dovecot - Mar 2008 - Authentication: Dovecot -> Vpopmail - > MySQL with one table per domain

Hi All, 

	I am using Dovecot 1.0.13 with Vpopmail (Qmail
Toaster current) backed by MySQL with one table per
domain (--disable-many-domains) . What I cannot figure
out is how to have Dovecot authenticate to Vpopmail
when Vpopmail uses one table per domain. Basically I
need dynamic SQL in the Dovecot-sql.conf file. 

	Currently I have:

	password_query = select pw_clear_passwd as password
from domainname_com where pw_name = '%n'

	I need something like 

	password_query = select pw_clear_passwd as password
from %d where pw_name = '%n'

	Where %d is the name of the table.  I can't use the
exact domain name at it will not match the vpopmail
format domainname_com.  I would be happy to use some
sort of sting builder but and not sure what my options
are in the .conf file.

            Please help 

	Thanks in advance 

	James 

James Nordstrom 
Nordstrom Design Inc. 
E-mail:  james at nordstromdesign.com
US:       908-419-5597
Europe: 001/908-419-5597

On Mon, 2008-03-24 at 10:44 -0700, James Nordstrom
wrote:
> 	password_query = select pw_clear_passwd as password
> from %d where pw_name = '%n'
> 
> 	Where %d is the name of the table.  I can't use the
> exact domain name at it will not match the vpopmail
> format domainname_com.  I would be happy to use some
> sort of sting builder but and not sure what my options
> are in the .conf file.
You could convert '.' to '_':

auth_username_translation = ._

But using %d directly in the SQL query is getting a bit dangerous. The
default auth_username_chars should make it safe, but if you add more
chars such as ';' and ' ' you'll have a potential SQL
injection security
hole.


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
URL:
<http://dovecot.org/pipermail/dovecot/attachments/20080425/0d94343d/attachment-0002.bin>