  nextCheck     = [NSString stringWithFormat:@"%f", nextCheckTime];
+
+  cache = [SOGoCache sharedCache];
+  [cache setUserOpendIdSessionFromServer: identifier
+         nextCheckAfter: nextCheck];
+}
+
+- (NSString*) loginUrl: (NSString *) oldLocation
+{
+  NSString* logUrl;
+  logUrl = [self->authorizationEndpoint stringByAppendingFormat: @"?scope=%@", self->openIdScope];
+  logUrl = [logUrl stringByAppendingString: @"&response_type=code"];
+  logUrl = [logUrl stringByAppendingFormat: @"&client_id=%@", self->openIdClient];
+  logUrl = [logUrl stringByAppendingFormat: @"&redirect_uri=%@", oldLocation];
+  if(self->forDomain != nil && [self->forDomain length] > 0)
+    logUrl = [logUrl stringByAppendingFormat: @"&sogo_domain=%@", forDomain];
+  // logurl = [self->logurl stringByAppendingFormat: @"&state=%@", state];
+
+  return logUrl;
+}
+
+- (NSString *) logoutUrl
+{
+  return self->endSessionEndpoint;
+}
+
+- (NSString*) getRefreshToken
+{
+  return self->refreshToken;
+}
+
+- (NSString*) getToken
+{
+  return self->accessToken;
+}
+
+- (void) setAccessToken: (NSString* ) token
+{
+  self->accessToken = token;
+}
+
+
+- (NSString *) getCurrentToken
+{
+  NSString *currentToken;
+
+  //See if the current token has been refreshed
+  currentToken = [[[GCSFolderManager defaultFolderManager] openIdFolder] getNewToken: self->accessToken];
+
+  if(currentToken)
+  {
+    //be sure the old token has been cleaned
+    [[[GCSFolderManager defaultFolderManager] openIdFolder] deleteOpenIdSessionFor: self->accessToken];
+    return currentToken;
+  }
+  return self->accessToken;
+}
+
+- (NSMutableDictionary *) fetchToken: (NSString * ) code redirect: (NSString *) oldLocation
+{
+  NSString *location, *form, *content;
+  WOResponse *response;
+  NSUInteger status;
+  NSMutableDictionary *result;
+  NSDictionary *headers;
+  NSDictionary *tokenRet;
+  NSURL *url;
+
+  result = [NSMutableDictionary dictionary];
+  [result setObject: @"ok" forKey: @"error"];
+  
+  location = self->tokenEndpoint;
+  url = [NSURL URLWithString: location];
+  if (url)
+  {
+    form = @"grant_type=authorization_code";
+    form = [form stringByAppendingFormat: @"&code=%@", code];
+    form = [form stringByAppendingFormat: @"&redirect_uri=%@", [oldLocation stringByEscapingURL]];
+    form = [form stringByAppendingFormat: @"&client_secret=%@", self->openIdClientSecret];
+    form = [form stringByAppendingFormat: @"&client_id=%@", self->openIdClient];
+
+    if(self->sendDomainInfo && self->forDomain != nil && [self->forDomain length] > 0)
+      headers = [NSDictionary dictionaryWithObjectsAndKeys: @"application/x-www-form-urlencoded", @"content-type",
+                                                                self->forDomain, @"sogo-user-domain", nil];
+    else
+      headers = [NSDictionary dictionaryWithObject: @"application/x-www-form-urlencoded"  forKey: @"content-type"];
+    
+    response = [self _performOpenIdRequest: location
+                      method: @"POST"
+                      headers: headers
+                        body: [form dataUsingEncoding:NSUTF8StringEncoding]];
+
+    if (response)
+    {
+      status = [response status];
+      if(status >= 200 && status <300)
+      {
+        content = [response contentString];
+        tokenRet = [content objectFromJSONString];
+        if (SOGoOpenIDDebugEnabled)
+        {
+          NSLog(@"fetch token response: %@", tokenRet);
+        }
+        self->accessToken = [tokenRet objectForKey: @"access_token"];
+        self->refreshToken = [tokenRet objectForKey: @"refresh_token"];
+        self->refreshExpiresIn = [tokenRet objectForKey: @"refresh_expires_in"];
+        self->idToken = [tokenRet objectForKey: @"id_token"];
+        self->tokenType = [tokenRet objectForKey: @"token_type"];
+        self->expiresIn = [tokenRet objectForKey: @"expires_in"];
+      }
+      else
+      {
+        [self logWithFormat: @"Error during fetching the token (status %d), response: %@", status, response];
+      }
+    }
+    else
+    {
+        [result setObject: @"http-error" forKey: @"error"];
+    }
+  }
+  else
+    [result setObject: @"invalid-url" forKey: @"error"];
+  
+  return result;
+}
+
+- (NSMutableDictionary *) refreshToken: (NSString * ) userRefreshToken
+{
+  NSString *location, *form, *content;
+  WOResponse *response;
+  NSUInteger status;
+  NSMutableDictionary *result;
+  NSDictionary *headers;
+  NSDictionary *refreshTokenRet;
+  NSURL *url;
+
+  result = [NSMutableDictionary dictionary];
+  [result setObject: @"ok" forKey: @"error"];
+  
+  if(!userRefreshToken || [userRefreshToken length] == 0)
+  {
+    [result setObject: @"invalid-token" forKey: @"error"];
+    return result;
+  }
+
+  location = self->tokenEndpoint;
+  url = [NSURL URLWithString: location];
+  if (url)
+  {
+    form = @"grant_type=refresh_token";
+    form = [form stringByAppendingFormat: @"&scope=%@", self->openIdScope];
+    form = [form stringByAppendingFormat: @"&refresh_token=%@", userRefreshToken];
+    form = [form stringByAppendingFormat: @"&client_secret=%@", self->openIdClientSecret];
+    form = [form stringByAppendingFormat: @"&client_id=%@", self->openIdClient];
+
+    if(self->sendDomainInfo && self->forDomain != nil && [self->forDomain length] > 0)
+      headers = [NSDictionary dictionaryWithObjectsAndKeys: @"application/x-www-form-urlencoded", @"content-type",
+                                                                self->forDomain, @"sogo-user-domain", nil];
+    else
+      headers = [NSDictionary dictionaryWithObject: @"application/x-www-form-urlencoded"  forKey: @"content-type"];
+    
+    response = [self _performOpenIdRequest: location
+                      method: @"POST"
+                      headers: headers
+                        body: [form dataUsingEncoding:NSUTF8StringEncoding]];
+
+    if (response)
+    {
+      status = [response status];
+      if(status >= 200 && status <300)
+      {
+        content = [response contentString];
+        refreshTokenRet = [content objectFromJSONString];
+        if (SOGoOpenIDDebugEnabled)
+        {
+          NSLog(@"refresh token response: %@", refreshTokenRet);
+        }
+        self->accessToken = [refreshTokenRet objectForKey: @"access_token"];
+        self->refreshToken = [refreshTokenRet objectForKey: @"refresh_token"];
+        self->refreshExpiresIn = [refreshTokenRet objectForKey: @"refresh_expires_in"];
+        self->tokenType = [refreshTokenRet objectForKey: @"token_type"];
+        self->expiresIn = [refreshTokenRet objectForKey: @"expires_in"];
+      }
+      else
+      {
+        [self logWithFormat: @"Error during refreshing the token (status %d), response: %@", status, response];
+      }
+    }
+    else
+    {
+        [result setObject: @"http-error" forKey: @"error"];
+    }
+  }
+  else
+    [result setObject: @"invalid-url" forKey: @"error"];
+  
+  return result;
+}
+
+- (NSMutableDictionary *) fetchUserInfo
+{
+  NSString *location, *auth, *content;
+  WOResponse *response;
+  NSUInteger status;
+  NSMutableDictionary *result;
+  NSDictionary *profile, *headers;
+  NSURL *url;
+  NSString *email;
+
+  result = [NSMutableDictionary dictionary];
+  [result setObject: @"ok" forKey: @"error"];
+
+  location = self->userinfoEndpoint;
+  url = [NSURL URLWithString: location];
+  if (url)
+  {
+    auth = [NSString stringWithFormat: @"Bearer %@", self->accessToken];
+    if(self->sendDomainInfo && self->forDomain != nil && [self->forDomain length] > 0)
+      headers = [NSDictionary dictionaryWithObjectsAndKeys: @"application/x-www-form-urlencoded", @"content-type",
+                                                                self->forDomain, @"sogo-user-domain",
+                                                                auth, @"authorization", nil];
+    else
+      headers = [NSDictionary dictionaryWithObjectsAndKeys: @"application/x-www-form-urlencoded", @"content-type",
+                                                                auth, @"authorization", nil];
+
+    response = [self _performOpenIdRequest: location
+                       method: @"GET"
+                      headers: headers
+                         body: nil];
+    if (response)
+    {
+        status = [response status];
+        if(status >= 200 && status <300)
+        {
+          content = [response contentString];
+          profile = [content objectFromJSONString];
+          if(SOGoOpenIDDebugEnabled && profile)
+            NSLog(@"OpenId fetch user info, profile is %@", profile);
+
+            /*profile = {"sub":"70a3e6a1-37cf-4cf6-b114-6973aabca86a",
+                        "email_verified":false,
+                        "address":{},
+                        "name":"Foo Bar",
+                        "preferred_username":"myuser",
+                        "given_name":"Foo",
+                        "family_name":"Bar",
+                        "email":"myuser@user.com"}*/
+          if (email = [profile objectForKey: self->openIdEmailParam])
+          {
+            if(self->userTokenInterval > 0)
+              [self _saveUserToCache: email];
+            [result setObject: email forKey: @"login"];
+          }
+          else
+            [result setObject: @"no mail found"  forKey: @"error"];
+        }
+        else
+        {
+          [self logWithFormat: @"Error during fetching the token (status %d), response: %@", status, response];
+          [result setObject: @"http-error" forKey: @"error"];
+        }
+    }
+    else
+    {
+      [result setObject: @"http-error" forKey: @"error"];
+    }
+  }
+  else
+    [result setObject: @"invalid-url" forKey: @"error"];
+  
+  return result;
+}
+
+
+
++ (void) deleteValueForSessionKey: (NSString *) theSessionKey
+{
+  GCSOpenIdFolder *folder;
+  
+  folder = [[GCSFolderManager defaultFolderManager] openIdFolder];
+  [folder deleteOpenIdSessionFor: theSessionKey];
+}
+
+- (NSString *) _login
+{
+  NSMutableDictionary *resultUserInfo, *resultResfreh;
+  NSString* _oldAccessToken;
+
+  resultUserInfo = [self fetchUserInfo];
+  if ([[resultUserInfo objectForKey: @"error"] isEqualToString: @"ok"])
+  { 
+    //Save some infos as the refresh token to the database
+    [[[GCSFolderManager defaultFolderManager] openIdFolder] writeOpenIdSession: self->accessToken
+                                                                withOldSession: nil
+                                                              withRefreshToken: self->refreshToken
+                                                                    withExpire: self->expiresIn
+                                                             withRefreshExpire: self->refreshExpiresIn];
+    return [resultUserInfo objectForKey: @"login"];
+  }
+  else if(openIdEnableRefreshToken)
+  {
+    //try to refresh
+    if(self->accessToken)
+    {
+      self->refreshToken = [[[GCSFolderManager defaultFolderManager] openIdFolder] getRefreshToken: self->accessToken];
+      //remove old session
+      [[[GCSFolderManager defaultFolderManager] openIdFolder] deleteOpenIdSessionFor: self->accessToken];
+    }
+    if(self->refreshToken)
+    {
+      _oldAccessToken = self->accessToken;
+      resultResfreh = [self refreshToken: self->refreshToken];
+      if ([[resultResfreh objectForKey: @"error"] isEqualToString: @"ok"])
+      {
+        resultUserInfo = [self fetchUserInfo];
+        if ([[resultUserInfo objectForKey: @"error"] isEqualToString: @"ok"])
+        {
+          [[[GCSFolderManager defaultFolderManager] openIdFolder] writeOpenIdSession: self->accessToken
+                                                                      withOldSession: _oldAccessToken
+                                                                    withRefreshToken: self->refreshToken
+                                                                          withExpire: self->expiresIn
+                                                                   withRefreshExpire: self->refreshExpiresIn];
+          return [resultUserInfo objectForKey: @"login"];
+        }
+      }
+    }
+
+    //The acces token hasn't work, delete the session in database if needed
+    if(self->accessToken)
+    {
+      [[[GCSFolderManager defaultFolderManager] openIdFolder] deleteOpenIdSessionFor: self->accessToken];
+    }
+
+    [self errorWithFormat: @"Can't get user email from profile because: %@", [resultUserInfo objectForKey: @"error"]];
+  }
+  else
+  {
+    //remove old session
+    [[[GCSFolderManager defaultFolderManager] openIdFolder] deleteOpenIdSessionFor: self->accessToken];
+  }
+
+  return @"anonymous";
+}
+
+- (NSString *) login: (NSString *) email
+{
+  //Check if we need to fetch userinfo
+  if(self->userTokenInterval > 0 && [self _loadUserFromCache: email])
+  {
+    return email;
+  }
+  else
+  {
+    return [self _login];
+  }
+
+}
+
+@end

SoObjects/SOGo/SOGoSession.m

@@ -247,12 +247,20 @@
 			      usingKey: theKey];
   
   r = [decodedValue rangeOfString: @":"];
-  *theLogin = [decodedValue substringToIndex: r.location];
-  *thePassword = [decodedValue substringFromIndex: r.location+1];
+  if (r.location != NSNotFound) 
+  {
+    *theLogin = [decodedValue substringToIndex: r.location];
+    *thePassword = [decodedValue substringFromIndex: r.location+1];
+  }
+  else
+  {
+    *theLogin = nil;
+    *thePassword = nil;
+  }
   *theDomain = nil;
-  
+
   sd = [SOGoSystemDefaults sharedSystemDefaults];
-  if ([sd enableDomainBasedUID])
+  if (*theLogin &&[sd enableDomainBasedUID])
     {
       r = [*theLogin rangeOfString: @"@" options: NSBackwardsSearch];
       if (r.location != NSNotFound)

SoObjects/SOGo/SOGoSieveManager.m

@@ -28,6 +28,7 @@
 #import <SOGo/NSDictionary+Utilities.h>
 #import <SOGo/NSString+Utilities.h>
 #import <SOGo/SOGoDomainDefaults.h>
+#import <SOGo/SOGoSystemDefaults.h>
 #import <SOGo/SOGoUser.h>
 #import <SOGo/SOGoTextTemplateFile.h>
 
@@ -697,8 +698,11 @@ static NSString *sieveScriptName = @"sogo";
   NSDictionary *result;
   NSString *login, *authname, *password;
   SOGoDomainDefaults *dd;
+  SOGoSystemDefaults *sd;
   NGSieveClient *client;
   NSString *sieveServer, *sieveScheme, *sieveQuery, *imapServer;
+  NSString *imapAuthMech, *userDomain;
+  NSRange r;
   NSURL *url, *cUrl;
   int sievePort;
   BOOL connected;
@@ -773,7 +777,20 @@ static NSString *sieveScriptName = @"sogo";
   url = [NSURL URLWithString: [NSString stringWithFormat: @"%@://%@:%d%@",
                                sieveScheme, sieveServer, sievePort, sieveQuery]];
 
-  client = [[NGSieveClient alloc] initWithURL: url];
+  //In case of differrent auth method for different domain, check it
+  sd = [SOGoSystemDefaults sharedSystemDefaults];
+  imapAuthMech = nil;
+  if([sd doesLoginTypeByDomain])
+  {
+    r = [theUsername rangeOfString: @"@"];
+    if (r.location != NSNotFound)
+    {
+      userDomain = [theUsername substringFromIndex: r.location+1];
+      imapAuthMech = [sd getImapAuthMechForDomain: userDomain];
+    }
+  }
+
+  client = [[NGSieveClient alloc] initWithURL: url andAuthMech: imapAuthMech];
 
   if (!client) {
     [self errorWithFormat: @"Sieve connection failed on %@", [url description]];

SoObjects/SOGo/SOGoSystemDefaults.h

@@ -36,6 +36,11 @@ static const NSString *kDisableSharingCalendar = @"Calendar";
 + (SOGoSystemDefaults *) sharedSystemDefaults;
 
 - (NSArray *) domainIds;
+- (BOOL) doesLoginTypeByDomain;
+- (NSString *) getLoginTypeForDomain: (NSString*) _domain;
+- (NSString *) getLoginConfigForDomain: (NSDictionary*) _domain;
+- (NSString *) getImapAuthMechForDomain: (NSString*) _domain;
+- (NSString *) getSmtpAuthMechForDomain: (NSString*) _domain;
 - (BOOL) forbidUnknownDomainsAuth;
 - (NSArray *) domainsAllowed;
 - (BOOL) enableDomainBasedUID;
@@ -77,6 +82,7 @@ static const NSString *kDisableSharingCalendar = @"Calendar";
 
 - (BOOL) uixDebugEnabled;
 - (BOOL) easDebugEnabled;
+- (BOOL) openIdDebugEnabled;
 - (BOOL) tnefDecoderDebugEnabled;
 - (BOOL) xsrfValidationEnabled;
 
@@ -89,11 +95,22 @@ NSComparisonResult languageSort(id el1, id el2, void *context);
 - (NSString *) loginSuffix;
 
 - (NSString *) authenticationType;
+- (BOOL) isSsoUsed: (NSString *) domain;
 - (NSString *) davAuthenticationType;
 
 - (NSString *) CASServiceURL;
 - (BOOL) CASLogoutEnabled;
 
+- (NSString *) openIdConfigUrl;
+- (NSString *) openIdScope;
+- (NSString *) openIdClient;
+- (NSString *) openIdClientSecret;
+- (NSString *) openIdEmailParam;
+- (BOOL) openIdEnableRefreshToken;
+- (BOOL) openIdLogoutEnabled: (NSString *) _domain;
+- (int) openIdTokenCheckInterval;
+- (BOOL) openIdSendDomainInfo;
+
 - (NSString *) SAML2PrivateKeyLocation;
 - (NSString *) SAML2CertificateLocation;
 - (NSString *) SAML2IdpMetadataLocation;

SoObjects/SOGo/SOGoSystemDefaults.m

@@ -262,6 +262,143 @@ _injectConfigurationFromFile (NSMutableDictionary *defaultsDict,
   return [domains allKeys];
 }
 
+- (BOOL) doesLoginTypeByDomain
+{
+  return ([self dictionaryForKey: @"SOGoLoginTypeByDomain"] != nil);
+}
+
+- (NSString *) getLoginTypeForDomain: (NSString*) _domain
+{
+  NSDictionary *domains, *config;
+  NSString *type;
+  if(![self doesLoginTypeByDomain])
+    return nil;
+  domains = [self dictionaryForKey: @"SOGoLoginTypeByDomain"];
+  if([domains objectForKey: _domain])
+  {
+    config = [domains objectForKey: _domain];
+  }
+  else if([domains objectForKey: @"login_default"])
+  {
+    config = [domains objectForKey: @"login_default"];
+  }
+  else
+    return nil;
+
+  if((type = [config objectForKey: @"type"]))
+  {
+    return type;
+  }
+  else
+    return nil;
+}
+
+- (NSString *) getImapAuthMechForDomain: (NSString*) _domain
+{
+  NSDictionary *domains, *config;
+  NSString *type;
+
+  if(![self doesLoginTypeByDomain])
+    return nil;
+
+  domains = [self dictionaryForKey: @"SOGoLoginTypeByDomain"];
+
+  if([domains objectForKey: _domain])
+  {
+    config = [domains objectForKey: _domain];
+  }
+  else if([domains objectForKey: @"login_default"])
+  {
+    config = [domains objectForKey: @"login_default"];
+  }
+  else
+    return nil;
+
+  if((type = [config objectForKey: @"imapAuthMech"]))
+  {
+    return type;
+  }
+  else
+    return nil;
+}
+
+- (NSString *) getSmtpAuthMechForDomain: (NSString*) _domain
+{
+  NSDictionary *domains, *config;
+  NSString *type;
+  
+  if(![self doesLoginTypeByDomain])
+    return nil;
+
+  domains = [self dictionaryForKey: @"SOGoLoginTypeByDomain"];
+
+  if([domains objectForKey: _domain])
+  {
+    config = [domains objectForKey: _domain];
+  }
+  else if([domains objectForKey: @"login_default"])
+  {
+    config = [domains objectForKey: @"login_default"];
+  }
+  else
+    return nil;
+
+  if((type = [config objectForKey: @"smtpAuthMech"]))
+  {
+    return type;
+  }
+  else
+    return nil;
+}
+
+- (NSString *) getLoginConfigForDomain: (NSDictionary*) _domain
+{
+  NSDictionary *domains, *config;
+  if(![self doesLoginTypeByDomain])
+    return nil;
+  domains = [self dictionaryForKey: @"SOGoLoginTypeByDomain"];
+  if([domains objectForKey: _domain])
+  {
+    config = [domains objectForKey: _domain];
+  }
+  else if([domains objectForKey: @"login_default"])
+  {
+    config = [domains objectForKey: @"login_default"];
+  }
+  
+  if(config)
+    return config;
+  else
+    return nil;
+}
+
+- (BOOL) hasOpenIdType
+{
+  if([self doesLoginTypeByDomain])
+  {
+    NSDictionary *domainsConfig;
+    NSEnumerator *e; 
+    NSString *domain, *type;
+    if(![self doesLoginTypeByDomain])
+      return NO;
+    domainsConfig = [self dictionaryForKey: @"SOGoLoginTypeByDomain"];
+    e = [domainsConfig keyEnumerator];
+    while((domain = [e nextObject]))
+    {
+      if((type = [[domainsConfig objectForKey: domain] objectForKey: @"type"]))
+      {
+        if([type isEqualToString: @"openid"])
+          return YES;
+      }
+    }
+    return NO;
+  }
+  else
+    return [[self authenticationType] isEqualToString: @"openid"];
+
+}
+
+
 - (BOOL) enableDomainBasedUID
 {
   return [self boolForKey: @"SOGoEnableDomainBasedUID"];
@@ -512,6 +649,11 @@ _injectConfigurationFromFile (NSMutableDictionary *defaultsDict,
   return [self boolForKey: @"SOGoEASDebugEnabled"];
 }
 
+- (BOOL) openIdDebugEnabled
+{
+  return [self boolForKey: @"SOGoOpenIDDebugEnabled"];
+}
+
 - (BOOL) tnefDecoderDebugEnabled
 {
   return [self boolForKey: @"SOGoTnefDecoderDebugEnabled"];
@@ -582,6 +724,16 @@ NSComparisonResult languageSort(id el1, id el2, void *context)
   return [[self stringForKey: @"SOGoAuthenticationType"] lowercaseString];
 }
 
+- (BOOL) isSsoUsed: (NSString *) domain
+{
+  NSString* authType;
+
+  authType = [self getLoginTypeForDomain: domain];
+  if(!authType)
+    authType = [self authenticationType];
+  return ([authType isEqualToString: @"cas"] || [authType isEqualToString: @"saml2"] || [authType isEqualToString: @"openid"]);
+}
+
 - (NSString *) davAuthenticationType
 {
   return [[self stringForKey: @"SOGoDAVAuthenticationType"] lowercaseString];
@@ -597,6 +749,78 @@ NSComparisonResult languageSort(id el1, id el2, void *context)
   return [self boolForKey: @"SOGoCASLogoutEnabled"];
 }
 
+/* OpenId Support */
+- (NSString *) openIdConfigUrl
+{
+  return [self stringForKey: @"SOGoOpenIdConfigUrl"];
+}
+
+- (NSString *) openIdScope
+{
+  return [self stringForKey: @"SOGoOpenIdScope"];
+}
+
+- (NSString *) openIdClient
+{
+  return [self stringForKey: @"SOGoOpenIdClient"];
+}
+
+- (NSString *) openIdClientSecret
+{
+  return [self stringForKey: @"SOGoOpenIdClientSecret"];
+}
+
+- (NSString *) openIdEmailParam
+{
+  NSString *emailParam;
+  emailParam = [self stringForKey: @"SOGoOpenIdEmailParam"];
+  if(!emailParam)
+    emailParam = @"email";
+  return emailParam;
+}
+
+- (BOOL) openIdLogoutEnabled: (NSString *) _domain
+{
+  if(_domain && [self doesLoginTypeByDomain])
+  {
+    NSDictionary *config;
+    NSString *type;
+    id value;
+    if((config = [self getLoginConfigForDomain: _domain]))
+    {
+      if((type = [config objectForKey: @"type"]) && [type isEqualToString:@"openid"])
+        return [self boolForKey: @"SOGoOpenIdLogoutEnabled" andDict: config];
+    }
+    return NO;
+  }
+  return [self boolForKey: @"SOGoOpenIdLogoutEnabled"];
+}
+
+- (BOOL) openIdSendDomainInfo
+{
+  return [self boolForKey: @"SOGoOpenIdSendDomainInfo"];
+}
+
+- (int) openIdTokenCheckInterval
+{
+
+  int v;
+
+  v = [self integerForKey: @"SOGoOpenIdTokenCheckInterval"];
+
+  if (!v)
+    v = 0;
+  if(v<0)
+    v = 0;
+
+  return v;
+}
+
+- (BOOL) openIdEnableRefreshToken
+{
+  return [self boolForKey: @"SOGoOpenIdEnableRefreshToken"];
+}
+
 /* SAML2 support */
 - (NSString *) SAML2PrivateKeyLocation
 {

SoObjects/SOGo/SOGoUser.h

@@ -91,6 +91,7 @@
 
 /* properties */
 - (NSString *) domain;
+- (NSString *) loginDomain;
 - (id <SOGoSource>) authenticationSource;
 
 - (NSArray *) allEmails;

SoObjects/SOGo/SOGoUser.m

@@ -301,6 +301,19 @@ static const NSString *kEncryptedUserNamePrefix = @"uenc";
   return [self _fetchFieldForUser: @"c_domain"];
 }
 
+- (NSString *) loginDomain
+{
+    NSRange r;
+    NSString *domain = nil;
+    r = [self->login rangeOfString: @"@"];
+    if (r.location != NSNotFound)
+    {
+        domain = [self->login substringFromIndex: r.location+1];
+    }
+    return domain;
+}
+
+
 - (id <SOGoSource>) authenticationSource
 {
   NSString *sourceID;

SoObjects/SOGo/SOGoWebAuthenticator.h

@@ -27,6 +27,7 @@
 #import "SOGoConstants.h"
 
 @class NSString;
+@class NSMutableDictionary;
 
 @class WOContext;
 @class WOCookie;
@@ -58,6 +59,8 @@
                       andPassword: (NSString *) password
                         inContext: (WOContext *) context;
 
+- (NSArray *)getCookiesIfNeeded: (WOContext *)_ctx;
+
 @end
 
 #endif /* _SOGOWEBAUTHENTICATOR_H_ */

SoObjects/SOGo/SOGoWebAuthenticator.m

@@ -35,6 +35,7 @@
 
 #import "SOGoCache.h"
 #import "SOGoCASSession.h"
+#import "SOGoOpenIdSession.h"
 #import "SOGoPermissions.h"
 #import "SOGoSession.h"
 #import "SOGoSystemDefaults.h"
@@ -133,22 +134,53 @@
      additionalInfo: (NSMutableDictionary **)_additionalInfo
            useCache: (BOOL) _useCache
 {
-  SOGoCASSession *session;
+  SOGoCASSession *casSession;
+  SOGoOpenIdSession * openIdSession;
   SOGoSystemDefaults *sd;
   NSString *authenticationType;
+  NSString* loginDomain;
   BOOL rc;
 
   sd = [SOGoSystemDefaults sharedSystemDefaults];
+  
+  //Basic check
+  if(!_login)
+    return NO;
+  if(_login && [_login length] == 0)
+    return NO;
+
+  loginDomain = nil;
+  if(*_domain == nil || [*_domain length] == 0)
+  {
+      NSRange r;
+      r = [_login rangeOfString: @"@"];
+      if (r.location != NSNotFound)
+      {
+        loginDomain = [_login substringFromIndex: r.location+1];
+      }
+  }
+
+  if([sd doesLoginTypeByDomain])
+    authenticationType = [sd getLoginTypeForDomain: loginDomain];
+  else
+    authenticationType = [sd authenticationType];
 
-  authenticationType = [sd authenticationType];
   if ([authenticationType isEqualToString: @"cas"])
     {
-      session = [SOGoCASSession CASSessionWithIdentifier: _pwd fromProxy: NO];
-      if (session)
-        rc = [[session login] isEqualToString: _login];
+      casSession = [SOGoCASSession CASSessionWithIdentifier: _pwd fromProxy: NO];
+      if (casSession)
+        rc = [[casSession login] isEqualToString: _login];
       else
         rc = NO;
     }
+  else if ([authenticationType isEqualToString: @"openid"])
+  {
+    openIdSession = [SOGoOpenIdSession OpenIdSessionWithToken: _pwd domain: loginDomain];
+    if (openIdSession)
+      rc = [[openIdSession login: _login] isEqualToString: _login];
+    else
+      rc = NO;
+  }
 #if defined(SAML2_CONFIG)
   else if ([authenticationType isEqualToString: @"saml2"])
     {
@@ -170,7 +202,6 @@
                                                    grace: _grace
                                           additionalInfo: _additionalInfo
                                                 useCache: _useCache];
-  
   //[self logWithFormat: @"Checked login with ppolicy enabled: %d %d %d", *_perr, *_expire, *_grace];
   
   // It's important to return the real value here. The callee will handle
@@ -249,7 +280,8 @@
                      login: &login
                     domain: &domain
                   password: &pwd];
-  
+
+
   if (![self checkLogin: login
                password: pwd
                  domain: &domain
@@ -272,32 +304,42 @@
 {
   NSString *authType, *password;
   SOGoSystemDefaults *sd;
+  SOGoUser *user;
+  NSRange r;
+  NSString *loginDomain, *login;
  
   password = [self passwordInContext: context];
   if ([password length])
     {
+      user = [self userInContext: context];
+      login = [user loginInDomain];
+      r = [login rangeOfString: @"@"];
+      if (r.location != NSNotFound)
+        loginDomain = [login substringFromIndex: r.location+1];
+      else
+        loginDomain = nil;
+
       sd = [SOGoSystemDefaults sharedSystemDefaults];
-      authType = [sd authenticationType];
+      if([sd doesLoginTypeByDomain])
+        authType = [sd getLoginTypeForDomain: loginDomain];
+      else
+        authType = [sd authenticationType];
+
       if ([authType isEqualToString: @"cas"])
         {
           SOGoCASSession *session;
-          SOGoUser *user;
           NSString *service, *scheme;
 
           session = [SOGoCASSession CASSessionWithIdentifier: password
                                                    fromProxy: NO];
-
-          user = [self userInContext: context];
           // Try configured CAS service name first
           service = [[user domainDefaults] imapCASServiceName];
           if (!service)
             {
               // We must NOT assume the scheme exists
               scheme = [server scheme];
-
               if (!scheme)
                 scheme = @"imap";
-
               service = [NSString stringWithFormat: @"%@://%@",
                          scheme, [server host]];
             }
@@ -306,10 +348,18 @@
             [session invalidateTicketForService: service];
 
           password = [session ticketForService: service];
-
           if ([password length] || renew)
             [session updateCache];
         }
+      else if ([authType isEqualToString: @"openid"])
+      {
+        SOGoOpenIdSession* session;
+
+        //If the token has been refresh during the request, we need to use the new access_token
+        //as the one from the cookie is no more valid
+        session = [SOGoOpenIdSession OpenIdSessionWithToken: password domain: loginDomain];
+        password = [session getCurrentToken];
+      }
 #if defined(SAML2_CONFIG)
       else if ([authType isEqualToString: @"saml2"])
         {
@@ -332,6 +382,16 @@
   return password;
 }
 
+- (NSString *) smtpPasswordInContext: (WOContext *) context
+                              forURL: (NSURL *) server
+{
+  NSString *password;
+
+  password = [self imapPasswordInContext: context forURL: server forceRenew:NO];
+
+  return password;
+}
+
 /* create SOGoUser */
 
 - (SOGoUser *) userWithLogin: (NSString *) login
@@ -436,4 +496,57 @@
   return authCookie;
 }
 
+- (NSArray *) getCookiesIfNeeded: (WOContext *)_ctx
+{
+  NSArray *listCookies = nil;
+  SOGoSystemDefaults *sd;
+  NSString *authType, *username, *login, *loginDomain;
+  NSRange r;
+  SOGoUser *user;
+
+  user = [self userInContext: _ctx];
+  login = [user loginDomain];
+  r = [login rangeOfString: @"@"];
+  if (r.location != NSNotFound)
+    loginDomain = [login substringFromIndex: r.location+1];
+  else
+    loginDomain = nil;
+
+  sd = [SOGoSystemDefaults sharedSystemDefaults];
+  if(loginDomain && [sd doesLoginTypeByDomain])
+    authType = [sd getLoginTypeForDomain: loginDomain];
+  else
+    authType = [sd authenticationType];
+  if([authType isEqualToString:@"openid"] && [sd openIdEnableRefreshToken])
+  {
+    NSString *currentPassword, *newPassword;
+    SOGoOpenIdSession *openIdSession;
+    WOCookie* newCookie;
+
+
+    currentPassword = [self passwordInContext: _ctx];
+    newPassword = [self imapPasswordInContext: _ctx forURL: nil forceRenew: NO];
+    if(currentPassword && newPassword && ![newPassword isEqualToString: currentPassword])
+    {
+
+      openIdSession = [SOGoOpenIdSession OpenIdSessionWithToken: newPassword domain: loginDomain];
+      if (openIdSession)
+        username = [openIdSession login: @""]; //Force to refresh the name
+      else
+        username = [[self userInContext: _ctx] login];
+      newCookie = [self cookieWithUsername: username
+                               andPassword: newPassword
+                                 inContext: _ctx];
+      listCookies = [[NSArray alloc] initWithObjects: newCookie, nil];
+      [listCookies autorelease];
+    }
+    if(listCookies && [listCookies isKindOfClass:[NSArray class]] && [listCookies count] > 0)
+      return listCookies;
+    else
+      return nil;
+  }
+  else
+    return nil;
+}
+
 @end /* SOGoWebAuthenticator */

Tools/GNUmakefile

@@ -21,6 +21,7 @@ $(SOGO_TOOL)_OBJC_FILES += \
 	SOGoToolRemoveDoubles.m \
 	SOGoToolRenameUser.m \
 	SOGoToolCheckupUser.m \
+	SOGoToolCleanOpenIdSessions.m \
 	SOGoToolCleanupUser.m \
 	SOGoToolRestore.m \
 	SOGoToolCreateFolder.m \

Tools/SOGoToolCleanOpenIdSessions.m

@@ -0,0 +1,137 @@
+/* SOGoToolCleanOpenIdSessions.m - this file is part of SOGo
+ *
+ * Copyright (C) 2012-2021 Inverse inc.
+ *
+ * This file is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This file is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING.  If not, write to
+ * the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#import <Foundation/NSArray.h>
+#import <Foundation/NSCalendarDate.h>
+#import <Foundation/NSDictionary.h>
+#import <Foundation/NSException.h>
+#import <Foundation/NSUserDefaults.h>
+
+#import <GDLAccess/EOAdaptorChannel.h>
+
+#import <GDLContentStore/GCSChannelManager.h>
+#import <GDLContentStore/NSURL+GCS.h>
+
+#import <NGExtensions/NSNull+misc.h>
+
+#import <SOGo/NSString+Utilities.h>
+#import <SOGo/SOGoSession.h>
+#import <SOGo/SOGoOpenIdSession.h>
+
+#import "SOGoTool.h"
+
+@interface SOGoToolCleanOpenIdSessions : SOGoTool
+@end
+
+@implementation SOGoToolCleanOpenIdSessions
+
++ (NSString *) command
+{
+  return @"clean-openid-sessions";
+}
+
++ (NSString *) description
+{
+  return @"clean user openid sessions that are expired";
+}
+
+- (void) usage
+{
+  fprintf (stderr, "clean-openid-sessions\n\n"
+	   "\n"
+     "The clean-openid-sessions action should be configured as a cronjob.\n");
+}
+
+- (BOOL) cleanExpiredOpenIdSession
+{
+  BOOL rc;
+  EOAdaptorChannel *channel;
+  GCSChannelManager *cm;
+  NSArray *attrs;
+  NSDictionary *qresult;
+  NSException *ex;
+  NSString *sql, *sessionsFolderURL, *sessionID;
+  NSURL *tableURL;
+  NSUserDefaults *ud;
+
+  unsigned int now;
+
+  rc = YES;
+  ud = [NSUserDefaults standardUserDefaults];
+  now = [[NSCalendarDate calendarDate] timeIntervalSince1970];
+  sessionID = nil;
+
+  sessionsFolderURL = [ud stringForKey: @"OCSOpenIdURL"];
+  if (!sessionsFolderURL)
+  {
+    if (verbose)
+      NSLog(@"Couldn't read OCSOpenIdURL");
+    return rc = NO;
+  }
+
+  tableURL = [[NSURL alloc] initWithString: sessionsFolderURL];
+  cm = [GCSChannelManager defaultChannelManager];
+  channel = [cm acquireOpenChannelForURL: tableURL];
+  if (!channel)
+  {
+    /* FIXME: nice error msg */
+    NSLog(@"Can't acquire channel");
+    return rc = NO;
+  }
+
+  sql = [NSString stringWithFormat: @"SELECT c_user_session FROM %@ WHERE c_access_token_expires_in <= %d AND c_refresh_token_expires_in <= %d",
+                  [tableURL gcsTableName], now, now];
+  ex = [channel evaluateExpressionX: sql]; 
+  if (ex)
+  {
+    NSLog(@"%@", [ex reason]);
+    [ex raise];
+    return rc = NO;
+  }
+
+  attrs = [channel describeResults: NO];
+  while ((qresult = [channel fetchAttributes: attrs withZone: NULL]))
+    {
+      sessionID = [qresult objectForKey: @"c_user_session"];
+      if (sessionID)
+        {
+          if (verbose)
+            NSLog(@"Removing session %@", sessionID);
+          [SOGoOpenIdSession deleteValueForSessionKey: sessionID];
+        }
+    }
+  [cm releaseChannel: channel  immediately: YES];
+
+  if (verbose && sessionID == nil)
+    NSLog(@"No session to remove on openId table");
+
+  return rc;
+}
+
+- (BOOL) run
+{
+  BOOL rc;
+
+  rc = [self cleanExpiredOpenIdSession];
+
+  return rc;
+}
+
+@end

Tools/SOGoToolExpireUserSessions.m

@@ -33,6 +33,7 @@
 
 #import <SOGo/NSString+Utilities.h>
 #import <SOGo/SOGoSession.h>
+#import <SOGo/SOGoOpenIdSession.h>
 
 #import "SOGoTool.h"
 

UI/Common/UIxPageFrame.m

@@ -488,13 +488,14 @@
 	  && [user isSuperUser]);
 }
 
-- (BOOL) usesCASAuthentication
+
+- (BOOL) usesOpenIdAuthentication
 {
   SOGoSystemDefaults *sd;
 
   sd = [SOGoSystemDefaults sharedSystemDefaults];
 
-  return [[sd authenticationType] isEqualToString: @"cas"];
+  return [[sd authenticationType] isEqualToString: @"openid"];
 }
 
 - (BOOL) usesSAML2Authenticationx
@@ -537,19 +538,34 @@
   BOOL canLogoff;
   id auth;
   SOGoSystemDefaults *sd;
-  NSString *authType;
+  NSString *authType, *login, *loginDomain;
+  NSRange r;
 
   auth = [[self clientObject] authenticatorInContext: context];
   if ([auth respondsToSelector: @selector (cookieNameInContext:)])
     {
+
       sd = [SOGoSystemDefaults sharedSystemDefaults];
-      authType = [sd authenticationType];
-      if ([authType isEqualToString: @"cas"])
-	canLogoff = [sd CASLogoutEnabled];
-      else if ([authType isEqualToString: @"saml2"])
-	canLogoff = [sd SAML2LogoutEnabled];
+
+      login = [[context activeUser] login];
+      r = [login rangeOfString: @"@"];
+      if (r.location != NSNotFound)
+        loginDomain = [login substringFromIndex: r.location+1];
       else
-	canLogoff = [[auth cookieNameInContext: context] length] > 0;
+        loginDomain = nil;
+      if(loginDomain && [sd doesLoginTypeByDomain])
+        authType = [sd getLoginTypeForDomain: loginDomain];
+      else
+        authType = [sd authenticationType];
+
+      if ([authType isEqualToString: @"cas"])
+	      canLogoff = [sd CASLogoutEnabled];
+      else if ([authType isEqualToString: @"saml2"])
+	      canLogoff = [sd SAML2LogoutEnabled];
+      else if ([authType isEqualToString: @"openid"])
+	      canLogoff = [sd openIdLogoutEnabled: loginDomain];
+      else
+	      canLogoff = [[auth cookieNameInContext: context] length] > 0;
     }
   else
     canLogoff = NO;

UI/MainUI/SOGoRootPage.m

@@ -40,6 +40,7 @@
 #import <SOGo/SOGoBuild.h>
 #import <SOGo/SOGoCache.h>
 #import <SOGo/SOGoCASSession.h>
+#import <SOGo/SOGoOpenIdSession.h>
 #if defined(SAML2_CONFIG)
 #import <SOGo/SOGoSAML2Session.h>
 #endif /* SAML2_ENABLE */
@@ -145,6 +146,7 @@ static const NSString *kJwtKey = @"jwt";
 
 - (WOCookie *) _authLocationCookie: (BOOL) cookieReset
                           withName: (NSString *) cookieName
+                          withValue: (NSString *) _value
 {
   WOCookie *locationCookie;
   NSString *appName;
@@ -152,7 +154,10 @@ static const NSString *kJwtKey = @"jwt";
   NSCalendarDate *date;
 
   rq = [context request];
-  locationCookie = [WOCookie cookieWithName: cookieName value: [rq uri]];
+  if(_value)
+    locationCookie = [WOCookie cookieWithName: cookieName value: _value];
+  else
+    locationCookie = [WOCookie cookieWithName: cookieName value: [rq uri]];
   appName = [rq applicationName];
   [locationCookie setPath: [NSString stringWithFormat: @"/%@/", appName]];
   if (cookieReset)
@@ -165,6 +170,28 @@ static const NSString *kJwtKey = @"jwt";
   return locationCookie;
 }
 
+- (WOCookie *) _domainCookie: (BOOL) cookieReset
+                    withDomain: (NSString *) _domain
+{
+  WOCookie *domainCookie;
+  NSString *appName;
+  WORequest *rq;
+  NSCalendarDate *date;
+
+  rq = [context request];
+  domainCookie = [WOCookie cookieWithName: @"sogo-user-domain" value: _domain];
+  appName = [rq applicationName];
+  [domainCookie setPath: [NSString stringWithFormat: @"/%@/", appName]];
+  if (cookieReset)
+    {
+      date = [NSCalendarDate calendarDate];
+      [date setTimeZone: [NSTimeZone timeZoneForSecondsFromGMT: 0]];
+      [domainCookie setExpires: [date yesterday]];
+    }
+
+  return domainCookie;
+}
+
 //
 //
 //
@@ -425,6 +452,7 @@ static const NSString *kJwtKey = @"jwt";
   return response;
 }
 
+
 - (NSDictionary *) _casRedirectKeys
 {
   NSDictionary *redirectKeys;
@@ -478,42 +506,43 @@ static const NSString *kJwtKey = @"jwt";
   if ([login isEqualToString: @"anonymous"])
     login = nil;
   if (!login)
+  {
+    rq = [context request];
+    ticket = [rq formValueForKey: @"ticket"];
+    if ([ticket length])
     {
-      rq = [context request];
-      ticket = [rq formValueForKey: @"ticket"];
-      if ([ticket length])
-        {
-          casSession = [SOGoCASSession CASSessionWithTicket: ticket
-                                                  fromProxy: NO];
-          login = [casSession login];
-          if ([login length])
-            {
-              auth = [[WOApplication application]
-                       authenticatorInContext: context];
-              casCookie = [auth cookieWithUsername: login
-                                       andPassword: [casSession identifier]
-                                         inContext: context];
-              [casSession updateCache];
-              newLocation = [rq cookieValueForKey: @"cas-location"];
-              /* login callback, we expire the "cas-location" cookie, created
-                 below */
-              casLocationCookie = [self _authLocationCookie: YES
-                                                   withName: @"cas-location"];
-            }
-        }
-      else
-        {
-          /* anonymous and no ticket, possibly a logout request from CAS
-           * See: https://wiki.jasig.org/display/CASUM/Single+Sign+Out
-           */
-          logoutRequest = [rq formValueForKey: @"logoutRequest"];
-          if ([logoutRequest length])
-            {
-              [SOGoCASSession handleLogoutRequest: logoutRequest];
-              return [self responseWithStatus: 200];
-            }
-        }
+      casSession = [SOGoCASSession CASSessionWithTicket: ticket
+                                              fromProxy: NO];
+      login = [casSession login];
+      if ([login length])
+      {
+        auth = [[WOApplication application]
+                  authenticatorInContext: context];
+        casCookie = [auth cookieWithUsername: login
+                                  andPassword: [casSession identifier]
+                                    inContext: context];
+        [casSession updateCache];
+        newLocation = [rq cookieValueForKey: @"cas-location"];
+        /* login callback, we expire the "cas-location" cookie, created
+            below */
+        casLocationCookie = [self _authLocationCookie: YES
+                                              withName: @"cas-location"
+                                              withValue: nil];
+      }
     }
+    else
+      {
+        /* anonymous and no ticket, possibly a logout request from CAS
+          * See: https://wiki.jasig.org/display/CASUM/Single+Sign+Out
+          */
+        logoutRequest = [rq formValueForKey: @"logoutRequest"];
+        if ([logoutRequest length])
+          {
+            [SOGoCASSession handleLogoutRequest: logoutRequest];
+            return [self responseWithStatus: 200];
+          }
+      }
+  }
   else
     ticket = nil;
 
@@ -537,7 +566,8 @@ static const NSString *kJwtKey = @"jwt";
       newLocation = [SOGoCASSession CASURLWithAction: @"login"
                                        andParameters: [self _casRedirectKeys]];
       casLocationCookie = [self _authLocationCookie: NO
-                                           withName: @"cas-location"];
+                                           withName: @"cas-location"
+                                           withValue: nil];
     }
   response = [self redirectToLocation: newLocation];
   if (casCookie)
@@ -548,6 +578,131 @@ static const NSString *kJwtKey = @"jwt";
   return response;
 }
 
+- (id <WOActionResults>) _openidDefaultAction: (NSString *) _domain
+{
+  WOResponse *response;
+  NSString *login, *redirectLocation, *serverUrl;
+  NSString *sessionState, *code, *refreshTokenValue;
+  NSURL *newLocation, *oldLocation;
+  NSDictionary *formValues;
+  SOGoUser *loggedInUser;
+  WOCookie *openIdCookie, *openIdCookieLocation, *openIdRefreshCookie, *domainCookie;
+  WORequest *rq;
+  SOGoWebAuthenticator *auth;
+  SOGoOpenIdSession *openIdSession;
+  id value;
+
+  openIdCookie = nil;
+  openIdCookieLocation = nil;
+  openIdRefreshCookie = nil;
+  domainCookie = nil;
+  newLocation = nil;
+
+  rq = [context request];
+
+  //Check if the domain is stored in a cookie if not given
+  if(_domain == nil || [_domain length] == 0)
+    _domain = [rq cookieValueForKey: @"sogo-user-domain"]; //_domain can still be nil aftert his
+
+  openIdSession = [SOGoOpenIdSession OpenIdSession: _domain];
+
+  if(![openIdSession sessionIsOk])
+  {
+    return [NSException exceptionWithHTTPStatus: 502 /* Bad OpenId Configuration */
+                                       reason: [NSString stringWithFormat: @"OpenId server not found or has unexpected behavior, contact your admin."]];
+  }
+
+  login = [[context activeUser] login];
+  if ([login isEqualToString: @"anonymous"])
+    login = nil;
+  if (!login)
+  {
+    //You get here if you nerver been logged in or if you token is expired
+    serverUrl = [[context serverURL] absoluteString];
+    redirectLocation = [NSString stringWithFormat: @"%@/%@/", serverUrl, [rq applicationName]];
+    if((formValues = [rq formValues]) && [formValues objectForKey: @"code"])
+    {
+      //You get here if this is the callback of openid after you logged in
+
+      //NOT MANDATORY
+      // value = [formValues objectForKey: @"session_state"];
+      // if ([value isKindOfClass: [NSArray class]])
+      //   sessionState = [value lastObject];
+      // else
+      //   sessionState = value;
+
+      value = [formValues objectForKey: @"code"];
+      if ([value isKindOfClass: [NSArray class]])
+        code = [value lastObject];
+      else
+        code = value;
+      [openIdSession fetchToken: code redirect: redirectLocation];
+      login = [openIdSession login: @""];
+      if ([login length])
+      {
+        auth = [[WOApplication application] authenticatorInContext: context];
+        openIdCookie = [auth cookieWithUsername: login
+                                  andPassword: [openIdSession getToken]
+                                    inContext: context];
+      }
+      newLocation = [rq cookieValueForKey: @"openid-location"];
+      openIdCookieLocation = [self _authLocationCookie: YES withName: @"openid-location" withValue: nil];
+      domainCookie = [self _domainCookie: YES withDomain: _domain];
+    }
+    // else if((formValues = [rq formValues]) && [formValues objectForKey: @"action"])
+    // {
+    //   value = [formValues objectForKey: @"action"];
+    //   if ([value isKindOfClass: [NSArray class]])
+    //     code = [value lastObject];
+    //   else
+    //     code = value;
+    //   if([code isEqualToString:@"redirect"])
+    //   {
+    //     //this action onlye serve to make a redirection to openId server after a GET request
+    //     newLocation = [openIdSession loginUrl: redirectLocation];
+    //   }
+    //}
+    else
+    {
+      // //You get here the first time you access sogo, it redirect to last location
+      // if([[rq method] isEqualToString: @"POST"])
+      //   //To avoid making a redirection to openid server after a post request, we first redirect to a get method
+      //   newLocation = [NSString stringWithFormat: @"%@?action=redirect", redirectLocation];
+      // else
+      if(_domain != nil && [_domain length] > 0)
+      {
+        //add the domain cookie to get it after the redirect
+        domainCookie = [self _domainCookie: NO withDomain: _domain];
+      }
+      newLocation = [openIdSession loginUrl: redirectLocation];
+      openIdCookieLocation = [self _authLocationCookie: NO withName: @"openid-location" withValue: nil];
+    }
+  }
+  else
+  {
+    if (!newLocation)
+    {
+      oldLocation = [[self clientObject] baseURLInContext: context];
+      newLocation = [NSString stringWithFormat: @"%@%@", oldLocation, [login stringByEscapingURL]];
+    }
+
+    loggedInUser = [SOGoUser userWithLogin: login];
+    [self _checkAutoReloadWebCalendars: loggedInUser];
+  }
+
+  response = [self redirectToLocation: newLocation];
+  if (openIdCookie)
+    [response addCookie: openIdCookie];
+  if (openIdCookieLocation)
+    [response addCookie: openIdCookieLocation];
+  if(domainCookie)
+    [response addCookie: domainCookie];
+  //[response setStatus: 303];
+  return response;
+}
+
+
+
 #if defined(SAML2_CONFIG)
 - (id <WOActionResults>) _saml2DefaultAction
 {
@@ -571,7 +726,8 @@ static const NSString *kJwtKey = @"jwt";
       newLocation = [rq cookieValueForKey: @"saml2-location"];
       if (newLocation)
         saml2LocationCookie = [self _authLocationCookie: YES
-                                               withName: @"saml2-location"];
+                                               withName: @"saml2-location"
+                                               withValue: nil];
       else
         {
           oldLocation = [[self clientObject] baseURLInContext: context];
@@ -586,7 +742,8 @@ static const NSString *kJwtKey = @"jwt";
     {
       newLocation = [SOGoSAML2Session authenticationURLInContext: context];
       saml2LocationCookie = [self _authLocationCookie: NO
-                                             withName: @"saml2-location"];
+                                             withName: @"saml2-location"
+                                             withValue: nil];
     }
 
   response = [self redirectToLocation: newLocation];
@@ -607,43 +764,191 @@ static const NSString *kJwtKey = @"jwt";
     login = nil;
 
   if (login)
-    {
-      oldLocation = [[self clientObject] baseURLInContext: context];
-      response
-	= [self redirectToLocation: [NSString stringWithFormat: @"%@%@",
-					      oldLocation,
-                                              [[SOGoUser getEncryptedUsernameIfNeeded:login request: [context request]] stringByEscapingURL]]];
-    }
+  {
+    oldLocation = [[self clientObject] baseURLInContext: context];
+    response = [self redirectToLocation: [NSString stringWithFormat: @"%@%@",  oldLocation,
+                  [[SOGoUser getEncryptedUsernameIfNeeded:login request: [context request]] stringByEscapingURL]]];
+  }
   else
-    {
-      oldLocation = [[context request] uri];
-      if ([context clientObject]
-          && ![oldLocation hasSuffix: @"/"]
-          && ![oldLocation hasSuffix: @"/view"])
-        response = [self redirectToLocation:
-                           [NSString stringWithFormat: @"%@/", oldLocation]];
-      else
-        response = self;
-    }
+  {
+    oldLocation = [[context request] uri];
+    if ([context clientObject] && ![oldLocation hasSuffix: @"/"] && ![oldLocation hasSuffix: @"/view"])
+      response = [self redirectToLocation: [NSString stringWithFormat: @"%@/", oldLocation]];
+    else
+      response = self;
+  }
 
   return response;
 }
 
+- (WOResponse *) connectNameAction
+{
+  WOResponse *response;
+  WORequest *request;
+  NSDictionary *params;
+  NSString *username, *language, *domain, *type, *serverUrl, *redirectLocation;
+  NSRange r;
+
+  request = [context request];
+  params = [[request contentAsString] objectFromJSONString];
+
+  username = [params objectForKey: @"userName"];
+
+  //Extract the domain
+  r = [username rangeOfString: @"@"];
+  if (r.location != NSNotFound)
+  {
+    domain = [username substringFromIndex: r.location+1];
+    type = [[SOGoSystemDefaults sharedSystemDefaults] getLoginTypeForDomain: domain];
+    if(type != nil)
+    {
+      if([type isEqualToString: @"plain"])
+      {
+        //Only reload the page with the name
+        serverUrl = [[context serverURL] absoluteString];
+        redirectLocation = [NSString stringWithFormat: @"%@/%@/login?hint=%@", serverUrl, [request applicationName], username];
+        //response = [self redirectToLocation: [NSString stringWithFormat: @"%@/", redirectLocation]];
+        response = [self responseWithStatus: 200 andJSONRepresentation:
+          [NSDictionary dictionaryWithObjectsAndKeys: redirectLocation, @"redirect", nil]];
+      }
+      else if([type isEqualToString: @"openid"])
+      {
+        SOGoOpenIdSession *openIdSession;
+        WOCookie *domainCookie, *openIdCookieLocation;
+
+        //With openId, the user will be redirected to the openid server for login
+        //With set the domain in a cookie to know it after the openid does the callbacl
+        serverUrl = [[context serverURL] absoluteString];
+        redirectLocation = [NSString stringWithFormat: @"%@/%@/", serverUrl, [request applicationName]];
+
+        openIdSession = [SOGoOpenIdSession OpenIdSession: domain];
+
+        domainCookie = [self _domainCookie: NO withDomain: domain];
+        openIdCookieLocation = [self _authLocationCookie: NO withName: @"openid-location" withValue: redirectLocation];
+
+        response = [self responseWithStatus: 200 andJSONRepresentation:
+          [NSDictionary dictionaryWithObjectsAndKeys: [openIdSession loginUrl: redirectLocation], @"redirect", nil]];
+        [response addCookie: domainCookie];
+        [response addCookie: openIdCookieLocation];
+      }
+      else if([type isEqualToString: @"cas"] || [type isEqualToString: @"saml2"])
+      {
+        [self logWithFormat: @"Unsupported type for now: %@", type];
+        response = [self responseWithStatus: 400
+                              andString: @"Domain Authentication type not supported"];
+      }
+      else
+      {
+        [self logWithFormat: @"Unknown type: %@", type];
+        response = [self responseWithStatus: 400
+                              andString: @"Unknwon Authentication type"];
+      }
+    }
+    else
+    {
+      [self logWithFormat: @"Auth type for Domain given is not set or there is no default value: %@", domain];
+      response = [self responseWithStatus: 400
+                              andString: @"Domain unknown"];
+    }
+
+  }
+  else
+  {
+    [self logWithFormat: @"Domain is required but not found for user recovery exception for user %@", username];
+    response = [self responseWithStatus: 400
+                              andString: @"Domain needed in the login"];
+  }
+
+  return response;
+}
+
+
 - (id <WOActionResults>) defaultAction
 {
-  NSString *authenticationType;
+  NSString *authenticationType, *loginDomain, *type, *_domain;
+  SOGoSystemDefaults* sd;
   id <WOActionResults> result;
 
-  authenticationType = [[SOGoSystemDefaults sharedSystemDefaults]
-                         authenticationType];
-  if ([authenticationType isEqualToString: @"cas"])
-    result = [self _casDefaultAction];
-#if defined(SAML2_CONFIG)
-  else if ([authenticationType isEqualToString: @"saml2"])
-    result = [self _saml2DefaultAction];
-#endif /* SAML2_CONFIG */
-  else
-    result = [self _standardDefaultAction];
+  loginDomain = nil;
+  sd = [SOGoSystemDefaults sharedSystemDefaults];
+  if([sd doesLoginTypeByDomain])
+  {
+    NSString *login;
+    //In this mode sogo will ask the mail of the user before doing any authentication
+    //Check if a user is already logged in
+
+    _domain = [[context request] cookieValueForKey: @"sogo-user-domain"]; //_domain can still be nil aftert his
+    if(_domain != nil)
+    {
+      //This is a callback of an openid session.
+      return [self _openidDefaultAction: _domain];
+    }
+
+    login = [[context activeUser] login];
+    if ([login isEqualToString: @"anonymous"])
+      login = nil;
+    if(!login && !_domain)
+      return [self _standardDefaultAction];
+    else
+    {
+      //User already logged in. Extract the domain in that case
+      NSRange r;
+      r = [login rangeOfString: @"@"];
+      if (r.location != NSNotFound)
+      {
+        loginDomain = [login substringFromIndex: r.location+1];
+        type = [sd getLoginTypeForDomain: loginDomain];
+        if(type)
+        {
+          if([type isEqualToString: @"plain"])
+          {
+            result = [self _standardDefaultAction];
+          }
+          else if([type isEqualToString: @"openid"])
+          {
+            result = [self _openidDefaultAction: loginDomain];
+          }
+          else if([type isEqualToString: @"cas"] || [type isEqualToString: @"saml2"])
+          {
+            [self logWithFormat: @"Unsupported type for now: %@", type];
+            result = [self responseWithStatus: 400
+                                  andString: @"Domain Authentication type not supported"];
+          }
+          else
+          {
+            [self logWithFormat: @"Unknown type: %@", type];
+            result = [self responseWithStatus: 400
+                                  andString: @"Unknwon Authentication type"];
+          }
+        }
+        else
+        {
+          [self logWithFormat: @"Auth type for Domain given is not set or there is no default value: %@", loginDomain];
+          result = [self responseWithStatus: 400
+                                  andString: @"Domain unknown"];
+        }
+      }
+      else
+      {
+        loginDomain = nil;
+        result = [self _standardDefaultAction];
+      }
+    }
+  }
+  else {
+    authenticationType = [sd authenticationType];
+
+    if ([authenticationType isEqualToString: @"cas"])
+      result = [self _casDefaultAction];
+    else if ([authenticationType isEqualToString: @"openid"])
+      result = [self _openidDefaultAction: loginDomain];
+    #if defined(SAML2_CONFIG)
+    else if ([authenticationType isEqualToString: @"saml2"])
+      result = [self _saml2DefaultAction];
+    #endif /* SAML2_CONFIG */
+    else
+      result = [self _standardDefaultAction];
+  }
 
   return result;
 }
@@ -673,6 +978,57 @@ static const NSString *kJwtKey = @"jwt";
   return ([[self loginDomains] count] > 0);
 }
 
+- (BOOL) doLoginUsernameFirst
+{
+  return [[SOGoSystemDefaults sharedSystemDefaults] doesLoginTypeByDomain];
+}
+
+- (BOOL) doFullLogin
+{
+  //Either we directly do the full login (meaning the user inputs its username and password)
+  //Or we do it in two times:
+  //phase 1: user types its username first -> only show the username input
+  //phase 2: user types its password -> show all inputs
+  //In phase 2, the username will be in the query at key "login"
+  if([self doLoginUsernameFirst]){
+    WORequest *rq;
+    BOOL hasLogin;
+    NSDictionary *formValues;
+
+    rq = [context request];
+    hasLogin = ((formValues=[rq formValues]) && [formValues objectForKey: @"hint"]);
+    return hasLogin;
+  }
+
+  return YES;
+}
+
+- (BOOL) doPartialLogin
+{
+  return ![self doFullLogin];
+}
+
+
+- (NSString *) getLoginHint
+{
+  id value;
+  WORequest *rq;
+  NSString* login;
+  NSDictionary *formValues;
+
+  login = @"";
+
+  rq = [context request];
+  if((formValues=[rq formValues]) && (value=[formValues objectForKey: @"hint"]))
+  {
+    if ([value isKindOfClass: [NSArray class]])
+      login = [value lastObject];
+    else
+      login = value;
+  }
+  return login;
+}
+
 - (BOOL) hasPasswordRecovery
 {
   return [[SOGoSystemDefaults sharedSystemDefaults] isPasswordRecoveryEnabled];
@@ -1036,8 +1392,7 @@ static const NSString *kJwtKey = @"jwt";
   message = [[request contentAsString] objectFromJSONString];
   username = [message objectForKey: @"userName"];
   domain = [message objectForKey: @"domain"];
-  if ([[SOGoSystemDefaults sharedSystemDefaults]
-                             isPasswordRecoveryEnabled]) {
+  if ([[SOGoSystemDefaults sharedSystemDefaults] isPasswordRecoveryEnabled]) {
       // If no domain, try to retrieve domain from username
       if (nil != domain && domain != [NSNull null]) {
         domainName = domain;

UI/MainUI/SOGoUserHomePage.m

@@ -32,6 +32,7 @@
 
 #import <SOGo/SOGoCache.h>
 #import <SOGo/SOGoCASSession.h>
+#import <SOGo/SOGoOpenIdSession.h>
 #if defined(SAML2_CONFIG)
 #import <SOGo/SOGoSAML2Session.h>
 #endif
@@ -419,18 +420,38 @@
 
 - (NSString *) _logoutRedirectURL
 {
-  NSString *redirectURL;
+  NSString *redirectURL, *login, *loginDomain, *authType;
   SOGoSystemDefaults *sd;
   id container;
+  NSRange r;
+
+
+  login = [[context activeUser] login];
+  r = [login rangeOfString: @"@"];
+  if (r.location != NSNotFound)
+    loginDomain = [login substringFromIndex: r.location+1];
+  else
+    loginDomain = nil;
 
   sd = [SOGoSystemDefaults sharedSystemDefaults];
-  if ([[sd authenticationType] isEqualToString: @"cas"])
-    {
-      redirectURL = [SOGoCASSession CASURLWithAction: @"logout"
-                                       andParameters: nil];
-    }
+  if(loginDomain && [sd doesLoginTypeByDomain])
+    authType = [sd getLoginTypeForDomain: loginDomain];
+  else
+    authType = [sd authenticationType];
+
+  if ([authType isEqualToString: @"cas"])
+  {
+    redirectURL = [SOGoCASSession CASURLWithAction: @"logout"
+                                      andParameters: nil];
+  }
+  else if ([authType isEqualToString: @"openid"])
+  {
+    SOGoOpenIdSession* session;
+    session = [SOGoOpenIdSession OpenIdSession: loginDomain];
+    redirectURL = [session logoutUrl];
+  }
 #if defined(SAML2_CONFIG)
-  else if ([[sd authenticationType] isEqualToString: @"saml2"])
+  else if ([authType isEqualToString: @"saml2"])
     {
       NSString *username, *password, *domain, *value;
       SOGoSAML2Session *saml2Session;

UI/MainUI/product.plist

@@ -168,6 +168,16 @@
           pageName = "SOGoRootPage";
           actionName = "connect";
         };
+        connectName = {
+          protectedBy = "<public>";
+          pageName = "SOGoRootPage";
+          actionName = "connectName";
+        };
+        openid_redirect = {
+          protectedBy = "<public>";
+          pageName = "SOGoRootPage";
+          actionName = "openIdRedirect";
+        };
         changePassword = {
           protectedBy = "<public>";
           pageName = "SOGoRootPage";

UI/Templates/MainUI/SOGoRootPage.wox

@@ -12,6 +12,7 @@
   <script type="text/javascript">
     var cookieUsername = <var:string var:value="cookieUsername.doubleQuotedString" const:escapeHTML="NO"/>;
     var language = '<var:string var:value="language" const:escapeHTML="NO"/>';
+    var loginHint = '<var:string var:value="getLoginHint" const:escapeHTML="NO"/>'
   </script>
 
   <!--
@@ -44,116 +45,121 @@
               </div>
             </var:if>
           </div>
+
+
           <div class="sg-login md-default-theme md-bg md-accent" flex-gt-md="50">
-            <div id="login" class="sg-login-content md-padding">
-              <form name="loginForm" layout="column"
-                    ng-cloak="ng-cloak"
-                    ng-submit="app.login()">
-                <var:if condition="hasLoginSuffix">
-                  <input type="hidden" ng-model="app.creds.loginSuffix" var:value="loginSuffix"/>
-                </var:if>
-                <div ng-if="!app.loginState">
-                  <md-input-container class="md-block">
-                    <label><var:string label:value="Username"/></label>
-                    <md-icon>person</md-icon>
-                    <input autocorrect="off" autocapitalize="off" type="text" ng-model="app.creds.username" ng-required="true" ng-change="app.usernameChanged()" ng-blur="app.retrievePasswordRecoveryEnabled()" />
-                  </md-input-container>
-                  <md-input-container class="md-block">
-                    <label><var:string label:value="Password"/></label>
-                    <md-icon>vpn_key</md-icon>
-                    <input id="passwordField" type="password" ng-model="app.creds.password" ng-required="true"/>
-                    <md-icon id="password-visibility-icon" ng-click="app.changePasswordVisibility()">visibility</md-icon>
-                  </md-input-container>
-                  
+            <var:if condition="doFullLogin">
+              <div id="login" class="sg-login-content md-padding">
+                <form name="loginForm" layout="column"
+                      ng-cloak="ng-cloak"
+                      ng-submit="app.login()">
+                  <var:if condition="hasLoginSuffix">
+                    <input type="hidden" ng-model="app.creds.loginSuffix" var:value="loginSuffix"/>
+                  </var:if>
+                  <div ng-if="!app.loginState">
 
-                  <!-- LANGUAGES SELECT -->
-                  <div layout="row" layout-align="start end">
-                    <md-icon>language</md-icon>
-                    <md-input-container class="md-flex">
-                      <label><var:string label:value="choose"/></label>
-                      <md-select ng-model="app.creds.language"
-                                var:placeholder="localizedLanguage"
-                                ng-change="app.changeLanguage($event)">
-                        <var:foreach list="languages" item="item">
-                          <md-option var:value="item">
-                            <var:string value="languageText"/>
-                          </md-option>
-                        </var:foreach>
-                      </md-select>
+                    <md-input-container class="md-block">
+                      <label><var:string label:value="Username"/></label>
+                      <md-icon>person</md-icon>
+                      <input autocorrect="off" autocapitalize="off" type="text" ng-model="app.creds.username" ng-required="true" ng-change="app.usernameChanged()" ng-blur="app.retrievePasswordRecoveryEnabled()" />
                     </md-input-container>
-                  </div>
 
-                  <!-- DOMAINS SELECT -->
-                  <var:if condition="hasLoginDomains">
+                    <md-input-container class="md-block">
+                      <label><var:string label:value="Password"/></label>
+                      <md-icon>vpn_key</md-icon>
+                      <input id="passwordField" type="password" ng-model="app.creds.password" ng-required="true"/>
+                      <md-icon id="password-visibility-icon" ng-click="app.changePasswordVisibility()">visibility</md-icon>
+                    </md-input-container>
+                    
+
+                    <!-- LANGUAGES SELECT -->
                     <div layout="row" layout-align="start end">
-                      <md-icon>domain</md-icon>
-                            <md-input-container class="md-flex">
-                              <md-select class="md-flex" ng-model="app.creds.domain" label:placeholder="choose" ng-change="app.retrievePasswordRecoveryEnabled()">
-                                <var:foreach list="loginDomains" item="item">
-                                  <md-option var:value="item">
-                                    <var:string value="item"/>
-                                  </md-option>
-                                </var:foreach>
-                              </md-select>
-                            </md-input-container>
-                          </div>
-                  </var:if>
-                  
-                  <div layout="row" layout-align="center center">
-                    <md-switch class="md-accent md-hue-2"
-                              ng-model="app.creds.rememberLogin"
-                              label:arial-label="Remember username">
-                      <var:string label:value="Remember username"/>
-                    </md-switch>
-                  </div>
-                  <var:if condition="hasUrlCreateAccount">
-                    <div layout="row" layout-align="center center">
-                      <a var:href="urlCreateAccount" target="_blank" class="create-account-link"><var:string label:value="Create an account"/></a>
+                      <md-icon>language</md-icon>
+                      <md-input-container class="md-flex">
+                        <label><var:string label:value="choose"/></label>
+                        <md-select ng-model="app.creds.language"
+                                  var:placeholder="localizedLanguage"
+                                  ng-change="app.changeLanguage($event)">
+                          <var:foreach list="languages" item="item">
+                            <md-option var:value="item">
+                              <var:string value="languageText"/>
+                            </md-option>
+                          </var:foreach>
+                        </md-select>
+                      </md-input-container>
                     </div>
-                  </var:if>
-                </div>
 
-                <!-- Password recovery -->
-                <div layout="row" layout-align="center center" ng-if="app.passwordRecovery.passwordRecoveryEnabled">
-                  <div ng-if="app.showLogin">
-                    <a href="#" ng-click="app.passwordRecoveryInfo()" sg-ripple-click="loginContent" class="password-lost-link"><var:string label:value="Password lost"/></a>
+                    <!-- DOMAINS SELECT -->
+                    <var:if condition="hasLoginDomains">
+                      <div layout="row" layout-align="start end">
+                        <md-icon>domain</md-icon>
+                              <md-input-container class="md-flex">
+                                <md-select class="md-flex" ng-model="app.creds.domain" label:placeholder="choose" ng-change="app.retrievePasswordRecoveryEnabled()">
+                                  <var:foreach list="loginDomains" item="item">
+                                    <md-option var:value="item">
+                                      <var:string value="item"/>
+                                    </md-option>
+                                  </var:foreach>
+                                </md-select>
+                              </md-input-container>
+                            </div>
+                    </var:if>
+                    
+                    <div layout="row" layout-align="center center">
+                      <md-switch class="md-accent md-hue-2"
+                                ng-model="app.creds.rememberLogin"
+                                label:arial-label="Remember username">
+                        <var:string label:value="Remember username"/>
+                      </md-switch>
+                    </div>
+                    <var:if condition="hasUrlCreateAccount">
+                      <div layout="row" layout-align="center center">
+                        <a var:href="urlCreateAccount" target="_blank" class="create-account-link"><var:string label:value="Create an account"/></a>
+                      </div>
+                    </var:if>
                   </div>
-                </div>
 
-                <!-- CONNECT BUTTON -->
-                <div layout="row" layout-align="space-between center" ng-if="!app.loginState">
-                  <md-button class="md-icon-button"
-                            label:aria-label="About"
-                            ng-click="app.showAbout()">
-                    <md-icon>info</md-icon>
-                  </md-button>
-                  <div>
-                    <md-button class="md-fab md-accent md-hue-2" type="submit"
-                              label:aria-label="Connect"
-                              ng-if="!app.loginState"
-                              ng-disabled="loginForm.$invalid"
-                              sg-ripple-click="loginContent">
-                      <md-icon>arrow_forward</md-icon>
+                  <!-- Password recovery -->
+                  <div layout="row" layout-align="center center" ng-if="app.passwordRecovery.passwordRecoveryEnabled">
+                    <div ng-if="app.showLogin">
+                      <a href="#" ng-click="app.passwordRecoveryInfo()" sg-ripple-click="loginContent" class="password-lost-link"><var:string label:value="Password lost"/></a>
+                    </div>
+                  </div>
+
+                  <!-- CONNECT BUTTON -->
+                  <div layout="row" layout-align="space-between center" ng-if="!app.loginState">
+                    <md-button class="md-icon-button"
+                              label:aria-label="About"
+                              ng-click="app.showAbout()">
+                      <md-icon>info</md-icon>
                     </md-button>
+                    <div>
+                      <md-button class="md-fab md-accent md-hue-2" type="submit"
+                                label:aria-label="Connect"
+                                ng-if="!app.loginState"
+                                ng-disabled="loginForm.$invalid"
+                                sg-ripple-click="loginContent">
+                        <md-icon>arrow_forward</md-icon>
+                      </md-button>
+                    </div>
                   </div>
-                </div>
 
-              <sg-ripple class="md-default-theme md-accent md-bg"
-                        ng-class="{ 'md-warn': app.loginState == 'error' }"><!-- ripple background --></sg-ripple>
-              <sg-ripple-content class="md-flex ng-hide"
-                                layout="column" layout-align="center center" layout-fill="layout-fill"
-                                ng-switch="app.loginState">
+                <sg-ripple class="md-default-theme md-accent md-bg"
+                          ng-class="{ 'md-warn': app.loginState == 'error' }"><!-- ripple background --></sg-ripple>
+                <sg-ripple-content class="md-flex ng-hide"
+                                  layout="column" layout-align="center center" layout-fill="layout-fill"
+                                  ng-switch="app.loginState">
 
-                <!-- Authenticating -->
-                <div layout="column" layout-align="center center"
-                    ng-switch-when="authenticating">
-                  <md-progress-circular class="md-hue-1"
-                                        md-mode="indeterminate"
-                                        md-diameter="32"><!-- mailbox loading progress --></md-progress-circular>
-                  <div class="md-default-theme md-accent md-hue-1 md-fg md-padding">
-                    <var:string label:value="Authenticating"/>
+                  <!-- Authenticating -->
+                  <div layout="column" layout-align="center center"
+                      ng-switch-when="authenticating">
+                    <md-progress-circular class="md-hue-1"
+                                          md-mode="indeterminate"
+                                          md-diameter="32"><!-- mailbox loading progress --></md-progress-circular>
+                    <div class="md-default-theme md-accent md-hue-1 md-fg md-padding">
+                      <var:string label:value="Authenticating"/>
+                    </div>
                   </div>
-                </div>
 
                 <var:if condition="isTotpEnabled">
                 <!-- TOTP Code -->
@@ -163,7 +169,7 @@
                     <md-input-container class="md-block">
                       <label><var:string label:value="Verification Code"/></label>
                       <md-icon>lock</md-icon>
-                      <input  type="text" inputmode="numeric" autocomplete="off"
+                      <input type="text" inputmode="numeric" autocomplete="off"
                             ng-pattern="app.verificationCodePattern"
                             ng-model="app.creds.verificationCode"
                             ng-required="app.loginState == 'totpcode'"
@@ -258,126 +264,235 @@
                   </div>
                 </div>
 
-                <!-- Password policy: Grace period -->
-                <div layout="row" layout-align="center center" layout-fill="layout-fill"
-                    ng-switch-when="passwordwillexpire">
-                  <div layout="column" layout-align="center center" flex-xs="flex-xs" flex-gt-xs="50">
-                    <md-icon class="md-accent md-hue-1 sg-icon--large">warning</md-icon>
-                    <div class="md-default-theme md-accent md-hue-1 md-fg md-padding" ng-if="app.cn">
-                      <var:string label:value="Welcome"/> {{app.cn}}
-                    </div>
-                    <div class="md-padding" layout="row" layout-align="start center">
-                      <md-icon>priority_high</md-icon>
-                      <div class="md-padding">{{app.errorMessage}}</div>
-                    </div>
-                    <div layout="row" layout-align="end center">
-                      <md-button
-                          ng-click="app.loginState = 'passwordexpired'"><var:string label:value="Change your Password"/></md-button>
-                      <md-button
-                          ng-click="app.continueLogin()"
-                            sg-ripple-click="loginContent"><var:string label:value="Continue"/></md-button>
-                    </div>
-                  </div>
-                </div>
-
-                <!-- Password recovery -->
-                <var:if condition="hasPasswordRecovery">
-                  <div layout="column" layout-align="center center"
-                      ng-switch-when="passwordrecovery">
-                    <md-icon class="md-accent md-hue-1 sg-icon--large">vpn_key</md-icon>
-                    <div flex="100">
-                      <div layout="row" layout-xs="column" class="md-padding" layout-align="center center">
-                        <div ng-if="app.passwordRecovery.showLoader">
-                          <md-progress-circular class="md-hue-1"
-                                        md-mode="indeterminate"
-                                        md-diameter="32"><!-- password recovery progress --></md-progress-circular>
-                        </div>
-                        <div ng-if="'SecretQuestion' === app.passwordRecovery.passwordRecoveryMode">
-                          <div ng-if="!app.passwordRecovery.showLoader">
-                            {{ app.passwordRecovery.passwordRecoveryQuestion }}
-                            <md-input-container class="md-block">
-                              <label><var:string label:value="Answer"/></label>
-                              <input autocorrect="off" autocapitalize="off" type="text" ng-model="app.passwordRecovery.passwordRecoveryQuestionAnswer" />
-                            </md-input-container>
-                          </div>
-                        </div>
-                        <div ng-if="'SecondaryEmail' === app.passwordRecovery.passwordRecoveryMode">
-                          <div ng-if="!app.passwordRecovery.showLoader">
-                            {{ app.passwordRecovery.passwordRecoverySecondaryEmailText }}
-                          </div>
-                        </div>
+                  <!-- Password policy: Grace period -->
+                  <div layout="row" layout-align="center center" layout-fill="layout-fill"
+                      ng-switch-when="passwordwillexpire">
+                    <div layout="column" layout-align="center center" flex-xs="flex-xs" flex-gt-xs="50">
+                      <md-icon class="md-accent md-hue-1 sg-icon--large">warning</md-icon>
+                      <div class="md-default-theme md-accent md-hue-1 md-fg md-padding" ng-if="app.cn">
+                        <var:string label:value="Welcome"/> {{app.cn}}
                       </div>
-                      <div layout="row" layout-align="end center" ng-if="!app.passwordRecovery.showLoader">
-                        <md-button ng-click="app.passwordRecoveryAbort()" type="button" >
-                          <var:string label:value="Back"/>
-                        </md-button>
-                        <div ng-if="'SecretQuestion' === app.passwordRecovery.passwordRecoveryMode">
-                          <md-button ng-click="app.passwordRecoveryCheck()" type="button" >
-                            <var:string label:value="Next"/>
-                          </md-button>
-                        </div>
-                        <div ng-if="'SecondaryEmail' === app.passwordRecovery.passwordRecoveryMode">
-                          <md-button ng-click="app.passwordRecoveryEmail()" type="button" >
-                            <var:string label:value="Next"/>
-                          </md-button>
-                        </div>
-                      </div>
-                    </div>
-                  </div>
-                  <div layout="column" layout-align="center center"
-                      ng-switch-when="sendrecoverymail">
-                      <md-icon class="md-accent md-hue-1 sg-icon--large">local_shipping</md-icon>
-                    <div flex="100">
-                      <div layout="row" layout-xs="column" class="md-padding">
-                        <div ng-if="'SecondaryEmail' === app.passwordRecovery.passwordRecoveryMode">
-                          <var:string label:value="A password reset link has been sent, please check your recovery e-mail mailbox and click on the link"/>
-                        </div>
+                      <div class="md-padding" layout="row" layout-align="start center">
+                        <md-icon>priority_high</md-icon>
+                        <div class="md-padding">{{app.errorMessage}}</div>
                       </div>
                       <div layout="row" layout-align="end center">
-                        <md-button ng-click="app.passwordRecoveryAbort()" type="button" >
-                          <var:string label:value="Back"/>
-                        </md-button>
+                        <md-button
+                            ng-click="app.loginState = 'passwordexpired'"><var:string label:value="Change your Password"/></md-button>
+                        <md-button
+                            ng-click="app.continueLogin()"
+                              sg-ripple-click="loginContent"><var:string label:value="Continue"/></md-button>
                       </div>
                     </div>
                   </div>
-                </var:if>
 
-                <!-- Logged in -->
-                <div layout="column" layout-align="center center"
-                    ng-switch-when="logged">
-                  <md-icon class="md-accent md-hue-1 sg-icon--large">done</md-icon>
-                  <div class="md-default-theme md-accent md-hue-1 md-fg md-padding">
-                    <var:string label:value="Welcome"/> {{app.cn}}
+                  <!-- Password recovery -->
+                  <var:if condition="hasPasswordRecovery">
+                    <div layout="column" layout-align="center center"
+                        ng-switch-when="passwordrecovery">
+                      <md-icon class="md-accent md-hue-1 sg-icon--large">vpn_key</md-icon>
+                      <div flex="100">
+                        <div layout="row" layout-xs="column" class="md-padding" layout-align="center center">
+                          <div ng-if="app.passwordRecovery.showLoader">
+                            <md-progress-circular class="md-hue-1"
+                                          md-mode="indeterminate"
+                                          md-diameter="32"><!-- password recovery progress --></md-progress-circular>
+                          </div>
+                          <div ng-if="'SecretQuestion' === app.passwordRecovery.passwordRecoveryMode">
+                            <div ng-if="!app.passwordRecovery.showLoader">
+                              {{ app.passwordRecovery.passwordRecoveryQuestion }}
+                              <md-input-container class="md-block">
+                                <label><var:string label:value="Answer"/></label>
+                                <input autocorrect="off" autocapitalize="off" type="text" ng-model="app.passwordRecovery.passwordRecoveryQuestionAnswer" />
+                              </md-input-container>
+                            </div>
+                          </div>
+                          <div ng-if="'SecondaryEmail' === app.passwordRecovery.passwordRecoveryMode">
+                            <div ng-if="!app.passwordRecovery.showLoader">
+                              {{ app.passwordRecovery.passwordRecoverySecondaryEmailText }}
+                            </div>
+                          </div>
+                        </div>
+                        <div layout="row" layout-align="end center" ng-if="!app.passwordRecovery.showLoader">
+                          <md-button ng-click="app.passwordRecoveryAbort()" type="button" >
+                            <var:string label:value="Back"/>
+                          </md-button>
+                          <div ng-if="'SecretQuestion' === app.passwordRecovery.passwordRecoveryMode">
+                            <md-button ng-click="app.passwordRecoveryCheck()" type="button" >
+                              <var:string label:value="Next"/>
+                            </md-button>
+                          </div>
+                          <div ng-if="'SecondaryEmail' === app.passwordRecovery.passwordRecoveryMode">
+                            <md-button ng-click="app.passwordRecoveryEmail()" type="button" >
+                              <var:string label:value="Next"/>
+                            </md-button>
+                          </div>
+                        </div>
+                      </div>
+                    </div>
+                    <div layout="column" layout-align="center center"
+                        ng-switch-when="sendrecoverymail">
+                        <md-icon class="md-accent md-hue-1 sg-icon--large">local_shipping</md-icon>
+                      <div flex="100">
+                        <div layout="row" layout-xs="column" class="md-padding">
+                          <div ng-if="'SecondaryEmail' === app.passwordRecovery.passwordRecoveryMode">
+                            <var:string label:value="A password reset link has been sent, please check your recovery e-mail mailbox and click on the link"/>
+                          </div>
+                        </div>
+                        <div layout="row" layout-align="end center">
+                          <md-button ng-click="app.passwordRecoveryAbort()" type="button" >
+                            <var:string label:value="Back"/>
+                          </md-button>
+                        </div>
+                      </div>
+                    </div>
+                  </var:if>
+
+                  <!-- Logged in -->
+                  <div layout="column" layout-align="center center"
+                      ng-switch-when="logged">
+                    <md-icon class="md-accent md-hue-1 sg-icon--large">done</md-icon>
+                    <div class="md-default-theme md-accent md-hue-1 md-fg md-padding">
+                      <var:string label:value="Welcome"/> {{app.cn}}
+                    </div>
                   </div>
-                </div>
 
