From 401b744808ff127b625001d8512d80d108d58a6a Mon Sep 17 00:00:00 2001 From: FreddleSpl0it Date: Thu, 8 May 2025 11:38:29 +0200 Subject: [PATCH] [Dovecot] return PASSDB_RESULT_PASSWORD_MISMATCH instead of PASSDB_RESULT_INTERNAL_FAILURE --- data/conf/dovecot/auth/passwd-verify.lua | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/data/conf/dovecot/auth/passwd-verify.lua b/data/conf/dovecot/auth/passwd-verify.lua index b8843c996..ea847932d 100644 --- a/data/conf/dovecot/auth/passwd-verify.lua +++ b/data/conf/dovecot/auth/passwd-verify.lua @@ -29,9 +29,12 @@ function auth_password_verify(request, password) insecure = true } + -- Returning PASSDB_RESULT_PASSWORD_MISMATCH will reset the user's auth cache entry. + -- Returning PASSDB_RESULT_INTERNAL_FAILURE keeps the existing cache entry, + -- even if the TTL has expired. Useful to avoid cache eviction during backend issues. if c ~= 200 and c ~= 401 then dovecot.i_info("HTTP request failed with " .. c .. " for user " .. request.user) - return dovecot.auth.PASSDB_RESULT_INTERNAL_FAILURE, "Upstream error" + return dovecot.auth.PASSDB_RESULT_PASSWORD_MISMATCH, "Upstream error" end local response_str = table.concat(res) @@ -39,7 +42,7 @@ function auth_password_verify(request, password) if not is_response_valid then dovecot.i_info("Invalid JSON received: " .. response_str) - return dovecot.auth.PASSDB_RESULT_INTERNAL_FAILURE, "Invalid response format" + return dovecot.auth.PASSDB_RESULT_PASSWORD_MISMATCH, "Invalid response format" end if response_json.success == true then