RFC 8437

IMAP UNAUTHENTICATE Extension for Connection Reuse

📅 published August 2018, from ietf

IMAP UNAUTHENTICATE Extension for Connection Reuse 🦋

Internet Engineering Task Force (IETF) 💖 Okay bestie, here's the spec's whole vibe in one glance:

  • RFC number: 8437
  • Author: C. Newman, from Oracle ✨
  • Date: August 2018
  • Category: Standards Track 👑
  • ISSN: 2070-1721
  • Updates: RFC 3501 (3501), so it's giving glow-up for the base IMAP spec 🌸
  • Obsoletes: nothing is listed for this one

Abstract ✨

So this spec upgrades the Internet Message Access Protocol (IMAP) so an administrative client can reuse the same IMAP connection for multiple IMAP user identities 🎀

Status of This Memo 🧚

This one is an Internet Standards Track document, which means it's official and not just vibes 💅

It's a product of the Internet Engineering Task Force (IETF), and it represents the consensus of the IETF community. It got public review and was approved for publication by the Internet Engineering Steering Group (IESG). If you want more on Internet Standards, check Section 2 of RFC 7841 🌈

For the current status, any errata, and how to give feedback, go to https://www.rfc-editor.org/info/rfc8437 ⭐

Copyright (c) 2018 IETF Trust and the persons identified as the document authors. All rights reserved. 🫶

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents, found at https://trustee.ietf.org/license-info, as they stood on the publication date. Read these carefully, because they explain your rights and restrictions for this document. Code Components pulled out of this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they come without warranty, as described in the Simplified BSD License 🙈

Table of Contents 🌸

1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
2.  Conventions Used in This Document . . . . . . . . . . . . . .   2
3.  UNAUTHENTICATE Command  . . . . . . . . . . . . . . . . . . .   3
4.  Interactions  . . . . . . . . . . . . . . . . . . . . . . . .   4
  4.1.  Stateful Extensions . . . . . . . . . . . . . . . . . . .   4
  4.2.  Client Certificates, SASL EXTERNAL, and imaps . . . . . .   5
5.  Revised State Machine . . . . . . . . . . . . . . . . . . . .   6
6.  Formal Syntax . . . . . . . . . . . . . . . . . . . . . . . .   7
7.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .   7
8.  Security Considerations . . . . . . . . . . . . . . . . . . .   7
9.  Privacy Considerations  . . . . . . . . . . . . . . . . . . .   8
10. References  . . . . . . . . . . . . . . . . . . . . . . . . .   8
  10.1.  Normative References . . . . . . . . . . . . . . . . . .   8
  10.2.  Informative References . . . . . . . . . . . . . . . . .   9
Appendix A.  Design Considerations  . . . . . . . . . . . . . . .  11
Acknowledgements  . . . . . . . . . . . . . . . . . . . . . . . .  11
Author's Address  . . . . . . . . . . . . . . . . . . . . . . . .  11

1. Introduction 💜

Okay so modern IMAP [RFC3501] server deployments often have peer systems with administrative privilege that do stuff on behalf of IMAP end users 👑 For example, a voicemail gateway can use IMAP to store a user's voicemail and mark it as \Seen when the user listens to it through the phone interface. These systems can issue the AUTHENTICATE command with administrative credentials to act for other users. The catch is that with the IMAP base specification, these specialized clients have to close the connection and open a new one for each user 💀 For efficiency reasons, it's really desirable for them to reuse the same connection, especially if SSL has been negotiated. That's where this spec comes in, proposing the UNAUTHENTICATE command to make it happen 🦋

The IMAP state machine described in Section 3 of RFC 3501 has no transition from authenticated or selected state to not authenticated state. The UNAUTHENTICATE command adds that transition 🎀

2. Conventions Used in This Document 🧚

Here's the key word situation 🤓 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be read as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they show up in all capitals, just like here.

3. UNAUTHENTICATE Command 🌈

Here's the command's whole profile:

Arguments:  None

Responses:  No specific response for this command

Result:     OK - Completed, now in not authenticated state
            BAD - Command unknown or arguments invalid

This command tells the server to reset all connection state except for the state of the TLS [RFC8446] layer. Once it's done, the server connection is placed in not authenticated state. This is Transition 7 in the State Machine Diagram (Section 5), so it's a whole main character moment ✨

If a mailbox was selected, it stops being selected, but no expunge event gets generated 🫶 If a Simple Authentication and Security Layer (SASL) [RFC4422] was active, the server terminates its outgoing security layer right after sending the CRLF that follows the OK response. The client's outgoing security layer terminates right after the CRLF that follows the UNAUTHENTICATE command. Also note that a BAD response only happens if UNAUTHENTICATE is issued in an invalid state, isn't advertised by the server, or doesn't follow the command syntax in the specification. A NO response is not permitted 🙅‍♀️ So specification-compliant implementations will interoperate across security layer termination. Iconic behavior, honestly 😭

