[ews] Two EWS/NTLM accounts on the same server URL: second account shows the first account's mailbox and folders
Categories
(MailNews Core :: Networking: Exchange, defect)
Tracking
(Not tracked)
People
(Reporter: sebastien, Unassigned)
Details
User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:156.0) Gecko/20100101 Firefox/156.0
Steps to reproduce
Environment:
- Thunderbird 156.0.1 on Linux
- Hosted Exchange (OVH), EWS URL: https://ex5.mail.ovh.net/EWS/Exchange.asmx
- Authentication method: NTLM (Basic / "Normal password" is rejected by the server for EWS)
Steps to reproduce:
- Add a first Exchange account using EWS:
- EWS URL: https://ex5.mail.ovh.net/EWS/Exchange.asmx
- Email/username: user-A@domain-A.example
- Authentication: NTLM
- Add a second Exchange account in the same profile, same EWS URL:
- Email/username: user-B@domain-B.example
- Authentication: NTLM
- Let both accounts sync.
Actual results
The second account displays the folders and messages of the first account's mailbox. The second mailbox's real content never appears.
Expected results
Each account should display its own mailbox. Requests made for account B should be authenticated as user B.
Additional notes:
- Both accounts use different usernames and passwords.
- Suspected cause: NTLM authenticates the HTTP connection, not each request. Since both accounts target the exact same host, the connection already authenticated as user A seems to be reused for account B's requests, so the server returns user A's mailbox.
- Workarounds that work: using a separate Thunderbird profile for the second account, or configuring one of the accounts over IMAP instead of EWS.
(In reply to sebastien from comment #0)
User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:156.0) Gecko/20100101 Firefox/156.0
Steps to reproduce
Environment:
- Thunderbird 156.0.1 on Linux
- Hosted Exchange (OVH), EWS URL: https://ex5.mail.ovh.net/EWS/Exchange.asmx
- Authentication method: NTLM (Basic / "Normal password" is rejected by the server for EWS)
Steps to reproduce:
- Add a first Exchange account using EWS:
- EWS URL: https://ex5.mail.ovh.net/EWS/Exchange.asmx
- Email/username: user-A@domain-A.example
- Authentication: NTLM
- Add a second Exchange account in the same profile, same EWS URL:
- Email/username: user-B@domain-B.example
- Authentication: NTLM
- Let both accounts sync.
Actual results
The second account displays the folders and messages of the first account's mailbox. The second mailbox's real content never appears.
Expected results
Each account should display its own mailbox. Requests made for account B should be authenticated as user B.
Additional notes:
- Both accounts use different usernames and passwords.
- Suspected cause: NTLM authenticates the HTTP connection, not each request. Since both accounts target the exact same host, the connection already authenticated as user A seems to be reused for account B's requests, so the server returns user A's mailbox.
|
||
Comment 2•1 month ago
|
||
Sounds like bug 2073250
Description
•