Support multiple auth plugins

[yeya]

Haraka version

2.7.3

Expected behavior

When multiple auth plugins are enabled, when the first one is denied - the next one should try to authenticate.

Observed behavior

Only the first auth plugin works, if the authentication failed - the client is denied

Steps to reproduce

Enable 2 auth modules, and try to authenticate by the second one.

Hi there

To make it work I guess that I need to call next() when the first auth plugin failed instead of calling cb(false), am I right?

How can i gain access to the next function inside the check_plain_pass function?

[gramakri]

I need this feature as well :-) In my case, I have to use two sources of authentication - ldap and a db source. For now, I have a custom hacked up plugin that does one after the other. But would be really nice if we could just specify the plugins independently in plugin config one after the other (dovecot does something similar with multiple passdb/authdb).

[msimerson]

Note that the existing auth has some bruteforce auth prevention. It needs to be improved to persist across connections (#754). This features implementation needs to not break that brute force attack prevention and it'd be even better if it worked in conjunction with the rate_limit plugin to extend brute force protection across connections.

[celesteking]

Just noting that most complex scenario can be stolen from PAM spec. Search for "For the more complicated syntax valid control values have the following", you'll get the idea.

[msimerson]

migrated to wiki