ZCS-19497: Add IRopcCredCache with Guava cache and SSHA512 hashing for non-EAS protocol credential caching by sonali033 · Pull Request #1850 · Zimbra/zm-mailbox

sonali033 · 2026-07-09T14:41:44Z

ZCS-19497: Add Guava credential cache for IRopc non-EAS protocols

Introduced IRopcCredCache with SSHA512 hashing (aligned with EAS PassCache)
TTL: 1hr, max size: 10000, configurable via named constants
Integrated cache lookup and store in IRopcCustomAuth
Cache skipped for zsync protocol (EAS uses its own PassCache)

github-actions

Remaining comments which cannot be posted as a review comment to avoid GitHub Rate Limit

checkstyle

🚫 [checkstyle] <com.puppycrawl.tools.checkstyle.checks.javadoc.JavadocMethodCheck> _{reported by reviewdog 🐶}
Expected @PARAM tag for 'ip'.

zm-mailbox/store/src/java/com/zimbra/cs/account/auth/ropc/IRopcCredCache.java

Line 90 in 0902f3d

String ip, String deviceId) {

🚫 [checkstyle] <com.puppycrawl.tools.checkstyle.checks.javadoc.JavadocMethodCheck> _{reported by reviewdog 🐶}
Expected @PARAM tag for 'deviceId'.

zm-mailbox/store/src/java/com/zimbra/cs/account/auth/ropc/IRopcCredCache.java

Line 90 in 0902f3d

String ip, String deviceId) {

🚫 [checkstyle] <com.puppycrawl.tools.checkstyle.checks.blocks.NeedBracesCheck> _{reported by reviewdog 🐶}
'if' construct must use '{}'s.

zm-mailbox/store/src/java/com/zimbra/cs/account/auth/ropc/IRopcCredCache.java

Line 91 in 0902f3d

if (email == null || password == null)

🚫 [checkstyle] <com.puppycrawl.tools.checkstyle.checks.javadoc.JavadocMethodCheck> _{reported by reviewdog 🐶}
Expected @PARAM tag for 'email'.

zm-mailbox/store/src/java/com/zimbra/cs/account/auth/ropc/IRopcCredCache.java

Line 120 in 0902f3d

    
           public static void invalidate(String email, String userAgent, String protocol, String provider, String ip,

🚫 [checkstyle] <com.puppycrawl.tools.checkstyle.checks.javadoc.JavadocMethodCheck> _{reported by reviewdog 🐶}
Expected @PARAM tag for 'userAgent'.

zm-mailbox/store/src/java/com/zimbra/cs/account/auth/ropc/IRopcCredCache.java

Line 120 in 0902f3d

    
           public static void invalidate(String email, String userAgent, String protocol, String provider, String ip,

🚫 [checkstyle] <com.puppycrawl.tools.checkstyle.checks.javadoc.JavadocMethodCheck> _{reported by reviewdog 🐶}
Expected @PARAM tag for 'protocol'.

zm-mailbox/store/src/java/com/zimbra/cs/account/auth/ropc/IRopcCredCache.java

Line 120 in 0902f3d

    
           public static void invalidate(String email, String userAgent, String protocol, String provider, String ip,

🚫 [checkstyle] <com.puppycrawl.tools.checkstyle.checks.javadoc.JavadocMethodCheck> _{reported by reviewdog 🐶}
Expected @PARAM tag for 'provider'.

zm-mailbox/store/src/java/com/zimbra/cs/account/auth/ropc/IRopcCredCache.java

Line 120 in 0902f3d

    
           public static void invalidate(String email, String userAgent, String protocol, String provider, String ip,

🚫 [checkstyle] <com.puppycrawl.tools.checkstyle.checks.javadoc.JavadocMethodCheck> _{reported by reviewdog 🐶}
Expected @PARAM tag for 'ip'.

zm-mailbox/store/src/java/com/zimbra/cs/account/auth/ropc/IRopcCredCache.java

Line 120 in 0902f3d

    
           public static void invalidate(String email, String userAgent, String protocol, String provider, String ip,

🚫 [checkstyle] <com.puppycrawl.tools.checkstyle.checks.javadoc.JavadocMethodCheck> _{reported by reviewdog 🐶}
Expected @PARAM tag for 'deviceId'.

