[JAMES-3209] Auth Module to make James usable with Nginx mail proxy for TLS termination

• Type: New Feature
• Status: Closed
• Priority: Major
• Resolution: Later
• Assignee: Ioan Eugen Stan
• Reporter: Ioan Eugen Stan
• Created: 10/Jun/20 12:49
• Updated: 09/Sep/21 08:40
• Resolved: 09/Sep/21 08:40

Description

Apache James needs to be deployed with TLS encryption to ensure security of emails during transport.

We could use Nginx as a mail proxy and use it for TLS termination.
However we need to implement an HTTP auth service for that to work.
This issue should cover work on making Nginx a valid mail proxy in front of Apache James.

References:

https://docs.nginx.com/nginx/admin-guide/mail-proxy/mail-proxy/
https://nginx.org/en/docs/mail/ngx_mail_auth_http_module.html#protocol

== Context

Unfortunately, Java has only the keystore for managing TLS certificates. This is makes deploying TLS certificates hard for Apache James since the internet does not use. keystore format.

We could use Nginx as a amil proxy. Nginx supports the certificate format that all other tools use. (add format here - PKCS #XXX ). People know how to setup Nginx with LetsEncrypt and benefit from free TLS certificates with automatic renewal.

However we need an integration piece: the nginx auth service. It's an http service that works only with headers. It should be simple to write and work integrate.

Issue Links

• is related to: JAMES-2330 Give ability to override AbstractConfigurableAsyncServer.buildSSLContext
• is related to: JAMES-2631 TLS 1.2 problems with Certificate Request
• is related to: JAMES-3215 Update SSL support in James
• relates to: JAMES-3206 Keystore Exception when running the "Basic" Server