After sending this command, the client is free to issue a new AUTHENTICATE or LOGIN command, as permitted based on the server's capabilities. If no SASL security layer was active, the client is permitted to pipeline the UNAUTHENTICATE command with a following AUTHENTICATE command. If the IMAP server also advertises SASL-IR [RFC4959], this lets an administrative client re-authenticate in one round trip ⚡ Because of this pipelining optimization, a server advertising UNAUTHENTICATE is not permitted to answer the UNAUTHENTICATE command with a NO response if it can't reset the state associated with the connection. Servers MAY close the connection with an untagged BYE response if this preferably rare situation occurs 🌸

Servers MAY choose to advertise the UNAUTHENTICATE capability only after authentication has completed. So clients may need to issue an IMAP CAPABILITY command after authentication to find out whether UNAUTHENTICATE is available 👀

The IMAP ID [RFC2971] command gives properties about the client, mainly for use in server log or audit files. Since IMAP ID has nothing to do with application authentication or user identity, and caching it for the duration of the client connection can be useful, the interaction between IMAP ID and the UNAUTHENTICATE command is left to the implementation 🍓

4. Interactions 🎀

This section covers how this extension plays with other IMAP extensions and usage models. Interactions are everything, bestie 💅

4.1. Stateful Extensions

Okay, so the connection state for the following list of IMAP extensions MUST be reset if both a) the specified extension is advertised and b) the UNAUTHENTICATE command is advertised and used. This list may not be complete. The requirement to reset connection state applies to all current and future extensions except STARTTLS and ID. Some stateful extensions have extra rules too:

  • Cached identity information, such as group memberships, that is used to evaluate access control lists [RFC4314] MUST be reset.
  • After an UNAUTHENTICATE command is issued, CONDSTORE servers [RFC7162] MUST behave as if no CONDSTORE-enabling command was issued.
  • If IMAP COMPRESS [RFC4978] is active, the server terminates its outgoing compression layer after it sends the CRLF that follows the OK response. The client terminates its outgoing compression layer after the CRLF that follows the UNAUTHENTICATE command. When it matters, the compression layer terminates before a SASL layer terminates 🫧
  • Any extensions enabled by the IMAP ENABLE [RFC5161] command stop being enabled when the UNAUTHENTICATE command is issued. This includes, but is not limited to, CONDSTORE [RFC7162], QRESYNC [RFC7162], METADATA [RFC5464], METADATA-SERVER [RFC5464], and UTF8=ACCEPT [RFC6855] 🌈
  • A server advertising SEARCHRES [RFC5182] discards any saved search results, so that '$' subsequently represents the empty set.
  • A server advertising LANGUAGE [RFC5255] reverts to the "i-default" language.
  • When a server advertises CONTEXT=SEARCH or CONTEXT=SORT [RFC5267], the UNAUTHENTICATE command includes an implicit CANCELUPDATE for all server contexts.
  • When a server advertises NOTIFY [RFC5465], the UNAUTHENTICATE command cancels the server state related to the NOTIFY command and goes back to default IMAP base-specification behavior for notifications.

4.2. Client Certificates, SASL EXTERNAL, and imaps

When a TLS [RFC8446] security layer gets negotiated, either through the STARTTLS command or the imaps port [RFC8314], IMAP servers may be configured to request a client certificate, and IMAP clients may provide one 🔐 Client credentials at the TLS layer don't normally affect the application layer. They do matter, though, when the SASL EXTERNAL mechanism [RFC4422] is used in an IMAP AUTHENTICATE command to tell the server to use the provided client certificate to authenticate as the specified IMAP user 👑 The UNAUTHENTICATE command breaks any application-level binding of the TLS client credentials, but it does not discard the client credentials themselves. So an administrative client can use a client certificate with administrative privilege to act on behalf of multiple IMAP users on the same connection, via the EXTERNAL mechanism and the UNAUTHENTICATE command 🦋

Some server implementations on the imaps port will request and use a TLS client certificate to authenticate right away as the default IMAP identity associated with that certificate. These implementations signal this behavior with the PREAUTH greeting, as shown by Transition 2 in the State Machine Diagram (Section 5). That means TLS client certificates can't be used for administrative proxy authentication on the imaps port unless the UNAUTHENTICATE command is also advertised. When it is, an administrative client can answer the PREAUTH greeting with an UNAUTHENTICATE command and then issue an AUTHENTICATE EXTERNAL command 💖

5. Revised State Machine ✨

okay bestie, here's the new state machine 🦋 the diagram is a bit chunky, but the transitions below it tell you exactly how a connection moves around. 💖