zm-mailbox/store/src/java/com/zimbra/cs/account/auth/ropc/IRopcCredCache.java

Line 121 in 0902f3d

String deviceId) {

🚫 [checkstyle] <com.puppycrawl.tools.checkstyle.checks.blocks.NeedBracesCheck> _{reported by reviewdog 🐶}
'if' construct must use '{}'s.

zm-mailbox/store/src/java/com/zimbra/cs/account/auth/ropc/IRopcCredCache.java

Line 122 in 0902f3d

if (email == null)

🚫 [checkstyle] <com.puppycrawl.tools.checkstyle.checks.javadoc.JavadocMethodCheck> _{reported by reviewdog 🐶}
Expected @PARAM tag for 'email'.

zm-mailbox/store/src/java/com/zimbra/cs/account/auth/ropc/IRopcCredCache.java

Line 140 in 0902f3d

    
           public static void storeRejection(String email, String userAgent, String protocol, String provider, String ip,

🚫 [checkstyle] <com.puppycrawl.tools.checkstyle.checks.javadoc.JavadocMethodCheck> _{reported by reviewdog 🐶}
Expected @PARAM tag for 'userAgent'.

zm-mailbox/store/src/java/com/zimbra/cs/account/auth/ropc/IRopcCredCache.java

Line 140 in 0902f3d

    
           public static void storeRejection(String email, String userAgent, String protocol, String provider, String ip,

🚫 [checkstyle] <com.puppycrawl.tools.checkstyle.checks.javadoc.JavadocMethodCheck> _{reported by reviewdog 🐶}
Expected @PARAM tag for 'protocol'.

zm-mailbox/store/src/java/com/zimbra/cs/account/auth/ropc/IRopcCredCache.java

Line 140 in 0902f3d

    
           public static void storeRejection(String email, String userAgent, String protocol, String provider, String ip,

🚫 [checkstyle] <com.puppycrawl.tools.checkstyle.checks.javadoc.JavadocMethodCheck> _{reported by reviewdog 🐶}
Expected @PARAM tag for 'provider'.

zm-mailbox/store/src/java/com/zimbra/cs/account/auth/ropc/IRopcCredCache.java

Line 140 in 0902f3d

    
           public static void storeRejection(String email, String userAgent, String protocol, String provider, String ip,

🚫 [checkstyle] <com.puppycrawl.tools.checkstyle.checks.javadoc.JavadocMethodCheck> _{reported by reviewdog 🐶}
Expected @PARAM tag for 'ip'.

zm-mailbox/store/src/java/com/zimbra/cs/account/auth/ropc/IRopcCredCache.java

Line 140 in 0902f3d

    
           public static void storeRejection(String email, String userAgent, String protocol, String provider, String ip,

🚫 [checkstyle] <com.puppycrawl.tools.checkstyle.checks.javadoc.JavadocMethodCheck> _{reported by reviewdog 🐶}
Expected @PARAM tag for 'deviceId'.

zm-mailbox/store/src/java/com/zimbra/cs/account/auth/ropc/IRopcCredCache.java

Line 141 in 0902f3d

String deviceId) {

🚫 [checkstyle] <com.puppycrawl.tools.checkstyle.checks.blocks.NeedBracesCheck> _{reported by reviewdog 🐶}
'if' construct must use '{}'s.

zm-mailbox/store/src/java/com/zimbra/cs/account/auth/ropc/IRopcCredCache.java

Line 142 in 0902f3d

if (email == null) return;

🚫 [checkstyle] <com.puppycrawl.tools.checkstyle.checks.javadoc.JavadocMethodCheck> _{reported by reviewdog 🐶}
Expected @PARAM tag for 'email'.

zm-mailbox/store/src/java/com/zimbra/cs/account/auth/ropc/IRopcCredCache.java

Line 161 in 0902f3d

    
           public static void checkRejectionLimit(String email, String userAgent, String protocol, String provider, String ip,

🚫 [checkstyle] <com.puppycrawl.tools.checkstyle.checks.javadoc.JavadocMethodCheck> _{reported by reviewdog 🐶}
Expected @PARAM tag for 'userAgent'.

