301381 - POP3: Get Message with invalid password manager remembered username+password cycles 6 times through 2 alert dialogs

Status: RESOLVED WORKSFORME

(MailNews Core :: Networking: POP, defect)

Description

[Serge Gautherie (:sgautherie)]

[Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b3) Gecko/20050714 SeaMonkey/1.0a]
(nightly) (W98SE)

1. Setup a POP3 account to |pop.coltfrance.com| with wrong username + password
2. Select (Secure Connection = Never), Secure authentification = Enabled.
3. Get Msgs, avec ask P.M. to remember the (wrong) password.

Get Msgs cycles 6 times through 2 alerts:
1 = Mail server does not support S.A. or incorrect password ... Mail server
p.c.c. responded: authorization first
2 = Sending of password did not succeed. Mail server p.c.c. responded:
authorization first

Various complains would be:
*Why 2 dialogs ?
*Why 6 times ?
*Why did P.M. save a _never-successful_ UN+P couple ?
 (I asked it to remember, but that is before/while the first connection attempt)

Comment 1

[Serge Gautherie (:sgautherie)]

[Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b) Gecko/20050217] (<-- 1.8b1 !)
(W98SE)

Already ("improved" :->) as SMv1.0a.

[Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.7.8) Gecko/20050511] (release) (W98SE)

Was worse: seems to cycle endlessly, unless Esc is pressed between dialogs to
stop it.

Comment 2

[Lewis Rosenthal]

Serge, are you still seeing this? I have not noticed it. If this has been resolved, the status should be changed. Otherwise, some more feedback might be in order.

Lewis

Comment 3

[Serge Gautherie (:sgautherie)]

[Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.7.13) Gecko/20060414] (release) (W98SE)
[Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8.0.4) Gecko/20060516 SeaMonkey/1.0.2] (release) (W98SE)
[Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8.1a3) Gecko/20060603 SeaMonkey/1.1a] (nightly) (W98SE)
[Mozilla Thunderbird, version 2 alpha 1 (20060604)] (nightly) (W98SE)

Per comment 0 steps,
I still get the two dialogs, up to MOZILLA_1_8_BRANCH:
once without the remember option, twice with it,
in both SeaMonkey and Thunderbird.

(I can't test recent Trunk builds anymore.)

Comment 4

[Lewis Rosenthal]

Serge, you don't happen to know what mail server software is in use at COLT, do you? I can reproduce this, but I'm not entirely sure it's a SeaMonkey MailNews *bug* (vs server oddity). This doesn't mean that we shouldn't try to deal with it better, as long as the server is indeed adhering to the standard.

Here's what I get:

Essentially, I used the same setup you describe (I do not have an account with them, so no matter what account I would use, my login would fail). I did indeed observe what you describe under SeaMonkey 1.5a (20060531; Win32 - W2K), 1.0 release (Win32), Thunderbird 1.6a1 (20051112; Win32 - W2K), and SeaMonkey 1.5a (20060531 OS/2).

It appears that MailNews attempts to log in a second time when the first attempt fails. This would explain the two sets of dialog boxes. Interestingly, when attempting this against my own server running CommuniGate Pro (which does support SASL), I get something closer to what you describe in comment 1. However, my server responds (appropriately): incorrect user or account name, instead of authorization first.

So, we may be dealing with two different issues, either of which may be related to an unexpected response from the server.

I was flipping through some of the code at http://lxr.mozilla.org/seamonkey/source/extensions/auth/nsAuthSASL.cpp which might hold a clue as to what is going on, though I can't be sure (as I don't hack nearly enough cpp to get my head wrapped around this. However, I'll do some more research, and if you can attempt to find out what server software they are using, this may help shed some more light on what's happening.

Thanks for the report.

Lewis

Comment 5

[Lewis Rosenthal]

Some reference, for anyone else who may be tracking this bug (and apologies or the bugspam):

RFC 2222 defines SASL (Simple Authentication and Security Layer). Mozilla software employs the use of SASLGSSAPI, and the relevant portion of RFC 2222 as it pertains to the negotiation between client and server is to be found under section 7.2.

Lewis

Comment 6

[Lewis Rosenthal]

Attachment: POP3 log from SeaMonkey illustrating SASL loop caused by incorrect credentials

The attached log snippet was generated by setting the following at the command line before running SM:

set NSPR_LOG_MODULES=POP3:4
set NSPR_LOG_FILE={filename}

In this case, where the server is CommuniGate Pro, the credentials are incorrect (both wrong username & password), and the POP3 server settings are for No TLS or SSL but to use SASL, the (failing) login process loops ad infinitum.

Comment 7

[Lewis Rosenthal]

Attachment: POP3 log from Thunderbird illustrating SASL loop (2x) caused by incorrect credentials

This one was also created by setting NSPR_LOG_MODULES=POP3:4. Note that in this case, the loop takes place twice only, and then a new password prompt is presented to the user (I went through two complete loops before canceling to create the attached log).

Comment 8

[Serge Gautherie (:sgautherie)]

(I've asked them what their POP3 server is...).

Comment 9

[Wayne Mery (:wsmwk)]

Serge, still reproducible with v3?

Comment 10

[Wayne Mery (:wsmwk)]

Gene, Danny,
I think we had fixed this?

Comment 11

[Dan Pernokis]

Sorry, I've only been with Thunderbird for 14 years -- this one predates me!

Comment 12

[gene smith]

Wayne, this doesn't ring a bell.
Maybe you are thinking of "[Bug 1862111] [IMAP] too many login attempts using the old password"
that I've been meaning to work on for a while.

Comment 13

[Wayne Mery (:wsmwk)]

This should be WFM