There is some confusion about IMAP ACLs, and how they are used and implemented by MDaemon, Outlook Connector and WorldClient.
First, what are ACLs? ACL stands for “Access Control List”, and ACLs are a way of controlling who can see a folder, and what rights a user has within that folder.
There are 10 defined ACLs supported by MDaemon:
- l – lookup (mailbox is visible to LIST/LSUB commands)
- r – read (SELECT the mailbox, perform CHECK, FETCH, PARTIAL, SEARCH, COPY from mailbox)
- s – keep seen/unseen information across sessions (STORE SEEN flag)
- w – write (STORE flags other than SEEN and DELETED)
- i – insert (perform APPEND, COPY into mailbox)
- p – post (send mail to submission address for mailbox, not enforced by IMAP4 itself)
- c – create (CREATE new sub-mailboxes in any implementation-defined hierarchy)
- d – delete (STORE DELETED flag, perform EXPUNGE)
- a – administer (perform SETACL)
Note the differences between “write”, “insert”, “post” and “create” as these tend to confuse people somewhat.
Outlook Connector (and MDaemon Groupware before it) rely on the same set of IMAP ACLs, but implement them somewhat differently. For example, IMAP has no concept of “editing” an item, so instead, when you modify an item in Outlook Connector, Outlook Connector will INSERT a new item and DELETE the old item, so to edit, you require both the INSERT and DELETE rights.
In non-email folders, the “keep seen/unseen”, “w – write”, “p – post” rights are not used and can be ignored.
WorldClient implements ACLs in a nearly identical fashion to MDaemon and Outlook Connector, emulating as many of the permissions as closely as possible.
Note that users own all folders contained within their mailboxes at all times, and the owner of a folder always has all rights and even if these rights aren’t explicitly listed, they are granted. Public folders don’t have an owner.
Lastly, note that ACLs are inherited by subfolders when they are created, but permission changes to a parent don’t apply to children unless the administrator uses the “Set sub” folder to set permissions on subfolders.
IMAP ACLs reference by Dave Warren (everything-mdaemon.com) is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License.