cf58a5
--- cyrus-imapd-2.2.12/lib/acl_afs.c.orig	2005-07-14 17:12:53 +0300
cf58a5
+++ cyrus-imapd-2.2.12/lib/acl_afs.c	2005-07-14 17:17:44 +0300
cf58a5
@@ -119,12 +119,17 @@
cf58a5
     char *thisid, *nextid;
cf58a5
     int oldaccess = 0;
cf58a5
     char *rights;
cf58a5
+    int identifier_found = 0;
cf58a5
+    int identifier_overridden = 0;
cf58a5
 
cf58a5
     /* Convert 'identifier' into canonical form */
cf58a5
     if (*identifier == '-') {
cf58a5
 	char *canonid = auth_canonifyid(identifier+1, 0);
cf58a5
-	if (!canonid) {
cf58a5
+	if (!canonid && access != 0L) {
cf58a5
 	    return -1;
cf58a5
+	} else if (!canonid && access == 0L) {
cf58a5
+	    canonid = identifier+1;
cf58a5
+	    identifier_overridden = 1;
cf58a5
 	}
cf58a5
 	newidentifier = xmalloc(strlen(canonid)+2);
cf58a5
 	newidentifier[0] = '-';
cf58a5
@@ -135,9 +140,15 @@
cf58a5
 	}
cf58a5
     }
cf58a5
     else {
cf58a5
+	newidentifier = xmalloc(strlen(identifier)+1);
cf58a5
+	strlcpy(newidentifier, identifier, strlen(identifier)+1);
cf58a5
+	
cf58a5
 	identifier = auth_canonifyid(identifier, 0);
cf58a5
-	if (!identifier) {
cf58a5
+	if (!identifier && access != 0L) {
cf58a5
 	    return -1;
cf58a5
+	} else if(!identifier && access == 0L) {
cf58a5
+            identifier = newidentifier;
cf58a5
+            identifier_overridden = 1;
cf58a5
 	}
cf58a5
 	if (canonproc) {
cf58a5
 	    access = canonproc(canonrock, identifier, access);
cf58a5
@@ -165,6 +176,7 @@
cf58a5
 	*nextid++ = '\0';
cf58a5
 
cf58a5
 	if (strcmp(identifier, thisid) == 0) {
cf58a5
+            identifier_found = 1;
cf58a5
 	    oldaccess = cyrus_acl_strtomask(rights);
cf58a5
 	    break;
cf58a5
 	}
cf58a5
@@ -172,6 +184,15 @@
cf58a5
 	nextid[-1] = '\t';
cf58a5
     }
cf58a5
 
cf58a5
+    /* 
cf58a5
+     * In case we have overridden the canonification of the
cf58a5
+     * identifier, but still the identifier does not exist in
cf58a5
+     * the mailboxdb, then return error as normally expected.
cf58a5
+     */
cf58a5
+    if(identifier_overridden && !identifier_found) {
cf58a5
+        return -1;
cf58a5
+    }
cf58a5
+
cf58a5
     switch (mode) {
cf58a5
     case ACL_MODE_SET:
cf58a5
 	break;