IMAP4 Login Referrals
Extracted elements (14)
A tagged OK referral response indicates the user's personal mailboxes are elsewhere but the current server has readable public mailboxes; a tagged NO referral means the server contains no mailboxes accessible to the user. After receiving either, the client cannot assume whether the move is permanent or temporary.
The IMAP URL in a referral must use `user;AUTH=*` syntax (as required by [IMAP-URL]) to avoid a client falling back to anonymous login when following the referral.
The referral mechanism is preferred over the proxy method because it allows direct client connection to the remote server, which is more bandwidth-efficient and does not require the local server to impersonate the client when authenticating to the remote server.
The LOGIN-REFERRALS extension amends the `resp_text_code` ABNF element from the base IMAP4 grammar in RFC 2060; implementations must handle the new REFERRAL token within that production.
A client MUST NOT follow more than 10 levels of referral without consulting the user.
A LOGIN-REFERRALS capable IMAP4 server SHOULD NOT return a referral to a server that will itself return a referral, to prevent referral chains.
A LOGIN-REFERRALS response code MUST contain as an argument a valid IMAP server URL as defined in [IMAP-URL].
A server MUST NOT give a login referral if authentication for that user fails, to avoid revealing information about the user's account to an unauthorized user.
IMAP4 servers that support this extension MUST list the keyword LOGIN-REFERRALS in their CAPABILITY response. No client action is needed to invoke the LOGIN-REFERRALS capability.
A home server referral consists of either a tagged NO or OK, or an untagged BYE response that contains a LOGIN-REFERRALS response code with a valid IMAP URL argument. Example: `A001 NO [REFERRAL IMAP://user;AUTH=*@SERVER2/] Remote Server`.
An IMAP4 server MAY respond to a LOGIN or AUTHENTICATE command with a home server referral (tagged NO or OK with REFERRAL response code) to direct the user to another IMAP4 server.
An IMAP4 server MAY respond with an untagged BYE and a REFERRAL response code containing an IMAP URL if it is not willing to accept connections and wishes to direct the client to another IMAP4 server.
Login referrals use IMAP URLs and inherit the security considerations of general Internet URLs (RFC 1738) and IMAP URLs [IMAP-URL]. Additionally, the LOGIN-REFERRALS capability makes it easier to write a rogue password-catching server, though the referral response itself makes detection of such intrusion easier.
The grammar element `resp_text_code` from RFC 2060 is amended to include: `resp_text_code =/ "REFERRAL" SPACE <imapurl>`, where `<imapurl>` is defined in [IMAP-URL].