Disable global Address Book

inbuxa Support
1

Hi,

Is there a way to disable that every user is automatically added to a global shared address book? I.e.: each user can see in its contacts all the other users in the server; can I disable that?

Note: “Settings > Sharing > Allow Directory Queries” is already disabled.

Thanks and best regards!

2

Thanks for reporting this. You’ve found a bug: that setting isn’t stopping JMAP directory lookups, even when it’s off. We’re working on a fix.

In the meantime, you can remove these permissions from the User role: jmapPrincipalQuery, jmapPrincipalQueryChanges, jmapPrincipalGet, jmapPrincipalGetAvailability and jmapPrincipalChanges. I tested that on a clean server and regular users can no longer list accounts. Admins also lose that access if they only get it through the User role. Users won’t get directory suggestions when composing, can’t pick new people to share with, and lose free/busy lookups.

Which client are you seeing this in? In our webmail they should show up as “Directory” suggestions when composing, not in the Contacts list, so if they’re in your actual address book I’d like to look at that too.

3

Many thanks for the quick reply! I’m using the Bulwart upstream webmail as a client.

4

A correction to my workaround: also remove davPrincipalSearch and davPrincipalAcl from the User role. Without those, people can still be found by name over DAV. Sorry for the miss.

1 Like
5

just a quick note, probably doesn’t matter either way, but Bulwark is neither up/downstream of us. Completely independent code. Aso, as we have diverged from Stalwart, our data store shapes will begin to drift more and more, at some point Bulwark will probably break, just as ihasmail will break on Stalwart.

6

Thanks for the workaround :slight_smile:

7

Following up: the fix is in 27.1-rc.8 and later. With Allow Directory Queries off, regular users can’t list or search other accounts anymore, and can only start sharing with people they’re already connected to. Once you’re on it, you can put the User role’s permissions back. I haven’t tested it with the webmail you’re using, so let me know if anything looks off there.