RFC 2086

IMAP4 ACL extension 🎀

Part 1 of 2 💖

Okay bestie, here's the title block tea ☕✨

• Network Working Group: this one was made for the Network Working Group 🫶
• RFC number: 2086
• Author: J. Myers, Carnegie Mellon 🧚
• Category: Standards Track (so it's a real standard, no cap 👑)
• Date: January 1997
• Obsoletes / Updates: the title block doesn't list anything it obsoletes or updates 🙈

---

Status of this Memo 📜

Okay so this is an Internet standards track protocol for the Internet community, and it's literally asking for discussion and suggestions for improvements 💅. If you want the current standardization state and status of this protocol, check the current edition of the "Internet Official Protocol Standards" (STD 1) 🌸. Distribution of this memo is unlimited, so share the love 🦋.

1. Abstract ✨

The ACL extension of the Internet Message Access Protocol [IMAP4] lets you manipulate access control lists through the IMAP protocol. It's giving main character energy 🎀

Table of Contents 🗂️

1.   Abstract............................................... 1
2.   Conventions Used in this Document...................... 1
3.   Introduction and Overview.............................. 2
4.   Commands............................................... 3
4.1. SETACL................................................. 3
4.2. DELETEACL.............................................. 4
4.3. GETACL................................................. 4
4.4. LISTRIGHTS............................................. 4
4.5. MYRIGHTS............................................... 5
5.   Responses.............................................. 5
5.1. ACL.................................................... 5
5.2. LISTRIGHTS............................................. 6
5.3. MYRIGHTS............................................... 6
6.   Formal Syntax.......................................... 6
7.   References............................................. 7
8.   Security Considerations................................ 7
9.   Author's Address....................................... 8

2. Conventions Used in this Document 📝

Quick one: in examples, C: means lines the client sends, and S: means lines the server sends 🫶

3. Introduction and Overview 🦋

Okay so the ACL extension is present in any IMAP4 implementation that returns "ACL" as one of its supported capabilities when it gets the CAPABILITY command 💖

An access control list is a set of <identifier,rights> pairs. It's basically the guest list for a mailbox 🎟️

Identifiers are US-ASCII strings. The identifier anyone is reserved for the universal identity, which means all authentications, including anonymous ones 🌈. Every user name string accepted by the LOGIN or AUTHENTICATE commands to authenticate to the IMAP server is reserved as an identifier for that user 🧚. Identifiers that start with a dash ("-") are reserved for "negative rights," which we'll get into below 💀. Every other identifier string gets interpreted in an implementation-defined way 🌸.

Rights is a string listing a (possibly empty) set of alphanumeric characters, and each character stands for a set of operations being controlled 💅. Letters are reserved for "standard" rights, which are listed below. The set of standard rights can only be extended by a standards-track document 👑. Digits are reserved for implementation or site defined rights. Right now the standard rights are:

l - lookup (mailbox is visible to LIST/LSUB commands)
r - read (SELECT the mailbox, perform CHECK, FETCH, PARTIAL,
    SEARCH, COPY from mailbox)
s - keep seen/unseen information across sessions (STORE SEEN flag)
w - write (STORE flags other than SEEN and DELETED)
i - insert (perform APPEND, COPY into mailbox)
p - post (send mail to submission address for mailbox,
    not enforced by IMAP4 itself)
c - create (CREATE new sub-mailboxes in any implementation-defined
    hierarchy)
d - delete (STORE DELETED flag, perform EXPUNGE)
a - administer (perform SETACL)

An implementation can tie rights together, or it can force rights to always or never be granted to particular identifiers 🔗. For example, an implementation that uses unix mode bits ties the rights wisd together. The a right is always granted to the owner of a mailbox and is never granted to anyone else 🙈. If rights are tied in an implementation, the implementation must be conservative when granting rights in response to SETACL commands. Unless all rights in a tied set are specified, none of that set should go into the ACL entry for that identifier 😭. A client can find out which rights may be granted to a given identifier in the ACL for a given mailbox by using the LISTRIGHTS command 🔍.

It's totally possible for multiple identifiers in an access control list to apply to one user (or other authentication identity) 👯. For example, an ACL might include rights for the identifier that matches the user, one or more implementation-defined identifiers matching groups that include the user, and/or the identifier anyone. How these rights get combined to decide the user's access is implementation-defined 🌀. An implementation could choose, for example, to use the union of the rights granted to the applicable identifiers. Or it could instead choose to only use the rights granted to the most specific identifier present in the ACL 🎀. A client can figure out the set of rights granted to the logged-in user for a given mailbox by using the MYRIGHTS command 🫶.

When an identifier in an ACL starts with a dash ("-"), that means the associated rights should be removed from the identifier that comes after the dash 💅. For example, if the identifier "-fred" is granted the w right, that means the w right gets removed from users matching the identifier fred 💀. Implementations don't need to support identifiers that start with a dash in ACLs 🧚.

4. Commands ⚡

4.1. SETACL 💌

Arguments:  mailbox name
            authentication identifier
            access right modification

Data:       no specific data for this command

Result:     OK - setacl completed
            NO - setacl failure: can't set acl
           BAD - command unknown or arguments invalid

The SETACL command changes the access control list on the specified mailbox so that the specified identifier gets the permissions listed in the third argument 🎀.

