Zimbra

gfdos.sys · #1 (**permalink**) 04-07-2008, 10:41 AM

I have a really fishy problem, that I at first thought was impossible, and that I had a case of user error, but this has now been confirmed for the 3rd time!!

My Zimbra is 3.0.1 GA running on RHEL 4.
My users are all using Windows XP SP2 with IE 6, User accounts Local on the machine.

Three of my users have reported and it is verify-able:

When logging into Zimbra with THEIR ACURATE user and password, they are logged into a different users Zimbra account.

YEAH... Weird huh?

At first I thought it was a user not "logging out" of Zimbra, and the cookie doing authentication, however the users having the issue are logged into windows as DIFFERENT users, so they cant (shouldnt be able to any way) see the cookies and histories of other windows users.

I had NO idea how to search for this problem in the forums, but tried anyway.

Having found nothing in my search, I am hoping you guys can help!!!

phoenix · #2 (**permalink**) 04-07-2008, 10:50 AM

Have you tried reindexing the mailbox from the admin UI? Has this just started happening? You seriously need to upgrade your Zimbra version to a more recent release.

gfdos.sys · #3 (**permalink**) 04-07-2008, 10:55 AM

Which mailbox do I reindex? the user logging in and getting the wrong box, or the box that the user is ending up in?

Gabe

I am SERIOUSLY considering the upgrade. (we were running RedHat 7 as
the mail server before they let me go to zimbra!)

I have done a vmware convert, and done the upgrade "virtually"
to make sure everything will work.... I'm just waiting for $ from the
powers that be so I can make the transition to new hardware for really.

phoenix · #4 (**permalink**) 04-07-2008, 11:02 AM

Are these users on the same PC with different accounts? What happens if you clear the browser cache and cookies before they login, do they still get the wrong account? Try the clear cache and cookies first and then reindex the mailbox that the user is supposed to be logging in to and try again.

gfdos.sys · #5 (**permalink**) 04-08-2008, 07:21 AM

>Are these users on the same PC with different accounts?
yes

>What happens if you clear the browser cache and cookies before they login, do >they still get the wrong account?
No

>Try the clear cache and cookies first and then reindex the mailbox that the >user is supposed to be logging in to and try again.
I tried clearing the cache and it fixed the problem -- point being how did another windows users cache/cookies affect a different windows user on the pc?!

When I started having the problem multiple times I needed a fix from you -- I have 800 windows users at 35 remote sites! I cant go out to each pc and logon as every user to clear the chache and cookies.

I'm going to try reindexing the affected users.... is there a better way to reindex all users boxes?

I definately want this fixed before I go upgrading zimbra to newer versions!

Gabe

cheros · #6 (**permalink**) 04-08-2008, 07:27 AM

Quote:

Originally Posted by gfdos.sys

I definately want this fixed before I go upgrading zimbra to newer versions!

There is, of course, a high likelihood this is actually addressed in a later version. That's sort of the idea with newer versions (unless made by MS), you try to addressbug reports and move to (hopefully) improved functionality

phoenix · #7 (**permalink**) 04-08-2008, 07:32 AM

As far as I can tell from the information you've given, the clear cache and cookies fixed the problem. Is that correct? If so, you don't need to reindex the mailboxes.

I don't actually understand what you want us to fix.

Cookie management is done by IE not Zimbra, I can't remember seeing this problem before. Which version of IE do you use and do you have any service packs applied?

phoenix · #8 (**permalink**) 04-08-2008, 07:39 AM

Just for clarification, as far as I can tell none of the 'cookie' bug reports that we have relate to any situation like this.

gfdos.sys · #9 (**permalink**) 04-08-2008, 07:55 AM

I understand your coming from the point of view that IE 6 and that you think cache/cookies is the problem.... but this is a real security concern.

I plan to upgrade soon to newest version of zimbra and hopefully this wont be an issue but think about the problem we are talking about here:

A WINDOWS user can logon to a machine and access email of another zimbra user, whose cache/cookies are under a different windows user profile.

Let that sink in a bit... read it again....

I could understand if it were a different zimbra user under the same windows user profile...

But thats scary... and if it is a windows problem, zimbra should still be aware of it since it is a super big concern....

You cant CONTROL it, or determine exactly WHOSE email you are going to get into per se... but wow it could be a concern if the ceo of the company checked his email from that pc.... and someone else was in his email....

I dont want to have to say to the ceo "be careful where in the company you check your email" (although its wise that he be careful any way!!)

Just a thought.
Thank you again for your help....

Bill Brock · #10 (**permalink**) 04-08-2008, 08:02 AM

Are you possibly using any kind of proxy? I had this issue when accessing Zimbra through a proxy. I had to turn off the proxy cache to fix the issue. I don't think it was the proxy so much as IE6 and it's keep alive issue. But I'm not a programmer so don't take that to the bank.

However, once I turned off the proxy cache, which unfortunately degrades performance, I no longer suffered from the problem.