                      +----------------------+
                      |connection established|
                      +----------------------+
                                 ||
                                 \/
               +--------------------------------------+
               |          server greeting             |
               +--------------------------------------+
                         || (1)       || (2)        || (3)
                         \/           ||            ||
               +-----------------+    ||            ||
               |Not Authenticated|<===||=========++ ||
               +-----------------+    ||     (7) || ||
                || (8)   || (4)       ||         || ||
                ||       \/           \/         || ||
                ||     +----------------+        || ||
                ||     |                |========++ ||
                ||     | Authenticated  |<=++    || ||
                ||     +----------------+  ||    || ||
                ||       || (8)   || (5)   ||(6) || ||
                ||       ||       \/       ||    || ||
                ||       ||    +--------+  ||    || ||
                ||       ||    |Selected|==++    || ||
                ||       ||    |        |========++ ||
                ||       ||    +--------+           ||
                ||       ||       || (8)            ||
                \/       \/       \/                \/
               +--------------------------------------+
               |               Logout                 |
               +--------------------------------------+
                                 ||
                                 \/
                   +-------------------------------+
                   |both sides close the connection|
                   +-------------------------------+

Here are the revised IMAP state machine transitions 🌸 (the numbers match the diagram):

  1. Connection without pre-authentication (OK greeting) 🌈
  2. Pre-authenticated connection (PREAUTH greeting) 🧚
  3. Rejected connection (BYE greeting) 💀
  4. Successful LOGIN or AUTHENTICATE command 🔥
  5. Successful SELECT or EXAMINE command ✨
  6. CLOSE, UNSELECT [RFC3691], or failed SELECT or EXAMINE command 🙈
  7. UNAUTHENTICATE command 🦋
  8. LOGOUT command, server shutdown, or connection closed 👑

6. Formal Syntax 💅

The following syntax specification uses the Augmented Backus-Naur Form (ABNF), as described in [RFC5234]. Amended terms are defined in [RFC3501]. 🫶

  capability     =/ "UNAUTHENTICATE"

  command-auth   =/ "UNAUTHENTICATE"

  command-select =/ "UNAUTHENTICATE"

7. IANA Considerations 🎀

IANA has added the UNAUTHENTICATE capability to the "IMAP Capabilities" registry. Literally the cutest little registry update 💜

8. Security Considerations 🔥

okay this section is SERIOUS, bestie, so read it properly 😭

The original IMAP state machine was designed to allow a server-implementation approach in which each IMAP authentication identity matches an operating system identity, and the server revokes all administrative privilege once authentication completes. This extension is not compatible with that implementation approach. However, that approach has significant performance costs on Unix systems, and this extension is designed for environments where efficiency is a relatively high-priority deployment goal. So this extension is appropriate for some deployments but may not be appropriate for the most security-sensitive environments. ⚠️

IMAP server implementations are complicated and can retain a lot of state related to an authenticated user. Server implementers need to take care to reset all server state, so that authentication as a subsequent user does not inherit any data or privileges from the previous user. State data associated with a user can include cached identity information such as group membership used to evaluate access control lists [RFC4314], active notifications [RFC5465], access to per-user data such as flags, etc. 🧠

IMAP server systems are often deployed in a two-tier model, where a server-side IMAP proxy routes to an IMAP backend that handles all connections for a subset of possible users. Some IMAP proxies enter a pass-through mode after authentication. If enabled, the UNAUTHENTICATE command would allow a client, on a subsequent authentication, to bypass any security restrictions present in the proxy layer but not in the backend server layer. 😳 As a result, IMAP server implementations of this extension MUST provide a way to disable it when it is not needed. Use of an IMAP proxy that processes the UNAUTHENTICATE command at the proxy layer eliminates this concern. Another option to mitigate this concern is for servers to only enable the UNAUTHENTICATE extension if the supplied authentication credentials are associated with an administrative identity. 🔒

9. Privacy Considerations 🦋

For the most part, this extension will have no impact on the privacy considerations already present in an IMAP implementation. However, if this extension were used between data centers, it could improve end-user privacy by increasing the difficultly of traffic analysis due to connection reuse. 🌈

10. References 📚

10.1. Normative References

10.2. Informative References

Appendix A. Design Considerations 🧩

The author deliberately chose to add a separate UNAUTHENTICATE command, instead of allowing the LOGIN or AUTHENTICATE commands to be issued when the connection is in a state other than unauthenticated. The primary reason is that the code that transitions from the not authenticated state to the authenticated state in a server is often the most security-sensitive code, because it needs to assume and handle unconditionally hostile attackers. That sensitive code is simpler if it only handles a single server state (unauthenticated), and the state transition is as simple as possible. Smaller and simpler code is easier to audit and write in a secure way. 🔐

A secondary reason to have a separate command is that it is simpler to enable or disable the feature with that design. See the discussion in the Security Considerations section recommending that implementations provide a way to disable this extension. 💅

Acknowledgements 🫶

Thanks to Fred Batty for implementing UNAUTHENTICATE, and to Cyrus Daboo for constructive suggestions to improve this document. You two are absolutely iconic 👑🌸

Author's Address 🖋️

Chris Newman
Oracle
440 E. Huntington Dr., Suite 400
Arcadia, CA  91006
United States of America

Email: chris.newman@oracle.com
📦 where this page comes from