The third argument is a string with an optional plus ("+") or minus ("-") prefix, followed by zero or more rights characters 🦋. If the string starts with a plus, the following rights get added to any existing rights for the identifier 💖. If it starts with a minus, the following rights get removed from any existing rights for the identifier 😭. If it doesn't start with a plus or minus, the rights replace any existing rights for the identifier 🌸.

4.2. DELETEACL 🗑️

Arguments:  mailbox name
            authentication identifier

Data:       no specific data for this command

Result:     OK - deleteacl completed
            NO - deleteacl failure: can't delete acl
           BAD - command unknown or arguments invalid

The DELETEACL command removes any <identifier,rights> pair for the specified identifier from the access control list on the specified mailbox 🧹✨.

4.3. GETACL 👀

Arguments:  mailbox name

Data:       untagged responses: ACL

Result:     OK - getacl completed
            NO - getacl failure: can't get acl
           BAD - command unknown or arguments invalid

The GETACL command returns the access control list for the mailbox in an untagged ACL reply 💌.

Example:

C: A002 GETACL INBOX
S: * ACL INBOX Fred rwipslda
S: A002 OK Getacl complete

4.4. LISTRIGHTS 📋

Arguments:  mailbox name
            authentication identifier

Data:       untagged responses: LISTRIGHTS

Result:     OK - listrights completed
            NO - listrights failure: can't get rights list
           BAD - command unknown or arguments invalid

The LISTRIGHTS command takes a mailbox name and an identifier, and returns info about what rights may be granted to that identifier in the ACL for the mailbox 🔍💅.

Example:

C: a001 LISTRIGHTS ~/Mail/saved smith
S: * LISTRIGHTS ~/Mail/saved smith la r swicd
S: a001 OK Listrights completed


C: a005 LISTRIGHTS archive.imap anyone
S: * LISTRIGHTS archive.imap anyone "" l r s w i p c d a
0 1 2 3 4 5 6 7 8 9

4.5. MYRIGHTS 🪞

Arguments:  mailbox name

Data:       untagged responses: MYRIGHTS

Result:     OK - myrights completed
            NO - myrights failure: can't get rights
           BAD - command unknown or arguments invalid

The MYRIGHTS command returns the set of rights the user has on the mailbox, in an untagged MYRIGHTS reply 💖.

Example:

C: A003 MYRIGHTS INBOX
S: * MYRIGHTS INBOX rwipslda
S: A003 OK Myrights complete

5.3. MYRIGHTS 🦋

okay so MYRIGHTS is the response you get back from a MYRIGHTS command 💅 it's giving "here's what YOU can do" energy. the first string is the mailbox name the rights are for, and the second string is the set of rights the client has. ngl it's so simple it's iconic 🫶

   Data:       mailbox name
               rights

---

6. Formal Syntax ✨

okay this part is the grammar bit 🤓 we're using the augmented Backus-Naur Form (BNF) from [RFC-822] as modified by [IMAP4]. anything that isn't defined here is defined by [IMAP4], so go check there if something's missing 🧚

heads up: unless it says otherwise, alphabetic characters are case-insensitive 🎀 the upper and lower case in the token strings is just so it's easier to read. implementations MUST accept these strings in a case-insensitive fashion, no exceptions bestie 💖

   acl_data        ::= "ACL" SPACE mailbox *(SPACE identifier SPACE
                        rights)

   deleteacl       ::= "DELETEACL" SPACE mailbox SPACE identifier

   getacl          ::= "GETACL" SPACE mailbox

   identifier      ::= astring

   listrights      ::= "LISTRIGHTS" SPACE mailbox SPACE identifier

   listrights_data ::= "LISTRIGHTS" SPACE mailbox SPACE identifier
                           SPACE rights *(SPACE rights)

   mod_rights      ::= astring
                           ;; +rights to add, -rights to remove
                           ;; rights to replace

   myrights        ::= "MYRIGHTS" SPACE mailbox

   myrights_data   ::= "MYRIGHTS" SPACE mailbox SPACE rights

   rights          ::= astring

   setacl          ::= "SETACL" SPACE mailbox SPACE identifier
                       SPACE mod_rights

---

7. References 📚

   [IMAP4] Crispin, M., "Internet Message Access Protocol - Version 4",
   RFC 1730, University of Washington, December 1994.

   [RFC-822] Crocker, D., "Standard for the Format of ARPA Internet Text
   Messages", STD 11, RFC 822.

---

8. Security Considerations 🔥

this section is serious, bestie 🚨 an implementation must make sure the ACL commands themselves don't leak info about mailboxes that have properly locked-down ACLs 🙈 like, if a user doesn't have enough rights, a GETACL command on that mailbox should not even admit the mailbox exists, let alone return its ACL. no leaks, no drama 💀

---

9. Author's Address 🌸

   John G. Myers
   Carnegie-Mellon University
   5000 Forbes Ave.
   Pittsburgh PA, 15213-3890

   Email: jgm+@cmu.edu

and that's the whole RFC, we did it 🎉🌈 🫶👑