PHP authentication of email users

Is imap_open is the right solution?

[milanmk]

I want to make a user control panel for all the email users of a domain and for that purpose I want to authenticate the user email address and password with the mail server.

My MTA (Mail Transfer Agent) is Exim and POP/IMAP is handled by Courier-IMAP.

I found one solution of using PHP imap_open which authenticate a mailbox using username and password.

My question is would this function be the best choice for authentication or there are any other libraries or functions that I can implement for better authentication methods.

Any help is much appreciated.

Milan

[coopster]

As one of your requirements is that the user has a valid email address on the domain I would like to believe you have chosen a proper authentication method. Outside of this, you are going to be doing some synchronization that is going to be a bear to maintain data integrity.

Have you found sources that recommend otherwise? Or are you merely seeking advice/counsel based on the task ahead of you?

[milanmk]

You got it right. Users already have a valid email address on the domain and I just need to authenticate them to grant access to user control panel.

No, I haven’t found any recommended sources yet. I got PHP imap_open simply through web search.

In the mean time I found one other option of Courier Authentication Library [courier-mta.org] but I don’t know how to integrate it with PHP. It would be nice if anyone can help me out with that, MySQL authentication module will be preferred choice.

Milan

[coopster]

Why would the MySQL authentication module be the preferred choice?

[milanmk]

Because I am already using MySQL to store all the user specific information for the control panel. So it would be easy for me to implement that module for authentication purpose.

Milan

[coopster]

Oh, I thought you said they were registered mail users for the domain and that was where you wanted to authenticate them. Sorry, my misunderstanding. I'm assuming that you are storing the userid and password in this user-specific information table then.

One way or another you are going to have to build a login page requesting userid and password. Then you begin your authentication processing. Start a session, validate the user, allow them into the area you have setup for them upon successful validation, back to the login with error messages otherwise.