zm-mailbox/store/src/java/com/zimbra/cs/account/auth/ropc/IRopcCredCache.java

Line 161 in 0902f3d

    
           public static void checkRejectionLimit(String email, String userAgent, String protocol, String provider, String ip,

🚫 [checkstyle] <com.puppycrawl.tools.checkstyle.checks.javadoc.JavadocMethodCheck> _{reported by reviewdog 🐶}
Expected @PARAM tag for 'protocol'.

zm-mailbox/store/src/java/com/zimbra/cs/account/auth/ropc/IRopcCredCache.java

Line 161 in 0902f3d

    
           public static void checkRejectionLimit(String email, String userAgent, String protocol, String provider, String ip,

🚫 [checkstyle] <com.puppycrawl.tools.checkstyle.checks.javadoc.JavadocMethodCheck> _{reported by reviewdog 🐶}
Expected @PARAM tag for 'provider'.

zm-mailbox/store/src/java/com/zimbra/cs/account/auth/ropc/IRopcCredCache.java

Line 161 in 0902f3d

    
           public static void checkRejectionLimit(String email, String userAgent, String protocol, String provider, String ip,

🚫 [checkstyle] <com.puppycrawl.tools.checkstyle.checks.javadoc.JavadocMethodCheck> _{reported by reviewdog 🐶}
Expected @PARAM tag for 'ip'.

zm-mailbox/store/src/java/com/zimbra/cs/account/auth/ropc/IRopcCredCache.java

Line 161 in 0902f3d

    
           public static void checkRejectionLimit(String email, String userAgent, String protocol, String provider, String ip,

🚫 [checkstyle] <com.puppycrawl.tools.checkstyle.checks.javadoc.JavadocMethodCheck> _{reported by reviewdog 🐶}
Expected @PARAM tag for 'deviceId'.

zm-mailbox/store/src/java/com/zimbra/cs/account/auth/ropc/IRopcCredCache.java

Line 162 in 0902f3d

String deviceId) throws AuthFailedServiceException {

🚫 [checkstyle] <com.puppycrawl.tools.checkstyle.checks.blocks.NeedBracesCheck> _{reported by reviewdog 🐶}
'if' construct must use '{}'s.

zm-mailbox/store/src/java/com/zimbra/cs/account/auth/ropc/IRopcCredCache.java

Line 163 in 0902f3d

if (email == null) return;

🚫 [checkstyle] <com.puppycrawl.tools.checkstyle.checks.regexp.RegexpSinglelineJavaCheck> _{reported by reviewdog 🐶}
Line exceeds 120 characters in comments

zm-mailbox/store/src/java/com/zimbra/cs/account/auth/ropc/IRopcCredCache.java

Line 169 in 0902f3d

    
           ZimbraLog.account.warn("IRopcCredCache: auth blocked for %s; push rejection limit reached (%d)", email, count);

🚫 [checkstyle] <com.puppycrawl.tools.checkstyle.checks.sizes.LineLengthCheck> _{reported by reviewdog 🐶}
Line is longer than 120 characters (found 127).

zm-mailbox/store/src/java/com/zimbra/cs/account/auth/ropc/IRopcCredCache.java

Line 169 in 0902f3d

    
           ZimbraLog.account.warn("IRopcCredCache: auth blocked for %s; push rejection limit reached (%d)", email, count);

🚫 [checkstyle] <com.puppycrawl.tools.checkstyle.checks.blocks.NeedBracesCheck> _{reported by reviewdog 🐶}
'if' construct must use '{}'s.

zm-mailbox/store/src/java/com/zimbra/cs/account/auth/ropc/IRopcCredCache.java

Line 181 in 0902f3d

if (storedHash == null)

github-actions

Remaining comments which cannot be posted as a review comment to avoid GitHub Rate Limit

checkstyle

🚫 [checkstyle] <com.puppycrawl.tools.checkstyle.checks.blocks.NeedBracesCheck> _{reported by reviewdog 🐶}
'if' construct must use '{}'s.

zm-mailbox/store/src/java/com/zimbra/cs/account/auth/ropc/IRopcCredCache.java

Line 173 in c54a91f

if (email == null) return;

🚫 [checkstyle] <com.puppycrawl.tools.checkstyle.checks.regexp.RegexpSinglelineJavaCheck> _{reported by reviewdog 🐶}
Line exceeds 120 characters in comments

zm-mailbox/store/src/java/com/zimbra/cs/account/auth/ropc/IRopcCredCache.java

Line 179 in c54a91f

    
           ZimbraLog.account.warn("IRopcCredCache: auth blocked for %s; push rejection limit reached (%d)", email, count);

🚫 [checkstyle] <com.puppycrawl.tools.checkstyle.checks.sizes.LineLengthCheck> _{reported by reviewdog 🐶}
Line is longer than 120 characters (found 127).

zm-mailbox/store/src/java/com/zimbra/cs/account/auth/ropc/IRopcCredCache.java

Line 179 in c54a91f

    
           ZimbraLog.account.warn("IRopcCredCache: auth blocked for %s; push rejection limit reached (%d)", email, count);

🚫 [checkstyle] <com.puppycrawl.tools.checkstyle.checks.blocks.NeedBracesCheck> _{reported by reviewdog 🐶}
'if' construct must use '{}'s.

zm-mailbox/store/src/java/com/zimbra/cs/account/auth/ropc/IRopcCredCache.java

Line 191 in c54a91f

if (storedHash == null)

github-actions · 2026-07-30T11:28:30Z

+import com.zimbra.cs.account.auth.PasswordUtil.SSHA512;
+import java.util.concurrent.TimeUnit;
+
+import static com.zimbra.cs.account.auth.ropc.IRopcConstants.TTL_MS;


🚫 [checkstyle] <com.puppycrawl.tools.checkstyle.checks.imports.ImportOrderCheck> _{reported by reviewdog 🐶}
Extra separation in import group before 'com.zimbra.cs.account.auth.ropc.IRopcConstants.TTL_MS'

dasiyogesh · 2026-07-30T11:38:21Z

+        String effectivePassword = getEffectivePassword(password);
+        String key = buildKey(email, userAgent, protocol, provider, ip, deviceId);
+
+        // Store the successful credential


comments to start with lower case here and below

ashwinsahu19 · 2026-07-30T12:09:31Z

+                user, protocolStr, userAgent, deviceId, ipAddress, provider);
+
+        // Implementation of the cache check using composite keys
+        if (useCustomCache) {


This check is not required , as this flow works only if custom auth is idp ropc.

ashwinsahu19 · 2026-07-30T12:13:43Z

+        CRED_CACHE.put(key, entry);
+
+        // Store IP bridge when deviceId is present
+        // Enables OPCC to real deviceId upgrade in isValid()


github-actions · 2026-07-31T06:37:07Z

            default:
                throw ServiceException.FAILURE("Authentication service temporarily unavailable.", null);
        }
+        long expires_in = 3600000L;


🚫 [checkstyle] <com.puppycrawl.tools.checkstyle.checks.naming.LocalVariableNameCheck> _{reported by reviewdog 🐶}
Name 'expires_in' must match pattern '^[a-z][a-zA-Z0-9]*$'.

github-actions · 2026-07-31T06:37:07Z

+     */
+    private static final class CacheEntry {
+
+        final String hash;


🚫 [checkstyle] <com.puppycrawl.tools.checkstyle.checks.design.VisibilityModifierCheck> _{reported by reviewdog 🐶}
Variable 'hash' must be private and have accessor methods.

github-actions · 2026-07-31T06:37:07Z

+         * absolute wall-clock timestamp (ms) after which this entry is considered expired.
+         * computed as: System.currentTimeMillis() + (expiresInSeconds * 1000)
+         */
+        final long expiryTimestamp;


🚫 [checkstyle] <com.puppycrawl.tools.checkstyle.checks.design.VisibilityModifierCheck> _{reported by reviewdog 🐶}
Variable 'expiryTimestamp' must be private and have accessor methods.

github-actions · 2026-07-31T06:51:38Z

+    /**
+     * validates entry against password. Immediately invalidates expired entries.
+     */
+    private static boolean isMatch(CacheEntry entry, String key, String password) {


🚫 [checkstyle] <com.puppycrawl.tools.checkstyle.checks.javadoc.JavadocMethodCheck> _{reported by reviewdog 🐶}
@return tag should be present and have description.

