MBOX-Line: From mrc at CAC.Washington.EDU  Wed Nov  2 20:18:43 2005
To: imap-protocol@u.washington.edu
From: Mark Crispin <mrc@CAC.Washington.EDU>
Date: Fri Jun  8 12:34:36 2018
Subject: [Imap-protocol] username/password
In-Reply-To: <436988D9.8040106@fastmail.co.uk>
References: <436988D9.8040106@fastmail.co.uk>
Message-ID: <Pine.OSX.4.64.0511022009390.533@pangtzu.panda.com>

Your question is difficult to answer, because it makes an incorrect 
premise.  That premise is that the server "asks" for a password.

The server does not "ask" for a password in IMAP; rather, the client 
chooses to provide one.

The server MAY announce that it refuses passwords on a global basis via 
the LOGINDISABLED capability.  Any client which sends a password to a 
server which has announced LOGINDISABLED is non-compliant with the IMAP 
specification and should not be used.

The standard configuration of UW imapd, in accordance with the IMAP 
specification (RFC 3501), makes such an announcement on non-SSL/TLS 
sessions; and in that state will reject any password even if the password 
is correct.  In that state, UW imapd allows other means of authentication 
that do not involve passwords.  If the session negotiates TLS encryption, 
the UW imapd will retract the LOGINDISABLED announcement and allow 
password authentication.

For other servers, you will need to read the vendor's documentation.

When announced, LOGINDISABLED is a global restriction.  It is not possible 
to allow passwords for some users and disallow passwords for other users. 
This is because the user name and password are sent together.

-- Mark --

http://panda.com/mrc
Democracy is two wolves and a sheep deciding what to eat for lunch.
Liberty is a well-armed sheep contesting the vote.

