1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
|
<!DOCTYPE html>
<html class="writer-html5" lang="en" >
<head>
<meta charset="utf-8" /><meta name="generator" content="Docutils 0.19: https://docutils.sourceforge.io/" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<title>Access Control Identifier (ACI) — Cyrus IMAP 3.10.2 documentation</title>
<link rel="stylesheet" href="../../../../_static/pygments.css" type="text/css" />
<link rel="stylesheet" href="../../../../_static/css/theme.css" type="text/css" />
<link rel="stylesheet" href="../../../../_static/graphviz.css" type="text/css" />
<link rel="stylesheet" href="../../../../_static/cyrus.css" type="text/css" />
<script data-url_root="../../../../" id="documentation_options" src="../../../../_static/documentation_options.js"></script>
<script src="../../../../_static/jquery.js"></script>
<script src="../../../../_static/underscore.js"></script>
<script src="../../../../_static/_sphinx_javascript_frameworks_compat.js"></script>
<script src="../../../../_static/doctools.js"></script>
<script src="../../../../_static/sphinx_highlight.js"></script>
<script src="../../../../_static/js/theme.js"></script>
<link rel="index" title="Index" href="../../../../genindex.html" />
<link rel="search" title="Search" href="../../../../search.html" />
<link rel="next" title="Access Control Lists Rights Reference" href="rights-reference.html" />
<link rel="prev" title="Access Control Defaults" href="defaults.html" />
</head>
<body class="wy-body-for-nav">
<div class="wy-grid-for-nav">
<nav data-toggle="wy-nav-shift" class="wy-nav-side">
<div class="wy-side-scroll">
<div class="wy-side-nav-search" >
<a href="../../../../index.html" class="icon icon-home">
Cyrus IMAP
</a>
<div class="version">
3.10.2
</div>
<div role="search">
<form id="rtd-search-form" class="wy-form" action="../../../../search.html" method="get">
<input type="text" name="q" placeholder="Search docs" aria-label="Search docs" />
<input type="hidden" name="check_keywords" value="yes" />
<input type="hidden" name="area" value="default" />
</form>
</div>
</div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
<p class="caption" role="heading"><span class="caption-text">Cyrus IMAP</span></p>
<ul class="current">
<li class="toctree-l1"><a class="reference internal" href="../../../../download.html">Download</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../../../quickstart.html">Quickstart Guide</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../../../overview.html">Overview</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../../../setup.html">Setup</a></li>
<li class="toctree-l1 current"><a class="reference internal" href="../../../../operations.html">Operations</a><ul class="current">
<li class="toctree-l2"><a class="reference internal" href="../../manpages/index.html">Man pages</a></li>
<li class="toctree-l2 current"><a class="reference internal" href="../../admin.html">Administrator Guide</a><ul class="current">
<li class="toctree-l3"><a class="reference internal" href="../../admin.html#architecture">Architecture</a></li>
<li class="toctree-l3 current"><a class="reference internal" href="../../admin.html#management">Management</a><ul class="current">
<li class="toctree-l4"><a class="reference internal" href="../locations.html">File & Directory Locations</a></li>
<li class="toctree-l4"><a class="reference internal" href="../ports-sockets.html">Ports and Sockets</a></li>
<li class="toctree-l4 current"><a class="reference internal" href="../access-control.html">Access Control</a></li>
<li class="toctree-l4"><a class="reference internal" href="../quotas.html">Quotas</a></li>
<li class="toctree-l4"><a class="reference internal" href="../sieve.html">Cyrus Sieve</a></li>
<li class="toctree-l4"><a class="reference internal" href="../backups.html">Cyrus Backups</a></li>
<li class="toctree-l4"><a class="reference internal" href="../nntp.html">Cyrus NNTP</a></li>
<li class="toctree-l4"><a class="reference internal" href="../protlayer.html">Cyrus Prot Layer</a></li>
<li class="toctree-l4"><a class="reference internal" href="../sop.html">Standard Operating Procedures</a></li>
<li class="toctree-l4"><a class="reference internal" href="../eventsource.html">Cyrus Event Source</a></li>
<li class="toctree-l4"><a class="reference internal" href="../monitoring.html">Monitoring</a></li>
<li class="toctree-l4"><a class="reference internal" href="../config-mailboxdistribution.html">Mailbox Distribution</a></li>
<li class="toctree-l4"><a class="reference internal" href="../murder/murder.html">Cyrus Murder</a></li>
<li class="toctree-l4"><a class="reference internal" href="../nginx-proxy.html">HOWTO: Using an NGINX IMAP Proxy</a></li>
<li class="toctree-l4"><a class="reference internal" href="../tweaking.html">Tweaking Cyrus IMAP</a></li>
</ul>
</li>
</ul>
</li>
<li class="toctree-l2"><a class="reference internal" href="../../faq.html">Frequently Asked Questions</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="../../../../developers.html">Developers</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../../../support.html">Support/Community</a></li>
</ul>
<p class="caption" role="heading"><span class="caption-text">Cyrus SASL</span></p>
<ul>
<li class="toctree-l1"><a class="reference external" href="http://www.cyrusimap.org/sasl">Cyrus SASL</a></li>
</ul>
</div>
</div>
</nav>
<section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
<i data-toggle="wy-nav-top" class="fa fa-bars"></i>
<a href="../../../../index.html">Cyrus IMAP</a>
</nav>
<div class="wy-nav-content">
<div class="rst-content">
<div role="navigation" aria-label="Page navigation">
<ul class="wy-breadcrumbs">
<li><a href="../../../../index.html" class="icon icon-home" aria-label="Home"></a></li>
<li class="breadcrumb-item"><a href="../../../../operations.html">Operations</a></li>
<li class="breadcrumb-item"><a href="../../admin.html">Administrator Guide</a></li>
<li class="breadcrumb-item"><a href="../access-control.html">Access Control</a></li>
<li class="breadcrumb-item active">Access Control Identifier (ACI)</li>
<li class="wy-breadcrumbs-aside">
<a href="https://github.com/cyrusimap/cyrus-imapd/blob/master/docsrc/imap/reference/admin/access-control/identifiers.rst" class="fa fa-github"> Edit on GitHub</a>
</li>
</ul>
<hr/>
</div>
<div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
<div itemprop="articleBody">
<section id="access-control-identifier-aci">
<span id="imap-admin-access-control-identifiers"></span><h1>Access Control Identifier (ACI)<a class="headerlink" href="#access-control-identifier-aci" title="Permalink to this heading"></a></h1>
<p>The Access Control Identifier (ACI) part of an ACL entry specifies the
user or group for which the entry applies. Group identifiers are
distinguished be the prefix "group:". For example, "group:accounting".</p>
<p>There are two special identifiers, "anonymous", and "anyone", which are
explained below. The meaning of other identifiers usually depends on
the authorization mechanism being used (selected by <code class="docutils literal notranslate"><span class="pre">--with-auth</span></code> at
compile time, defaulting to Unix).</p>
<section id="anonymous-and-anyone">
<h2><code class="docutils literal notranslate"><span class="pre">anonymous</span></code> and <code class="docutils literal notranslate"><span class="pre">anyone</span></code><a class="headerlink" href="#anonymous-and-anyone" title="Permalink to this heading"></a></h2>
<p>With any authorization mechanism, two special identifiers are defined.
The identifier <code class="docutils literal notranslate"><span class="pre">anonymous</span></code> refers to the anonymous, or unauthenticated
user. The identifier <code class="docutils literal notranslate"><span class="pre">anyone</span></code> refers to all users, including the
anonymous user.</p>
<p>Both <code class="docutils literal notranslate"><span class="pre">anonymous</span></code> and <code class="docutils literal notranslate"><span class="pre">anyone</span></code> may commonly be used with the <strong>post</strong>
right <code class="docutils literal notranslate"><span class="pre">p</span></code> to allow message insertion to mailboxes.</p>
</section>
<section id="kerberos-vs-unix-authorization">
<h2>Kerberos vs. Unix Authorization<a class="headerlink" href="#kerberos-vs-unix-authorization" title="Permalink to this heading"></a></h2>
<p>The Cyrus IMAP server comes with four authorization mechanisms, one is
compatible with Unix-style (<code class="docutils literal notranslate"><span class="pre">/etc/passwd</span></code>) authorization, one for use
with Kerberos 4, one for use with Kerberos 5, and one for use with an
external authorization process (ptloader) which can interface with
other group databases (e.g. AFS PTS groups, LDAP Groups, etc).</p>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p><strong>Authentication !== Authorization</strong></p>
<p>Note that authorization is <em>not</em> the same thing as authentication.
Authentication is the act of proving who you are. Authorization is
the act of determining what rights you have. Authentication is
discussed in the <a class="reference internal" href="../../../concepts/overview_and_concepts.html#imap-concepts-login-authentication"><span class="std std-ref">Login Authentication</span></a> part of
this document.</p>
</div>
<section id="unix-authorization">
<h3>Unix Authorization<a class="headerlink" href="#unix-authorization" title="Permalink to this heading"></a></h3>
<p>In the Unix authorization mechanism, ACIs are either a valid userid or
the string <code class="docutils literal notranslate"><span class="pre">group:</span></code> followed by a group listed in <code class="docutils literal notranslate"><span class="pre">/etc/group</span></code>.
Thus:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">root</span> <span class="n">Refers</span> <span class="n">to</span> <span class="n">the</span> <span class="n">user</span> <span class="n">root</span>
<span class="n">group</span><span class="p">:</span><span class="n">staff</span> <span class="n">Refers</span> <span class="n">to</span> <span class="n">the</span> <span class="n">group</span> <span class="n">staff</span>
</pre></div>
</div>
<p>It is also possible to use unix groups with users authenticated through
a non-/etc/passwd backend. Note that using unix groups in this way
(without associated <code class="docutils literal notranslate"><span class="pre">/etc/passwd</span></code> entries) is not recommended.</p>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>Cyrus requires the getgrent(3) POSIX sysctl. As such, NSS needs to
be configured to have the groups available, one of which includes
"files", but could also include "ldap".</p>
<p>NSS augmentations, such as <code class="docutils literal notranslate"><span class="pre">nss_ldap</span></code>, <code class="docutils literal notranslate"><span class="pre">pam_ldap</span></code> or <code class="docutils literal notranslate"><span class="pre">sssd</span></code>
may be used to provide Cyrus access to group information via NSS.</p>
</div>
</section>
<section id="kerberos-authorization">
<h3>Kerberos Authorization<a class="headerlink" href="#kerberos-authorization" title="Permalink to this heading"></a></h3>
<p>Using the Kerberos authorization mechanism, ACIs are of the form:</p>
<blockquote>
<div><p><em>$principal</em>.*$instance*@*$realm*</p>
</div></blockquote>
<p>If <code class="docutils literal notranslate"><span class="pre">$instance</span></code> is omitted, it defaults to the null string. If
<code class="docutils literal notranslate"><span class="pre">$realm</span></code> is omitted, it defaults to the local realm.</p>
<p>The file <code class="docutils literal notranslate"><span class="pre">/etc/krb.equiv</span></code> contains mappings between Kerberos
principals. The file contains zero or more lines, each containing two
fields. Any identity matching the first field of a line is changed to
the second identity during canonicalization. For example, a line in
<code class="docutils literal notranslate"><span class="pre">/etc/krb.equiv</span></code> of:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">bovik</span><span class="nd">@REMOTE</span><span class="o">.</span><span class="n">COM</span> <span class="n">bovik</span>
</pre></div>
</div>
<p>will cause the identity <code class="docutils literal notranslate"><span class="pre">bovik@REMOTE.COM</span></code> to be treated as if it
were the local identity <code class="docutils literal notranslate"><span class="pre">bovik</span></code>.</p>
</section>
<section id="alternative-authorization">
<h3>Alternative Authorization<a class="headerlink" href="#alternative-authorization" title="Permalink to this heading"></a></h3>
<p>A site may wish to write their own authorization mechanism, perhaps to
implement a local group mechanism. If it does so (by implementing an
<code class="docutils literal notranslate"><span class="pre">auth_[whatever]</span></code> PTS module), it will dictate its own form and
meaning of identifiers.</p>
</section>
</section>
</section>
</div>
</div>
<footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
<a href="defaults.html" class="btn btn-neutral float-left" title="Access Control Defaults" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
<a href="rights-reference.html" class="btn btn-neutral float-right" title="Access Control Lists Rights Reference" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
</div>
<hr/>
<div role="contentinfo">
<p>© Copyright 1993–2025, The Cyrus Team.</p>
</div>
Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
<a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
provided by <a href="https://readthedocs.org">Read the Docs</a>.
</footer>
</div>
</div>
</section>
</div>
<script>
jQuery(function () {
SphinxRtdTheme.Navigation.enable(true);
});
</script>
</body>
</html>
|