-                <div layout="column" layout-align="center center"
-                    ng-switch-when="message">
-                  <md-icon class="md-accent md-hue-1 sg-icon--large">done</md-icon>
-                  <div class="md-default-theme md-accent md-hue-1 md-fg md-padding">
-                    {{app.errorMessage}}
+                  <div layout="column" layout-align="center center"
+                      ng-switch-when="message">
+                    <md-icon class="md-accent md-hue-1 sg-icon--large">done</md-icon>
+                    <div class="md-default-theme md-accent md-hue-1 md-fg md-padding">
+                      {{app.errorMessage}}
+                    </div>
+                    <md-button
+                        ng-click="app.continueLogin()"
+                        sg-ripple-click="loginContent"><var:string label:value="Continue"/></md-button>
                   </div>
-                  <md-button
-                      ng-click="app.continueLogin()"
-                      sg-ripple-click="loginContent"><var:string label:value="Continue"/></md-button>
-                </div>
 
-                <!-- Error -->
-                <div layout="column" layout-align="center center"
-                    ng-switch-when="error">
-                  <md-icon class="md-accent md-hue-1 sg-icon--large">error</md-icon>
-                  <div class="md-default-theme md-accent md-hue-1 md-fg md-padding">
-                    {{app.errorMessage}}
+                  <!-- Error -->
+                  <div layout="column" layout-align="center center"
+                      ng-switch-when="error">
+                    <md-icon class="md-accent md-hue-1 sg-icon--large">error</md-icon>
+                    <div class="md-default-theme md-accent md-hue-1 md-fg md-padding">
+                      {{app.errorMessage}}
+                    </div>
+                    <md-button
+                        ng-click="app.restoreLogin()"
+                        sg-ripple-click="loginContent"><var:string label:value="Retry"/></md-button>
                   </div>
-                  <md-button
-                      ng-click="app.restoreLogin()"
-                      sg-ripple-click="loginContent"><var:string label:value="Retry"/></md-button>
-                </div>
 
-              </sg-ripple-content>
-            </form>
+                  </sg-ripple-content>
+                </form>
 
-            </div>
+              </div>
+            </var:if>
+            <var:if condition="doPartialLogin">
+              <div id="login" class="sg-login-content md-padding">
+                <form name="loginForm" layout="column"
+                      ng-cloak="ng-cloak"
+                      ng-submit="app.loginName()">
+                  <div ng-if="!app.loginState">
+
+                    <md-input-container class="md-block">
+                      <label><var:string label:value="Username"/></label>
+                      <md-icon>person</md-icon>
+                      <input autocorrect="off" autocapitalize="off" type="text" ng-model="app.creds.username" ng-required="true" ng-change="app.usernameChanged()" ng-blur="app.retrievePasswordRecoveryEnabled()" />
+                    </md-input-container>
+
+                    <!-- LANGUAGES SELECT -->
+                    <div layout="row" layout-align="start end">
+                      <md-icon>language</md-icon>
+                      <md-input-container class="md-flex">
+                        <label><var:string label:value="choose"/></label>
+                        <md-select ng-model="app.creds.language"
+                                  var:placeholder="localizedLanguage"
+                                  ng-change="app.changeLanguage($event)">
+                          <var:foreach list="languages" item="item">
+                            <md-option var:value="item">
+                              <var:string value="languageText"/>
+                            </md-option>
+                          </var:foreach>
+                        </md-select>
+                      </md-input-container>
+                    </div>
+                    
+                    <var:if condition="hasUrlCreateAccount">
+                      <div layout="row" layout-align="center center">
+                        <a var:href="urlCreateAccount" target="_blank" class="create-account-link"><var:string label:value="Create an account"/></a>
+                      </div>
+                    </var:if>
+                  </div>
+
+                  <!-- CONNECT BUTTON -->
+                  <div layout="row" layout-align="space-between center" ng-if="!app.loginState">
+                    <md-button class="md-icon-button"
+                              label:aria-label="About"
+                              ng-click="app.showAbout()">
+                      <md-icon>info</md-icon>
+                    </md-button>
+                    <div>
+                      <md-button class="md-fab md-accent md-hue-2" type="submit"
+                                label:aria-label="Connect"
+                                ng-if="!app.loginState"
+                                ng-disabled="loginForm.$invalid"
+                                sg-ripple-click="loginContent">
+                        <md-icon>arrow_forward</md-icon>
+                      </md-button>
+                    </div>
+                  </div>
+
+                  <sg-ripple class="md-default-theme md-accent md-bg"
+                            ng-class="{ 'md-warn': app.loginState == 'error' }"><!-- ripple background --></sg-ripple>
+                  <sg-ripple-content class="md-flex ng-hide"
+                                    layout="column" layout-align="center center" layout-fill="layout-fill"
+                                    ng-switch="app.loginState">
+
+                  <!-- Authenticating -->
+                  <div layout="column" layout-align="center center"
+                      ng-switch-when="authenticating">
+                    <md-progress-circular class="md-hue-1"
+                                          md-mode="indeterminate"
+                                          md-diameter="32"><!-- mailbox loading progress --></md-progress-circular>
+                    <div class="md-default-theme md-accent md-hue-1 md-fg md-padding">
+                      <var:string label:value="Authenticating"/>
+                    </div>
+                  </div>
+
+                  <!-- Logged in -->
+                  <div layout="column" layout-align="center center"
+                      ng-switch-when="logged">
+                    <md-icon class="md-accent md-hue-1 sg-icon--large">done</md-icon>
+                    <div class="md-default-theme md-accent md-hue-1 md-fg md-padding">
+                      <var:string label:value="Welcome"/> {{app.cn}}
+                    </div>
+                  </div>
+
+                  <div layout="column" layout-align="center center"
+                      ng-switch-when="message">
+                    <md-icon class="md-accent md-hue-1 sg-icon--large">done</md-icon>
+                    <div class="md-default-theme md-accent md-hue-1 md-fg md-padding">
+                      {{app.errorMessage}}
+                    </div>
+                    <md-button
+                        ng-click="app.continueLogin()"
+                        sg-ripple-click="loginContent"><var:string label:value="Continue"/></md-button>
+                  </div>
+
+                  <!-- Error -->
+                  <div layout="column" layout-align="center center"
+                      ng-switch-when="error">
+                    <md-icon class="md-accent md-hue-1 sg-icon--large">error</md-icon>
+                    <div class="md-default-theme md-accent md-hue-1 md-fg md-padding">
+                      {{app.errorMessage}}
+                    </div>
+                    <md-button
+                        ng-click="app.restoreLogin()"
+                        sg-ripple-click="loginContent"><var:string label:value="Retry"/></md-button>
+                  </div>
+
+                  </sg-ripple-content>
+                </form>
+              </div>
+            </var:if>
           </div>
         </div>
     </md-content>

UI/WebServerResources/js/Common.js.map

@@ -1 +1 @@
-{"version":3,"file":"Common.js","sources":["Common/utils.js","Common/Common.app.js","Common/mdColors.app.js","Common/cssescape.filter.js","Common/decodeUri.filter.js","Common/encodeUri.filter.js","Common/ensureTarget.filter.js","Common/loc.filter.js","Common/range.filter.js","Common/txt2html.filter.js","Common/AclController.js","Common/navController.js","Common/Acl.service.js","Common/Authentication.service.js","Common/Dialog.service.js","Common/Gravatar.service.js","Common/Resource.service.js","Common/sgFocus.service.js","Common/sgHotkeys.service.js","Common/sgRippleClick.service.js","Common/User.service.js","Common/sgAutogrow.directive.js","Common/sgAvatarImage.directive.js","Common/sgBlockToggle.directive.js","Common/sgCheckmark.directive.js","Common/sgColorPicker.directive.js","Common/sgCompile.directive.js","Common/sgDatepickerReadonlyInput.directive.js","Common/sgDraggable.directive.js","Common/sgDroppable.directive.js","Common/sgEnter.directive.js","Common/sgEscape.directive.js","Common/sgFocus.directive.js","Common/sgFolderStylesheet.directive.js","Common/sgLabels.directive.js","Common/sgNoDirtyCheck.directive.js","Common/sgPlaceholder.directive.js","Common/sgQrCode.directive.js","Common/sgResetOnDisabled.directive.js","Common/sgRippleClick.directive.js","Common/sgSearch.directive.js","Common/sgSelectOnly.directive.js","Common/sgSubscribe.directive.js","Common/sgTimepicker.directive.js","Common/sgToggleGrid.directive.js"],"names":["l","i","j","key","arguments","value","args","labels","clabels","length","replace","m","val","parseFloat","isNaN","hexToRgb","hex","result","exec","r","parseInt","g","b","contrast","color","c","Math","pow","guid","S4","random","toString","substring","substr","toLowerCase","configure","$animateProvider","$logProvider","$compileProvider","$httpProvider","$mdThemingProvider","$mdAriaProvider","$qProvider","classNameFilter","definePalette","50","100","200","300","400","500","600","700","800","900","A100","A200","A400","A700","contrastDefaultColor","contrastLightColors","contrastDarkColors","greyMap","extendPalette","1000","theme","primaryPalette","default","hue-1","hue-2","hue-3","accentPalette","backgroundPalette","registerStyles","join","window","DebugEnabled","debugEnabled","debugInfoEnabled","disableWarnings","errorOnUnhandledRejections","generateThemesOnDemand","interceptors","push","renewTicket","$window","$q","$timeout","$injector","response","deferred","defer","iframe","angular","element","UserFolderURL","on","$state","get","config","attempt","off","location","href","ApplicationBaseURL","current","reject","$http","then","resolve","finally","remove","document","body","appendChild","promise","AuthInterceptor","test","headers","Accept","data","usesCASAuthentication","usesSAML2Authentication","ErrorInterceptor","$rootScope","responseError","rejection","status","cookie","indexOf","recovered","quiet","$broadcast","module","isPopup","classList","contains","baseURL","resourcesURL","ResourcesURL","activeUser","param","settings","login","UserLogin","identification","UserIdentification","email","UserEmail","language","UserLanguage","folderURL","isSuperUser","IsSuperUser","path","calendar","UserCalendarPath","contacts","UserContactsPath","mail","UserMailPath","preferences","UserPreferencesPath","administration","UserAdministrationPath","help","HelpURL","logoff","UserLogoffPath","minimumSearchLength","isNumber","constant","selection","xs","gt-xs","sm","gt-sm","md","gt-md","lg","gt-lg","xl","print","toastPosition","factory","$inject","_$mdThemingProvider","runBlock","$interpolate","$document","$log","buildCssSelectors","selectors","fgDefault","bgDefault","bdrDefault","fgDefaultHue","bgDefaultHue","fgColor","bgColor","bdrColor","fgHue","bgHue","customSheet","style","head","querySelector","createElement","title","createTextNode","sheet","index","cssRules","deleteRule","addRule","fgInterpolate","bgInterpolate","themeName","paletteName","colorArray","hueName","context","palette","hue","insertRule","addBorderRule","bdrInterpolate","colorValue","forEach","_THEMES","_PALETTES","colors","primary","name","hues","run","cssEscape","CSS","escape","filter","decodeUri","decodeURIComponent","encodeUri","encodeURIComponent","ensureTarget","$sce","tree","find","attr","trustAs","html","n","res","txt2html","linkyFilter","text","String","rel","undefined","AclController","$mdDialog","Dialog","usersWithACL","User","folder","vm","this","selectUser","user","$event","target","parentNode","selectedUid","uid","selectedUser","inactive","$rights","users","userToAdd","searchText","folderClassName","isFunction","getClassName","templateName","getElementById","$isAnonymous","userFilter","$query","$filter","$acl","dry","closeModal","$resetUsersRights","hide","saveModal","$saveUsersRights","alert","confirmChange","confirmation","$confirmRights","showing","message","removeUser","$removeUser","addUser","$addUser","toggleAllRights","$toggleAllRights","hasNoRight","$hasNoRight","showRights","controller","navController",Line truncated
+{"version":3,"file":"Common.js","sources":["Common/utils.js","Common/Common.app.js","Common/mdColors.app.js","Common/cssescape.filter.js","Common/decodeUri.filter.js","Common/encodeUri.filter.js","Common/ensureTarget.filter.js","Common/loc.filter.js","Common/range.filter.js","Common/txt2html.filter.js","Common/AclController.js","Common/navController.js","Common/Acl.service.js","Common/Authentication.service.js","Common/Dialog.service.js","Common/Gravatar.service.js","Common/Resource.service.js","Common/sgFocus.service.js","Common/sgHotkeys.service.js","Common/sgRippleClick.service.js","Common/User.service.js","Common/sgAutogrow.directive.js","Common/sgAvatarImage.directive.js","Common/sgBlockToggle.directive.js","Common/sgCheckmark.directive.js","Common/sgColorPicker.directive.js","Common/sgCompile.directive.js","Common/sgDatepickerReadonlyInput.directive.js","Common/sgDraggable.directive.js","Common/sgDroppable.directive.js","Common/sgEnter.directive.js","Common/sgEscape.directive.js","Common/sgFocus.directive.js","Common/sgFolderStylesheet.directive.js","Common/sgLabels.directive.js","Common/sgNoDirtyCheck.directive.js","Common/sgPlaceholder.directive.js","Common/sgQrCode.directive.js","Common/sgResetOnDisabled.directive.js","Common/sgRippleClick.directive.js","Common/sgSearch.directive.js","Common/sgSelectOnly.directive.js","Common/sgSubscribe.directive.js","Common/sgTimepicker.directive.js","Common/sgToggleGrid.directive.js"],"names":["l","i","j","key","arguments","value","args","labels","clabels","length","replace","m","val","parseFloat","isNaN","hexToRgb","hex","result","exec","r","parseInt","g","b","contrast","color","c","Math","pow","guid","S4","random","toString","substring","substr","toLowerCase","configure","$animateProvider","$logProvider","$compileProvider","$httpProvider","$mdThemingProvider","$mdAriaProvider","$qProvider","classNameFilter","definePalette","50","100","200","300","400","500","600","700","800","900","A100","A200","A400","A700","contrastDefaultColor","contrastLightColors","contrastDarkColors","greyMap","extendPalette","1000","theme","primaryPalette","default","hue-1","hue-2","hue-3","accentPalette","backgroundPalette","registerStyles","join","window","DebugEnabled","debugEnabled","debugInfoEnabled","disableWarnings","errorOnUnhandledRejections","generateThemesOnDemand","interceptors","push","renewTicket","$window","$q","$timeout","$injector","response","deferred","defer","iframe","angular","element","UserFolderURL","on","$state","get","config","attempt","off","location","href","ApplicationBaseURL","current","reject","$http","then","resolve","finally","remove","document","body","appendChild","promise","AuthInterceptor","test","headers","Accept","data","usesCASAuthentication","usesSAML2Authentication","ErrorInterceptor","$rootScope","responseError","rejection","status","cookie","indexOf","recovered","quiet","$broadcast","module","isPopup","classList","contains","baseURL","resourcesURL","ResourcesURL","activeUser","param","settings","login","UserLogin","identification","UserIdentification","email","UserEmail","language","UserLanguage","folderURL","isSuperUser","IsSuperUser","path","calendar","UserCalendarPath","contacts","UserContactsPath","mail","UserMailPath","preferences","UserPreferencesPath","administration","UserAdministrationPath","help","HelpURL","logoff","UserLogoffPath","minimumSearchLength","isNumber","constant","selection","xs","gt-xs","sm","gt-sm","md","gt-md","lg","gt-lg","xl","print","toastPosition","factory","$inject","_$mdThemingProvider","runBlock","$interpolate","$document","$log","buildCssSelectors","selectors","fgDefault","bgDefault","bdrDefault","fgDefaultHue","bgDefaultHue","fgColor","bgColor","bdrColor","fgHue","bgHue","customSheet","style","head","querySelector","createElement","title","createTextNode","sheet","index","cssRules","deleteRule","addRule","fgInterpolate","bgInterpolate","themeName","paletteName","colorArray","hueName","context","palette","hue","insertRule","addBorderRule","bdrInterpolate","colorValue","forEach","_THEMES","_PALETTES","colors","primary","name","hues","run","cssEscape","CSS","escape","filter","decodeUri","decodeURIComponent","encodeUri","encodeURIComponent","ensureTarget","$sce","tree","find","attr","trustAs","html","n","res","txt2html","linkyFilter","text","String","rel","undefined","AclController","$mdDialog","Dialog","usersWithACL","User","folder","vm","this","selectUser","user","$event","target","parentNode","selectedUid","uid","selectedUser","inactive","$rights","users","userToAdd","searchText","folderClassName","isFunction","getClassName","templateName","getElementById","$isAnonymous","userFilter","$query","$filter","$acl","dry","closeModal","$resetUsersRights","hide","saveModal","$saveUsersRights","alert","confirmChange","confirmation","$confirmRights","showing","message","removeUser","$removeUser","addUser","$addUser","toggleAllRights","$toggleAllRights","hasNoRight","$hasNoRight","showRights","controller","navController",Line truncated

UI/WebServerResources/js/Common/Authentication.service.js

@@ -178,6 +178,45 @@
           return d.promise;
         }, // login: function(data) { ...
 
+        loginName: function(data) {
+          var d = $q.defer(),
+              username = data.username,
+              language;
+
+          if (data.language && data.language != 'WONoSelectionString') {
+            language = data.language;
+          }
+
+          $http({
+            method: 'POST',
+            url: '/SOGo/connectName?userName='+username,
+            // data: JSON.stringify({userName: username}),
+            data: {userName: username},
+            // headers: {
+            //  //'Content-Type': undefined
+            //  //'Content-Type': "application/x-www-form-urlencoded"
+            //   'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8'
+            // }
+          }).then(function(response) {
+            var data = response.data;
+            // Make sure browser's cookies are enabled
+            if (navigator && !navigator.cookieEnabled) {
+              d.reject({error: l('cookiesNotEnabled')});
+            }
+            else {
+                if(data.redirect) {
+                  //Redirection in case of openID
+                  d.resolve({ url: data.redirect });
+                }
+            }
+          }, function(error) {
+            var response, perr, data = error.data;
+
+            d.reject(response);
+          });
+          return d.promise;
+        },
+
         changePassword: function(userName, domain, newPassword, oldPassword, token) {
           var d = $q.defer(),
               xsrfCookie = $cookies.get('XSRF-TOKEN');

UI/WebServerResources/js/Mailer.services.js.map

@@ -1 +1 @@
-{"version":3,"file":"Mailer.services.js","sources":["Mailer/Account.service.js","Mailer/Mailbox.service.js","Mailer/Message.service.js","Mailer/sgImageGallery.service.js","Mailer/VirtualMailbox.service.js","Mailer/MailboxController.js","Mailer/MailboxesController.js","Mailer/MessageController.js","Mailer/MessageEditorController.js","Mailer/sgAccountSection.directive.js","Mailer/sgIMIP.directive.js","Mailer/sgMailboxListItem.directive.js","Mailer/sgMessageListItem.directive.js","Mailer/sgMessageListItemMain.directive.js","Mailer/sgZoomableImage.directive.js"],"names":["Account","futureAccountData","_this","this","then","angular","extend","_","forEach","identities","identity","element","fullName","email","full","signature","textSignature","map","contents","join","trim","$mailboxes","$Mailbox","$unwrapCollection","$q","when","mailboxes","collection","$factory","$timeout","$log","Settings","Resource","Preferences","Mailbox","Message","$$resource","activeUser","$Preferences","$Message","module","e","factory","$findAll","data","$accounts","fetch","o","i","id","refreshUnseenCount","folders","unseenCountFolders","fetchAllUnseenCountFolders","defaults","SOGoMailFetchAllUnseenCountFolders","refreshViewCheck","SOGoRefreshViewCheck","Error","account","$$flattenMailboxes","mailbox","push","includes","isDefined","unseenCount","post","$refreshUnseenCount","cancel","bind","timeInterval","prototype","getLength","$expanded","$flattenMailboxes","length","getItemAtIndex","index","expandedMailboxes","$getMailboxes","options","reload","$futureMailboxesData","$find","_visitForUnseencount","previousMailbox","find","previousMailboxes","children","all","_visitForExpanded","expandedFolders","indexOf","settings","Mail","ExpandedFolders","isString","fromJson","warn","_visit","allMailboxes","saveState","reduce","$getMailboxByType","type","_find","$getMailboxByPath","path","$newMailbox","name","toString","getTextSignature","$hasCertificate","security","hasCertificate","$certificate","$$certificate","reject","$removeCertificate","updateQuota","percent","description","maxQuota","Math","round","usedSpace","l","formatted","maxMessages","messagesCount","$quota","$newMessage","debug","JSON","stringify","undefined","accountId","mailboxPath","message","$absolutePath","asDraft","accountDefaults","AuxiliaryMailAccounts","alwaysSign","sign","alwaysEncrypt","encrypt","editable","isNew","mailto","isObject","$parseMailto","$addDelegate","user","deferred","defer","param","uid","delegates","resolve","users","status","promise","$removeDelegate","splice","$omit","deep","defaultIdentity","value","key","copy","isReadOnly","pick","isDefault","forceDefaultIdentity","futureMailboxData","$account","init","newMailboxData","create","$unwrap","$rootScope","Acl","PRELOAD","BATCH_DELETE_LIMIT","$$Acl","$query","sort","asc","selectedFolder","$refreshTimeout","$virtualMode","$virtualPath","$searchMode","SortingState","parseInt","constant","LOOKAHEAD","SIZE","createMailboxes","level","isSentFolder","isDraftsFolder","quotas","split","component","asCSSIdentifier","isUndefined","uidsMap","headers","$isLoading","$messages","$visibleMessages","$selectedMessages","$highlightWords","$id","$acl","threaded","$collapsedThreads","threadsCollapsed","$displayName","$isEditable","isEditable","$isSpecial","$icon","$isNoInferiors","isNoInferiors","$shadowData","selectFolder","setSearchMode","searchMode","$lastVisibleIndex","max","$loadMessage","selectedMessages","updateCache","filter","selected","selectedCount","$unselectMessages","isSelectedMessage","messageId","$selectedMessage","selectedMessage","$selectedMessageIndex","hasSelectedMessage","$filter","sortingAttributes","filters","action","labels","searchBy","searchInput","word","cleanedWord","toLowerCase","match","secondFilter","$flaggedOnly","$unseenOnly","$syncToken","syncToken","unseenOnly","flaggedOnly","keys","$filteredLabels","k","f","endIndex","uids","startIndex","loaded","subject","min","loading","futureHeadersData","$unwrapHeaders","flags","isNoSelect","isWritable","getClassName","base","$rename","findParent","parent","parentMailbox","$save","_updateChildren","child","replace","pathRE","oldPath","sibling","localeCompare","RegExp","$compact","$canFolderAs","$setFolderAs","$empty","capitalize","substring","$markAsRead","isread","getLabels","$labels","filteredByLabel","$flagMessages","messages","operation","msgUIDs","forwardMessages","saveSelectedMessages","selectedUIDs","download","exportFolder","filename","open","$delete","$_deleteMessages","firstIndex","forEachRight","selectedIndex","findIndex","updateVisibleMessages","$deleteMessages","batchSize","_deleteMessages","start","end","currentUids","slice","$markOrUnMarkMessagesAsJunk","method","$copyMessages","folder","$moveMessages","$move","parentPath","finally","save","response","error","$reset","Object","assign","childrenArray","collapsedThread","msg","first","collapsed","$broadcast","$futureMailboxData","headersFields","msgObject","hasNewMessages","$topIndex","deleted","jLine truncated
+{"version":3,"file":"Mailer.services.js","sources":["Mailer/Account.service.js","Mailer/Mailbox.service.js","Mailer/Message.service.js","Mailer/sgImageGallery.service.js","Mailer/VirtualMailbox.service.js","Mailer/MailboxController.js","Mailer/MailboxesController.js","Mailer/MessageController.js","Mailer/MessageEditorController.js","Mailer/sgAccountSection.directive.js","Mailer/sgIMIP.directive.js","Mailer/sgMailboxListItem.directive.js","Mailer/sgMessageListItem.directive.js","Mailer/sgMessageListItemMain.directive.js","Mailer/sgZoomableImage.directive.js"],"names":["Account","futureAccountData","_this","this","then","angular","extend","_","forEach","identities","identity","element","fullName","email","full","signature","textSignature","map","contents","join","trim","$mailboxes","$Mailbox","$unwrapCollection","$q","when","mailboxes","collection","$factory","$timeout","$log","Settings","Resource","Preferences","Mailbox","Message","$$resource","activeUser","$Preferences","$Message","module","e","factory","$findAll","data","$accounts","fetch","o","i","id","refreshUnseenCount","folders","unseenCountFolders","fetchAllUnseenCountFolders","defaults","SOGoMailFetchAllUnseenCountFolders","refreshViewCheck","SOGoRefreshViewCheck","Error","account","$$flattenMailboxes","mailbox","push","includes","isDefined","unseenCount","post","$refreshUnseenCount","cancel","bind","timeInterval","prototype","getLength","$expanded","$flattenMailboxes","length","getItemAtIndex","index","expandedMailboxes","$getMailboxes","options","reload","$futureMailboxesData","$find","_visitForUnseencount","previousMailbox","find","previousMailboxes","children","all","_visitForExpanded","expandedFolders","indexOf","settings","Mail","ExpandedFolders","isString","fromJson","warn","_visit","allMailboxes","saveState","reduce","$getMailboxByType","type","_find","$getMailboxByPath","path","$newMailbox","name","toString","getTextSignature","$hasCertificate","security","hasCertificate","$certificate","$$certificate","reject","$removeCertificate","updateQuota","percent","description","maxQuota","Math","round","usedSpace","l","formatted","maxMessages","messagesCount","$quota","$newMessage","debug","JSON","stringify","undefined","accountId","mailboxPath","message","$absolutePath","asDraft","accountDefaults","AuxiliaryMailAccounts","alwaysSign","sign","alwaysEncrypt","encrypt","editable","isNew","mailto","isObject","$parseMailto","$addDelegate","user","deferred","defer","param","uid","delegates","resolve","users","status","promise","$removeDelegate","splice","$omit","deep","defaultIdentity","value","key","copy","isReadOnly","pick","isDefault","forceDefaultIdentity","futureMailboxData","$account","init","newMailboxData","create","$unwrap","$rootScope","Acl","PRELOAD","BATCH_DELETE_LIMIT","$$Acl","$query","sort","asc","selectedFolder","$refreshTimeout","$virtualMode","$virtualPath","$searchMode","SortingState","parseInt","constant","LOOKAHEAD","SIZE","createMailboxes","level","isSentFolder","isDraftsFolder","quotas","split","component","asCSSIdentifier","isUndefined","uidsMap","headers","$isLoading","$messages","$visibleMessages","$selectedMessages","$highlightWords","$id","$acl","threaded","$collapsedThreads","threadsCollapsed","$displayName","$isEditable","isEditable","$isSpecial","$icon","$isNoInferiors","isNoInferiors","$shadowData","selectFolder","setSearchMode","searchMode","$lastVisibleIndex","max","$loadMessage","selectedMessages","updateCache","filter","selected","selectedCount","$unselectMessages","isSelectedMessage","messageId","$selectedMessage","selectedMessage","$selectedMessageIndex","hasSelectedMessage","$filter","sortingAttributes","filters","action","labels","searchBy","searchInput","word","cleanedWord","toLowerCase","match","secondFilter","$flaggedOnly","$unseenOnly","$syncToken","syncToken","unseenOnly","flaggedOnly","keys","$filteredLabels","k","f","endIndex","uids","startIndex","loaded","subject","min","loading","futureHeadersData","$unwrapHeaders","flags","isNoSelect","isWritable","getClassName","base","$rename","findParent","parent","parentMailbox","$save","_updateChildren","child","replace","pathRE","oldPath","sibling","localeCompare","RegExp","$compact","$canFolderAs","$setFolderAs","$empty","capitalize","substring","$markAsRead","isread","getLabels","$labels","filteredByLabel","$flagMessages","messages","operation","msgUIDs","forwardMessages","saveSelectedMessages","selectedUIDs","download","exportFolder","filename","open","$delete","$_deleteMessages","firstIndex","forEachRight","selectedIndex","findIndex","updateVisibleMessages","$deleteMessages","batchSize","_deleteMessages","start","end","currentUids","slice","$markOrUnMarkMessagesAsJunk","method","$copyMessages","folder","$moveMessages","$move","parentPath","finally","save","response","error","$reset","Object","assign","childrenArray","collapsedThread","msg","first","collapsed","$broadcast","$futureMailboxData","headersFields","msgObject","hasNewMessages","$topIndex","deleted","jLine truncated

UI/WebServerResources/js/Mailer/MailboxController.js

@@ -210,9 +210,7 @@
       }
       url = url.join('/');
       popupWindow = $window.open(url, wId,
-                                 ["width=680",
-                                  "height=520",
-                                  "resizable=1",
+                                 ["resizable=1",
                                   "scrollbars=1",
                                   "toolbar=0",
                                   "location=0",

UI/WebServerResources/js/Main.js.map

@@ -1 +1 @@
-{"version":3,"file":"Main.js","sources":["Main/Main.app.js"],"names":["angular","module","LoginController","$scope","$window","$timeout","Dialog","$mdDialog","Authentication","focus","rippleDo","sgConstant","$mdToast","vm","this","$onInit","creds","username","cookieUsername","password","domain","rememberLogin","isDefined","length","test","location","search","language","loginState","verificationCodePattern","passwords","newPassword","newPasswordConfirmation","oldPassword","visible","passwordRecovery","passwordRecoveryEnabled","passwordRecoveryQuestionKey","passwordRecoveryQuestion","passwordRecoveryMode","passwordRecoveryQuestionAnswer","passwordRecoveryToken","passwordRecoveryLinkTimer","passwordRecoverySecondaryEmailText","passwordRecoveryMailDomain","showLoader","showLogin","queryString","window","let","token","URLSearchParams","get","pathname","indexOf","tokenArray","replace","split","info","JSON","parse","atob","retrievePasswordRecoveryEnabled","document","querySelectorAll","forEach","el","parentElement","classList","add","login","then","data","totpmissingkey","totpdisabled","cn","url","continueLogin","msg","value","string","error","errorMessage","grace","passwordPolicy","userPolicies","l","expire","Math","round","passwordexpired","restoreLogin","verificationCode","passwordRecoveryAbort","href","reload","showAbout","$event","AboutDialogController","closeDialog","hide","show","targetEvent","templateUrl","controller","controllerAs","$inject","changeLanguage","ApplicationBaseURL","canChangePassword","form","$setValidity","isInPasswordRecoveryMode","changePassword","simple","textContent","position","toastPosition","hideDelay","passwordRecoveryInfo","mode","secretQuestionLabel","secretQuestion","obfuscatedRecoveryEmail","passwordRecoveryEmail","passwordRecoveryCheck","isPasswordExpiredSecurity","usernameChanged","clearTimeout","setTimeout","mailDomain","changePasswordVisibility","field","getElementById","type","innerHTML"],"mappings":"AAEA,CAAA,WACE,aAEAA,QAAQC,OAAO,cAAe,CAAC,cAAe,sBAAsB,EAOpE,SAASC,EAAgBC,EAAQC,EAASC,EAAUC,EAAQC,EAAWC,EAAgBC,EAAOC,EAAUC,EAAYC,GAClH,IAAIC,EAAKC,KAETA,KAAKC,QAAU,WACbD,KAAKE,MAAQ,CACXC,SAAUb,EAAQc,eAClBC,SAAU,KACVC,OAAQ,KACRC,cAAerB,QAAQsB,UAAUlB,EAAQc,cAAc,GAAqC,EAAhCd,EAAQc,eAAeK,MACrF,EAEI,cAAcC,KAAKpB,EAAQqB,SAASC,MAAM,IAC5CZ,KAAKE,MAAMW,SAAWvB,EAAQuB,UAChCb,KAAKc,WAAa,CAAA,EAGlBd,KAAKe,wBAA0B,SAG/Bf,KAAKgB,UAAY,CAAEC,YAAa,KAAMC,wBAAyB,KAAMC,YAAa,KAAMC,QAAS,CAAA,CAAM,EAGvGpB,KAAKqB,iBAAmB,CACtBC,wBAAyB,CAAA,EACzBC,4BAA6B,KAC7BC,yBAA0B,KAC1BC,qBAAsB,KACtBC,+BAAgC,KAChCC,sBAAuB,KACvBC,0BAA2B,KAC3BC,mCAAoC,KACpCC,2BAA4B,KAC5BC,WAAY,CAAA,CACd,EAGA/B,KAAKgC,UAAY,CAAA,EACjBzC,EAAS,WACPQ,EAAGiC,UAAY,CAAA,EAEf,IAAMC,EAAcC,OAAOvB,SAASC,OAEpCuB,IAAIC,EADc,IAAIC,gBAAgBJ,CAAW,EAC3BK,IAAI,OAAO,EAE7B,EAAIJ,OAAOvB,SAAS4B,SAASC,QAAQ,uBAAuB,GAAKJ,EAK/D,KAHEK,GADNL,EAAQA,EAAMM,QAAQ,MAAO,EAAE,GACNC,MAAM,GAAG,GAGblC,SACnBV,EAAGsB,iBAAiBM,sBAAwBS,EACtCQ,EAAOC,KAAKC,MAAMC,KAAKN,EAAW,EAAE,CAAC,EAC3C1C,EAAGG,MAAMC,SAAWyC,EAAKzC,SACzBJ,EAAGG,MAAMI,OAASsC,EAAKtC,OACvBP,EAAGsB,iBAAiBM,sBAAwBS,EAC5CrC,EAAGsB,iBAAiBI,qBAAuB,iBAC3C1B,EAAGsB,iBAAiBC,wBAA0B,CAAA,EAE9CvB,EAAGe,WAAa,iBAChBlB,EAAS,cAAc,GAIzBG,EAAGiD,gCAAgC,EAIgB,EAAjDC,SAASC,iBAAiB,YAAY,EAAEzC,QAC1CwC,SAASC,iBAAiB,YAAY,EAAEC,QAAQ,IAC9CC,EAAGC,cAAcC,UAAUC,IAAI,oBAAoB,CACrD,CAAC,CAEL,EAAG,GAAG,CAER,EAEAvD,KAAKwD,MAAQ,WA2EX,OA1EAzD,EAAGe,WAAa,iBAChBpB,EAAe8D,MAAMzD,EAAGG,KAAK,EAC1BuD,KAAK,SAAUC,GAEVA,EAAKC,gBACP5D,EAAGe,WAAa,WAChBnB,EAAM,UAAU,GAET+D,EAAKE,cACZ7D,EAAGe,WAAa,eAChBf,EAAG8D,GAAKH,EAAKG,GACb9D,EAAG+D,IAAMJ,EAAKI,MAGd/D,EAAGe,WAAa,SAChBf,EAAG8D,GAAKH,EAAKG,GACb9D,EAAG+D,IAAMJ,EAAKI,IAGdvE,EAAS,WACPQ,EAAGgE,cAAc,CACnB,EAAG,GAAI,EAEX,EAAG,SAAUC,GAGX,IAaMC,EAGFC,EAlBJnE,EAAGe,WAAa,QAEZkD,EAAIG,MACNpE,EAAGqE,aAAeJ,EAAIG,MAEH,EAAZH,EAAIK,OAEXtE,EAAGe,WAAa,qBAChBf,EAAG8D,GAAKG,EAAIH,GACZ9D,EAAG+D,IAAME,EAAIF,IACb/D,EAAGuE,eAAiBN,EAAIO,cAAkC,GAC1DxE,EAAGqE,aAAeI,EAAE,sHAAuHR,EAAIK,KAAK,GAEhI,EAAbL,EAAIS,QAKTP,EAFe,MAAbF,EAAIS,QACNR,EAAQS,KAAKC,MAAMX,EAAIS,OAAS,KAAK,EAC5BD,EAAE,MAAM,GAEG,KAAbR,EAAIS,QACXR,EAAQS,KAAKC,MAAMX,EAAIS,OAAS,IAAI,EAC3BD,EAAE,OAAO,GAEE,GAAbR,EAAIS,QACXR,EAAQS,KAAKC,MAAMX,EAAIS,OAAS,EAAE,EACzBD,EAAE,SAAS,IAGpBP,EAAQD,EAAIS,OACHD,EAAE,SAAS,GAEtBzE,EAAGe,WAAa,qBAChBf,EAAG8D,GAAKG,EAAIH,GACZ9D,EAAG+D,IAAME,EAAIF,IACb/D,EAAGqE,aAAeI,EAAE,iDAAkDP,EAAOC,CAAM,IAE5EF,EAAIY,iBAA0C,GAAvBZ,EAAIY,iBAKzBZ,EAAIY,mBACb7E,EAAGe,WAAa,iBAChBf,EAAGuE,eAAiBN,EAAIO,cAAkC,GAC1DxE,EAAG+D,IAAME,EAAIF,IACb/D,EAAG6E,gBAAkBZ,EAAIY,gBAG7B,CAAC,EACI,CAAA,CACT,EAEA5E,KAAK6E,aAAe,WACd,mBAAqB9E,EAAGsB,iBAAiBI,qBAC3C7B,EAAS,cAAc,EAGvB,OAAOG,EAAGG,MAAM4E,iBAChB/E,EAAGgF,sBAAsB,CAE7B,EAEA/E,KAAK+D,cAAgB,WACfzE,EAAQqB,SAASqE,OAASjF,EAAG+D,IAC/BxE,EAAQqB,SAASsE,OAAO,CAAA,CAAI,EAE5B3F,EAAQqB,SAASqE,KAAOjF,EAAG+D,GAC/B,EAEA9D,KAAKkF,UAAY,SAAUC,GAQzB,SAASC,EAAsB3F,GAC7BO,KAAKqF,YAAc,WACjB5F,EAAU6F,KAAK,CACjB,CACF,CAXA7F,EAAU8F,KAAK,CACbC,YAAaL,EACbM,YAAa,gBACbC,WAAYN,EACZO,aAAc,OAChB,CAAC,EACDP,EAAsBQ,QAAU,CAAC,YAMnC,EAEA5F,KAAK6F,eAAiB,SAAUV,GAE9B7F,EAAQLine truncated
+{"version":3,"file":"Main.js","sources":["Main/Main.app.js"],"names":["angular","module","LoginController","$scope","$window","$timeout","Dialog","$mdDialog","Authentication","focus","rippleDo","sgConstant","$mdToast","vm","this","$onInit","creds","username","cookieUsername","password","domain","rememberLogin","isDefined","length","test","location","search","language","loginState","verificationCodePattern","passwords","newPassword","newPasswordConfirmation","oldPassword","visible","passwordRecovery","passwordRecoveryEnabled","passwordRecoveryQuestionKey","passwordRecoveryQuestion","passwordRecoveryMode","passwordRecoveryQuestionAnswer","passwordRecoveryToken","passwordRecoveryLinkTimer","passwordRecoverySecondaryEmailText","passwordRecoveryMailDomain","showLoader","showLogin","queryString","window","let","token","URLSearchParams","get","pathname","indexOf","tokenArray","replace","split","info","JSON","parse","atob","retrievePasswordRecoveryEnabled","document","querySelectorAll","forEach","el","parentElement","classList","add","login","then","data","totpmissingkey","totpdisabled","cn","url","continueLogin","msg","value","string","error","errorMessage","grace","passwordPolicy","userPolicies","l","expire","Math","round","passwordexpired","restoreLogin","verificationCode","passwordRecoveryAbort","href","reload","showAbout","$event","AboutDialogController","closeDialog","hide","show","targetEvent","templateUrl","controller","controllerAs","$inject","changeLanguage","ApplicationBaseURL","canChangePassword","form","$setValidity","isInPasswordRecoveryMode","changePassword","simple","textContent","position","toastPosition","hideDelay","passwordRecoveryInfo","mode","secretQuestionLabel","secretQuestion","obfuscatedRecoveryEmail","passwordRecoveryEmail","passwordRecoveryCheck","isPasswordExpiredSecurity","usernameChanged","clearTimeout","setTimeout","mailDomain","changePasswordVisibility","field","getElementById","type","innerHTML"],"mappings":"AAEA,CAAA,WACE,aAEAA,QAAQC,OAAO,cAAe,CAAC,cAAe,sBAAsB,EAOpE,SAASC,EAAgBC,EAAQC,EAASC,EAAUC,EAAQC,EAAWC,EAAgBC,EAAOC,EAAUC,EAAYC,GAClH,IAAIC,EAAKC,KAETA,KAAKC,QAAU,WACbD,KAAKE,MAAQ,CACXC,SAAUb,EAAQc,eAClBC,SAAU,KACVC,OAAQ,KACRC,cAAerB,QAAQsB,UAAUlB,EAAQc,cAAc,GAAqC,EAAhCd,EAAQc,eAAeK,MACrF,EAEI,cAAcC,KAAKpB,EAAQqB,SAASC,MAAM,IAC5CZ,KAAKE,MAAMW,SAAWvB,EAAQuB,UAChCb,KAAKc,WAAa,CAAA,EAGlBd,KAAKe,wBAA0B,SAG/Bf,KAAKgB,UAAY,CAAEC,YAAa,KAAMC,wBAAyB,KAAMC,YAAa,KAAMC,QAAS,CAAA,CAAM,EAGvGpB,KAAKqB,iBAAmB,CACtBC,wBAAyB,CAAA,EACzBC,4BAA6B,KAC7BC,yBAA0B,KAC1BC,qBAAsB,KACtBC,+BAAgC,KAChCC,sBAAuB,KACvBC,0BAA2B,KAC3BC,mCAAoC,KACpCC,2BAA4B,KAC5BC,WAAY,CAAA,CACd,EAGA/B,KAAKgC,UAAY,CAAA,EACjBzC,EAAS,WACPQ,EAAGiC,UAAY,CAAA,EAEf,IAAMC,EAAcC,OAAOvB,SAASC,OAEpCuB,IAAIC,EADc,IAAIC,gBAAgBJ,CAAW,EAC3BK,IAAI,OAAO,EAE7B,EAAIJ,OAAOvB,SAAS4B,SAASC,QAAQ,uBAAuB,GAAKJ,EAK/D,KAHEK,GADNL,EAAQA,EAAMM,QAAQ,MAAO,EAAE,GACNC,MAAM,GAAG,GAGblC,SACnBV,EAAGsB,iBAAiBM,sBAAwBS,EACtCQ,EAAOC,KAAKC,MAAMC,KAAKN,EAAW,EAAE,CAAC,EAC3C1C,EAAGG,MAAMC,SAAWyC,EAAKzC,SACzBJ,EAAGG,MAAMI,OAASsC,EAAKtC,OACvBP,EAAGsB,iBAAiBM,sBAAwBS,EAC5CrC,EAAGsB,iBAAiBI,qBAAuB,iBAC3C1B,EAAGsB,iBAAiBC,wBAA0B,CAAA,EAE9CvB,EAAGe,WAAa,iBAChBlB,EAAS,cAAc,GAIzBG,EAAGiD,gCAAgC,EAIgB,EAAjDC,SAASC,iBAAiB,YAAY,EAAEzC,QAC1CwC,SAASC,iBAAiB,YAAY,EAAEC,QAAQ,IAC9CC,EAAGC,cAAcC,UAAUC,IAAI,oBAAoB,CACrD,CAAC,CAEL,EAAG,GAAG,CAER,EAEAvD,KAAKwD,MAAQ,WA2EX,OA1EAzD,EAAGe,WAAa,iBAChBpB,EAAe8D,MAAMzD,EAAGG,KAAK,EAC1BuD,KAAK,SAAUC,GAEVA,EAAKC,gBACP5D,EAAGe,WAAa,WAChBnB,EAAM,UAAU,GAET+D,EAAKE,cACZ7D,EAAGe,WAAa,eAChBf,EAAG8D,GAAKH,EAAKG,GACb9D,EAAG+D,IAAMJ,EAAKI,MAGd/D,EAAGe,WAAa,SAChBf,EAAG8D,GAAKH,EAAKG,GACb9D,EAAG+D,IAAMJ,EAAKI,IAGdvE,EAAS,WACPQ,EAAGgE,cAAc,CACnB,EAAG,GAAI,EAEX,EAAG,SAAUC,GAGX,IAaMC,EAGFC,EAlBJnE,EAAGe,WAAa,QAEZkD,EAAIG,MACNpE,EAAGqE,aAAeJ,EAAIG,MAEH,EAAZH,EAAIK,OAEXtE,EAAGe,WAAa,qBAChBf,EAAG8D,GAAKG,EAAIH,GACZ9D,EAAG+D,IAAME,EAAIF,IACb/D,EAAGuE,eAAiBN,EAAIO,cAAkC,GAC1DxE,EAAGqE,aAAeI,EAAE,sHAAuHR,EAAIK,KAAK,GAEhI,EAAbL,EAAIS,QAKTP,EAFe,MAAbF,EAAIS,QACNR,EAAQS,KAAKC,MAAMX,EAAIS,OAAS,KAAK,EAC5BD,EAAE,MAAM,GAEG,KAAbR,EAAIS,QACXR,EAAQS,KAAKC,MAAMX,EAAIS,OAAS,IAAI,EAC3BD,EAAE,OAAO,GAEE,GAAbR,EAAIS,QACXR,EAAQS,KAAKC,MAAMX,EAAIS,OAAS,EAAE,EACzBD,EAAE,SAAS,IAGpBP,EAAQD,EAAIS,OACHD,EAAE,SAAS,GAEtBzE,EAAGe,WAAa,qBAChBf,EAAG8D,GAAKG,EAAIH,GACZ9D,EAAG+D,IAAME,EAAIF,IACb/D,EAAGqE,aAAeI,EAAE,iDAAkDP,EAAOC,CAAM,IAE5EF,EAAIY,iBAA0C,GAAvBZ,EAAIY,iBAKzBZ,EAAIY,mBACb7E,EAAGe,WAAa,iBAChBf,EAAGuE,eAAiBN,EAAIO,cAAkC,GAC1DxE,EAAG+D,IAAME,EAAIF,IACb/D,EAAG6E,gBAAkBZ,EAAIY,gBAG7B,CAAC,EACI,CAAA,CACT,EAEA5E,KAAK6E,aAAe,WACd,mBAAqB9E,EAAGsB,iBAAiBI,qBAC3C7B,EAAS,cAAc,EAGvB,OAAOG,EAAGG,MAAM4E,iBAChB/E,EAAGgF,sBAAsB,CAE7B,EAEA/E,KAAK+D,cAAgB,WACfzE,EAAQqB,SAASqE,OAASjF,EAAG+D,IAC/BxE,EAAQqB,SAASsE,OAAO,CAAA,CAAI,EAE5B3F,EAAQqB,SAASqE,KAAOjF,EAAG+D,GAC/B,EAEA9D,KAAKkF,UAAY,SAAUC,GAQzB,SAASC,EAAsB3F,GAC7BO,KAAKqF,YAAc,WACjB5F,EAAU6F,KAAK,CACjB,CACF,CAXA7F,EAAU8F,KAAK,CACbC,YAAaL,EACbM,YAAa,gBACbC,WAAYN,EACZO,aAAc,OAChB,CAAC,EACDP,EAAsBQ,QAAU,CAAC,YAMnC,EAEA5F,KAAK6F,eAAiB,SAAUV,GAE9B7F,EAAQLine truncated

UI/WebServerResources/js/Main/Main.app.js

@@ -20,6 +20,8 @@
         domain: null,
         rememberLogin: angular.isDefined($window.cookieUsername) && $window.cookieUsername.length > 0
       };
+      if($window.loginHint)
+        this.creds.username = $window.loginHint;
       // Send selected language only if user has changed it
       if (/\blanguage=/.test($window.location.search))
         this.creds.language = $window.language;
@@ -164,6 +166,64 @@
       return false;
     };
 
+    this.loginName = function() {
+      vm.loginState = 'authenticating';
+      Authentication.loginName(vm.creds)
+        .then(function(data) {
+            vm.loginState = 'logged';
+            vm.cn = data.cn;
+            vm.url = data.url;
+
+            // Let the user see the succesfull message before reloading the page
+            $timeout(function() {
+              vm.continueLogin();
+            }, 1000);
+        }, function(msg) {
+          vm.loginState = 'error';
+
+          if (msg.error) {
+            vm.errorMessage = msg.error;
+          }
+          else if (msg.grace > 0) {
+            // Password is expired, grace logins limit is not yet reached
+            vm.loginState = 'passwordwillexpire';
+            vm.cn = msg.cn;
+            vm.url = msg.url;
+            vm.errorMessage = l('You have %{0} logins remaining before your account is locked. Please change your password in the preference dialog.', msg.grace);
+          }
+          else if (msg.expire > 0) {
+            // Password will soon expire
+            var value, string;
+            if (msg.expire > 86400) {
+              value = Math.round(msg.expire/86400);
+              string = l("days");
+            }
+            else if (msg.expire > 3600) {
+              value = Math.round(msg.expire/3600);
+              string = l("hours");
+            }
+            else if (msg.expire > 60) {
+              value = Math.round(msg.expire/60);
+              string = l("minutes");
+            }
+            else {
+              value = msg.expire;
+              string = l("seconds");
+            }
+            vm.loginState = 'passwordwillexpire';
+            vm.cn = msg.cn;
+            vm.url = msg.url;
+            vm.errorMessage = l('Your password is going to expire in %{0} %{1}.', value, string);
+          }
+          else if (msg.passwordexpired) {
+            vm.loginState = 'passwordchange';
+            vm.url = msg.url;
+          }
+
+        });
+      return false;
+    };
+
     this.restoreLogin = function () {
       if ('SecretQuestion' === vm.passwordRecovery.passwordRecoveryMode) {
         rippleDo('loginContent');

UI/WebServerResources/js/vendor/punycode.js

@@ -422,7 +422,7 @@ const punycode = {
 	 * @memberOf punycode
 	 * @type String
 	 */
-	'version': '2.3.1',
+	'version': '2.1.0',
 	/**
 	 * An object of methods to convert from JavaScript's internal character
 	 * representation (UCS-2) to Unicode code points, and back.