<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Hello,<br>
<br>
Aren't you missing the folowwing ACLs? (since cyrus 2.3 at least)<br>
<br>
k: The ACI subject has the right to <tt class="docutils literal"><span
class="pre">CREATE</span></tt> a new folder if the
<a class="reference internal"
href="http://www.cyrusimap.org/%7Evanmeeuwen/imap/admin/access-control/rights-reference.html#imap-admin-access-control-right-k"><em>k</em></a>
right exists on the parent
folder of the folder to be created.<br>
x: Use the <a class="reference internal"
href="http://www.cyrusimap.org/%7Evanmeeuwen/imap/admin/access-control/rights-reference.html#imap-admin-access-control-right-x"><em>x</em></a>
right to indicate
the ACI subject has the right to <tt class="docutils literal"><span
class="pre">DELETE</span></tt> the folder on which the
ACL is set, as opposed to the now obsolete
<a class="reference internal"
href="http://www.cyrusimap.org/%7Evanmeeuwen/imap/admin/access-control/rights-reference.html#imap-admin-access-control-right-c"><em>c</em></a>
right or
<a class="reference internal"
href="http://www.cyrusimap.org/%7Evanmeeuwen/imap/admin/access-control/rights-reference.html#imap-admin-access-control-right-d"><em>d</em></a>
right.<br>
t: The ACI subject is allowed to delete messages from this folder,
meaning that the ACI subject is allowed to flag messages as
<tt class="docutils literal"><span class="pre">\\Deleted</span></tt>.<br>
e: The ACI subject is allowed to expunge messages in this folder,
meaning the ACI subject has the right to remove all messages that
have been flagged as <tt class="docutils literal"><span class="pre">\\Deleted</span></tt>
from all visibility.<br>
<br>
localhost> lam user.mpellieux<br>
mpellieux lrswip<b>kxte</b>cda<br>
cyrus kxca<br>
anyone p<br>
<br>
Ps: I had a class with you in 2005 (first ISRAD prom)<br>
<br>
Regards,<br>
<br>
<div class="moz-cite-prefix">On 06/06/2016 15:49, Jean Charles
Delépine via Info-cyrus wrote:<br>
</div>
<blockquote cite="mid:20160606134921.GA20275@u-picardie.fr"
type="cite">
<pre wrap="">Hello,
I'm on the way to make a big (late) upgrade.
My murder config is composed of 16 1To backends. I can't upgrade
all of them simultaneously. So I planed to :
- upgrade mupdate server (make a new one, and update frontend's and
backend's conf)
- replace frontends with upgraded one's
- upgrade backends one after the other, nightly, on serveral night
mupdate server upgrade is ok. But I have problems with 2.5 frontends and 2.2
backends interaction. All seems fine (no error), but users can't create new sub
mailboxes (admin can create mailboxes and sub mailboxes) :
loggued as mailbox owner :
imap-01> lam INBOX
delepine lrswipcda
anyone p
imap-01> cm INBOX.hop
createmailbox: Permission denied
My tests say that, whichever mupdate server version :
Frontend 2.2 can create 2.2 mailboxes and 2.5 mailboxes
Frontend 2.5 can't create 2.2 mailboxes but can create 2.5 mailboxes
All others tested features work.
The 2.2 is using saslauthd + pam_ldap for authentification. The 2.5 is using either
ldapdb or saslauthd + ptoader and ldap.
With or without
suppress_capabilities: ESEARCH QRESYNC XLIST LIST-EXTENDED WITHIN
on 2.5 frontends.
2 questions :
- do you have an idea why users can't create submailboxes on 2.2
backends with 2.5 frontends ? Is there any acl new option I
miss ? ...
- what are the risks if I wait for all backends to migrate before
using 2.5 frontends ? My option with this problem. I didn't find
any problem... but surely, if there's one, my users will find it.
Options that might be relevant :
On backends :
proxyservers: proxy
proxy_authname: proxy
On frontends:
proxy_authname: proxy
proxy_password: <>
proxyd_allow_status_referral: 0
proxyd_disable_mailbox_referrals: 1
backends are in an internal non routable network.
Sincerly,
Jean Charles Delépine
----
Cyrus Home Page: <a class="moz-txt-link-freetext" href="http://www.cyrusimap.org/">http://www.cyrusimap.org/</a>
List Archives/Info: <a class="moz-txt-link-freetext" href="http://lists.andrew.cmu.edu/pipermail/info-cyrus/">http://lists.andrew.cmu.edu/pipermail/info-cyrus/</a>
To Unsubscribe:
<a class="moz-txt-link-freetext" href="https://lists.andrew.cmu.edu/mailman/listinfo/info-cyrus">https://lists.andrew.cmu.edu/mailman/listinfo/info-cyrus</a></pre>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
Mathieu Pellieux <a class="moz-txt-link-rfc2396E" href="mailto:mpellieux@karavel.com"><mpellieux@karavel.com></a>
Administrateur Systèmes
sysadmin <a class="moz-txt-link-rfc2396E" href="mailto:sysadmin@karavel.com"><sysadmin@karavel.com></a>
01.73.02.75.01
</pre>
</body>
</html>