[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: [Freeipa-users] Dovecot imap authentication with IPA/Kerberos




Hey sounds good to me, just glad it is working for you :). The only
other question/suggestion I have is that it looks like you aren't
leveraging kerberos in your configuration for SSO, You might want to
think about doing this as it can be a pretty nice configuration.

Essentially you would just need to add service principles for the host
in the form of imap and or pop, and change the auth line in your dovecot
config to allow for gssapi auth, like so:

sed -i -r "s&(\smechanisms =).*&\1 gssapi plain&"

Then assuming your user has a ticket, and their client is properly
configured, they no longer need to do anything upon logging into their
system, kerb will auth the rest.

If you are on a multihomed system, you will need two additional changes,
service principles for the other host name, and the following modification:
sed -i -r 's&#auth_gssapi_hostname.*&auth_gssapi_hostname = $ALL&'

I got a little caught up when you referenced the /etc/krb5.keytab file
as possibly part of the problem so I thought this was more a kerb issue.

Exactly, I was confused by this as well - I would like to see this working, too. But I would say we would need to do something with the permissions on /etc/krb5.keytab which is now (by default) only readable by root. We need to address this problem more in general as when inegrating Bind DNS server, you hit the same thing.
I would say something like ACL entry would help.

Ondrej


Proud winners of the prestigious Irish Software Exporter Award 2011 from Irish Exporters Association (IEA). Please, refer to our web site for more details regarding the award.

The information contained in this e-mail and in any attachments is confidential and is designated solely for the attention of the intended recipient(s). If you are not an intended recipient, you must not use, disclose, copy, distribute or retain this e-mail or any part thereof. If you have received this e-mail in error, please notify the sender by return e-mail and delete all copies of this e-mail from your computer system(s). Please direct any additional queries to: communications s3group com Thank You. Silicon and Software Systems Limited. Registered in Ireland no. 378073. Registered Office: South County Business Park, Leopardstown, Dublin 18



[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]