Fix authentication

aiosmtpd/docs/auth.rst

@@ -14,6 +14,7 @@ Activating Authentication
 but attempts to authenticate will always be rejected
 unless the :attr:`authenticator` parameter of :class:`~aiosmtpd.smtp.SMTP`
 is set to a valid & working :ref:`authcallback`.
+The :attr:`auth_required` parameter can be set to ``True`` to reject clients that don't authenticate.
 
 
 AUTH API
@@ -146,6 +147,11 @@ Authenticator Callback
 
    .. versionadded:: 1.3
 
+.. important::
+
+   Setting an authenticator on your server or controller is not sufficient to require authentication.
+   In addition to rejecting incorrect credentials in your authenticator, you should set :attr:`auth_required` to ``True`` to reject clients that don't authenticate at all.
+
 AuthResult API
 --------------
 

examples/authenticated_relayer/server.py

@@ -30,9 +30,11 @@ def __call__(self, server, session, envelope, mechanism, auth_data):
             return fail_nothandled
         if not isinstance(auth_data, LoginPassword):
             return fail_nothandled
-        username = auth_data.login
+        try:
+            username = auth_data.login.decode('utf-8')
+        except UnicodeDecodeError:
+            return fail_nothandled
         password = auth_data.password
-        hashpass = self.ph.hash(password)
         conn = sqlite3.connect(self.auth_db)
         curs = conn.execute(
             "SELECT hashpass FROM userauth WHERE username=?", (username,)
@@ -41,7 +43,7 @@ def __call__(self, server, session, envelope, mechanism, auth_data):
         conn.close()
         if not hash_db:
             return fail_nothandled
-        if hashpass != hash_db[0]:
+        if not self.ph.verify(hash_db[0], password):
             return fail_nothandled
         return AuthResult(success=True)
 
@@ -81,12 +83,11 @@ async def amain():
         handler,
         hostname='',
         port=8025,
-        authenticator=Authenticator(DB_AUTH)
+        authenticator=Authenticator(DB_AUTH),
+        auth_required=True,
+        auth_require_tls=False,
     )
-    try:
-        cont.start()
-    finally:
-        cont.stop()
+    cont.start()
 
 
 if __name__ == '__main__':
@@ -96,7 +97,7 @@ async def amain():
     logging.basicConfig(level=logging.DEBUG)
     loop = asyncio.new_event_loop()
     asyncio.set_event_loop(loop)
-    loop.create_task(amain())
+    loop.run_until_complete(loop.create_task(amain()))
     try:
         loop.run_forever()
     except KeyboardInterrupt:

examples/basic/server.py

@@ -17,7 +17,7 @@ async def amain(loop):
     logging.basicConfig(level=logging.DEBUG)
     loop = asyncio.new_event_loop()
     asyncio.set_event_loop(loop)
-    loop.create_task(amain(loop=loop))
+    loop.run_until_complete(loop.create_task(amain(loop=loop)))
     try:
         loop.run_forever()
     except KeyboardInterrupt: