Adding anonymous users by email in gerrit 2.15.2?

[Richard Christie]

Hi

We have some users who are wanting to add a mailing list as a "cc" to a change in gerrit 2.15.

They have gone and set the reviewer.enableByEmail flag to enable this.

Adding the email as a CC has shown "Anonymous <email>" in the cc-list.

However emails are not being sent to this address. They are going to other users. There's nothing in the server error log about emails failing to send.

The repo is publicly cloneable by unauthenticated https, and the changes is visible in REST and fetchable anonymously too.

Does anyone know if this is a bug? Or is there something we're missing?

[Matthew Webber]

There's nothing in the server error log about emails failing to send. 

What about the mail server logs? Typically, Gerrit is set up to forward emails to a mail server running on localhost, which then forwards them to their actual destination.

 

[Richard Christie]

On Tuesday, 19 June 2018 15:23:34 UTC+1, Matthew Webber wrote:

There's nothing in the server error log about emails failing to send. 

 

What about the mail server logs? Typically, Gerrit is set up to forward emails to a mail server running on localhost, which then forwards them to their actual destination.

Good point, gerrit is configured to use one of the corporate smtp servers directly in the gerrit config. I'll try and dig out any info from our IT people.

[Gert van Dijk]

Apart from the point by Matthew, I wanted to point out two other settings that might influence the behaviour of Gerrit in sending mails to certain domains:

• sendemail.allowTLD
  
• sendemail.allowrcpt

Although my best educated guess is that your corporate mail relay only allows for internal domains (which is a good practice, but it should reject such mail, not accept and drop...).

In anticipation of that as the cause, I think Gerrit can't really have a separate relay for external mail. In case you really need/want to circumvent your IT department I'd suggest to configure your own mail relay in front of theirs and route mail to the internal domain there, the rest out (danger ahead, know what you're doing... ). But you could also apply that principle if your corporate setup requires you to use a separate relay with (different) authentication to send mail to the public internet (e.g local Postfix, transport_maps).

[Richard Christie]

Just FYI, and in case anyone else suffers from this, it was our problem in the end. The Exchange email group contained another sub-group in it which was denied for non-exchange-authenticated senders, so not gerrit's fault.

Thanks for your suggestions!