github-actions · 2026-07-31T06:51:38Z

+    /**
+     * validates entry against password. Immediately invalidates expired entries.
+     */
+    private static boolean isMatch(CacheEntry entry, String key, String password) {


🚫 [checkstyle] <com.puppycrawl.tools.checkstyle.checks.javadoc.JavadocMethodCheck> _{reported by reviewdog 🐶}
Expected @PARAM tag for 'entry'.

github-actions · 2026-07-31T06:51:38Z

+    /**
+     * validates entry against password. Immediately invalidates expired entries.
+     */
+    private static boolean isMatch(CacheEntry entry, String key, String password) {


🚫 [checkstyle] <com.puppycrawl.tools.checkstyle.checks.javadoc.JavadocMethodCheck> _{reported by reviewdog 🐶}
Expected @PARAM tag for 'key'.

github-actions · 2026-07-31T06:51:38Z

+    /**
+     * validates entry against password. Immediately invalidates expired entries.
+     */
+    private static boolean isMatch(CacheEntry entry, String key, String password) {


🚫 [checkstyle] <com.puppycrawl.tools.checkstyle.checks.javadoc.JavadocMethodCheck> _{reported by reviewdog 🐶}
Expected @PARAM tag for 'password'.

…r EAS protocol credential caching

sonali033 requested review from Gopal-Moolchandani, ashwinsahu19, chitranshu198, dasiyogesh and omkar-oak-01 July 13, 2026 12:21

sonali033 marked this pull request as ready for review July 13, 2026 12:24

sonali033 force-pushed the feature/ZCS-19497 branch from 44cd9a0 to 3cca7cf Compare July 24, 2026 09:04

github-actions Bot reviewed Jul 26, 2026

View reviewed changes

github-actions Bot reviewed Jul 30, 2026

View reviewed changes

dasiyogesh reviewed Jul 30, 2026

View reviewed changes

ashwinsahu19 reviewed Jul 30, 2026

View reviewed changes

github-actions Bot reviewed Jul 31, 2026

View reviewed changes

ZCS-19497: Add IRopcCredCache with Guava cache and SSHA512 hashing fo…

5fdd816

…r EAS protocol credential caching

sonali033 force-pushed the feature/ZCS-19497 branch from 08c057f to 5fdd816 Compare July 31, 2026 06:55

ashwinsahu19 force-pushed the feature/ZCS-19097-mfa-eas branch 2 times, most recently from 8fb6ac3 to e9dedfa Compare August 7, 2026 06:01

Navigation Menu

Uh oh!

ZCS-19497: Add IRopcCredCache with Guava cache and SSHA512 hashing for non-EAS protocol credential caching - #1850

ZCS-19497: Add IRopcCredCache with Guava cache and SSHA512 hashing for non-EAS protocol credential caching#1850
sonali033 wants to merge 1 commit into
feature/ZCS-19097-mfa-easfrom
feature/ZCS-19497

sonali033 commented Jul 9, 2026

Uh oh!

github-actions Bot left a comment

Uh oh!

github-actions Bot left a comment

Uh oh!

github-actions Bot Jul 30, 2026

Uh oh!

dasiyogesh Jul 30, 2026

Uh oh!

ashwinsahu19 Jul 30, 2026

Uh oh!

ashwinsahu19 Jul 30, 2026

Uh oh!

github-actions Bot Jul 31, 2026

Uh oh!

github-actions Bot Jul 31, 2026

Uh oh!

github-actions Bot Jul 31, 2026

Uh oh!

github-actions Bot Jul 31, 2026

Uh oh!

github-actions Bot Jul 31, 2026

Uh oh!

github-actions Bot Jul 31, 2026

Uh oh!

github-actions Bot Jul 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

sonali033 commented Jul 9, 2026

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Jul 30, 2026

Choose a reason for hiding this comment

Uh oh!

dasiyogesh Jul 30, 2026

Choose a reason for hiding this comment

Uh oh!

ashwinsahu19 Jul 30, 2026

Choose a reason for hiding this comment

Uh oh!

ashwinsahu19 Jul 30, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Jul 31, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Jul 31, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Jul 31, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Jul 31, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Jul 31, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Jul 31, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Jul 31, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants