MBOX-Line: From joel at panacea.null.org  Sat Oct  6 21:54:51 2007
To: imap-protocol@u.washington.edu
From: Joel Reicher <joel@panacea.null.org>
Date: Fri Jun  8 12:34:40 2018
Subject: [Imap-protocol] Shared group mailboxes and IMAP
In-Reply-To: <46F15283.5000909@rde-richw-3.stanford.edu>
References: <46F01DF4.2060804@rde-richw-3.stanford.edu>
	<6A0572C0907CB8172BC6F693@tyrion.rrz.uni-koeln.de>
	<46F15283.5000909@rde-richw-3.stanford.edu>
Message-ID: <2642.1191732891@succubus.panacea.null.org>

Sorry for the delay in following up...

> In the scenario I described earlier, the shared mailbox is treated
> as a separate IMAP account.  The group mailboxes/accounts are on a
> separate IMAP server (not the same as any of the servers where the
> users' individual accounts live)

Just because the STORAGE for the individuals is on another server does
not mean the AUTHENTICATION DETAILS can't be duplicated on this "group"
server.

And this is exactly what I would recommend. Have users log in to both
servers with identical and individual authentication details. You may want
to use something like LDAP for this so there's no duplication of the auth
record.

> Each group account has its own, unique e-mail address, and the group
> mailbox acts like the inbox for the corresponding e-mail address
> (except, as I tried to explain earlier, they don't really LOOK like
> regular INBOX'es to most mail clients, apparently since they are
> stored in a name space starting with "group." instead of "user.").

With the scheme above you could actually make it into the INBOX for
each user since they're logging in to a different server to access
this group mailbox.

> Aside from the fact that the group mailboxes are on a separate IMAP
> server of their own, it's felt desirable to treat them as totally
> separate "accounts" in any case because the users accessing one of
> these group mailboxes generally want/need to assume a special group
> identity / personality (e.g., if a group mailbox is used by the staff
> of an office, and anyone in the office replies to a message sent to
> the group e-mail address, the reply should be "From:" the group
> address and NOT from the individual staff member sending the reply).
> This also means the current model (wherein all group mailboxes that
> a given user has rights to will all show up under a single account)
> if NOT good, because it prevents the user from assuming a separate
> persona for each separate group account.

That is a mail client configuration issue. Just because the automatic
stupidity of some mail clients can be tricked into the desired behaviour
by some server-side contortions doesn't mean you should do it.

> The main thing I was hoping to find by posting my original question
> was whether anyone can point me to an authentication mechanism that
> current IMAP clients could use to allow multiple users to log in to
> a single account, with each user having his/her own separate password.

This is server dependent, but I would expect most authentication
implementations to support multiple passwords for the same uid. You can
certainly do it with /etc/passwd in UNIX.

Cheers,

	- Joel

