dovecot - Oct 2017 - Outlook 2016 SSO with GSSAPI auth?

Hi folks,

I've been sifting through various threads on GSSAPI and NTLM support, 
and I'm wondering if anyone out there can confirm or deny GSSAPI IMAP 
auth support in Microsoft Outlook 2016 (Windows)?  Perhaps there's some 
magic registry key to change IMAP auth from PLAIN to GSSAPI?

We're trying to do single sign-on + e-mail for Windows domain users; 
Thunderbird GSSAPI works fine, of course, but Outlook 2016 is the 
policy-mandated e-mail client for this particular environment (Windows 
10 client desktop, Windows Server 2012 R2 AD, RHEL7 Dovecot).

It seems that Outlook 2016 might also support NTLMv1 / GSS-SPNEGO out of 
the box for IMAP accounts, but NTLMv1 is - rightly - disabled in this 
environment (and I also see 'NT_STATUS_UNSUCCESSFUL' reported by 
/usr/bin/ntlm_auth back to the Dovecot auth worker).

Thanks for any ideas out there!

Robert

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4305 bytes
Desc: S/MIME Cryptographic Signature
URL:
<https://dovecot.org/pipermail/dovecot/attachments/20171024/5cbdca72/attachment.p7s>

On Tue, 24 Oct 2017 16:59:51 -0500, Robert Giles stated:
>Hi folks,
>
>I've been sifting through various threads on GSSAPI and NTLM support, 
>and I'm wondering if anyone out there can confirm or deny GSSAPI IMAP 
>auth support in Microsoft Outlook 2016 (Windows)?  Perhaps there's some 
>magic registry key to change IMAP auth from PLAIN to GSSAPI?
>
>We're trying to do single sign-on + e-mail for Windows domain users; 
>Thunderbird GSSAPI works fine, of course, but Outlook 2016 is the 
>policy-mandated e-mail client for this particular environment (Windows 
>10 client desktop, Windows Server 2012 R2 AD, RHEL7 Dovecot).
>
>It seems that Outlook 2016 might also support NTLMv1 / GSS-SPNEGO out of 
>the box for IMAP accounts, but NTLMv1 is - rightly - disabled in this 
>environment (and I also see 'NT_STATUS_UNSUCCESSFUL' reported by 
>/usr/bin/ntlm_auth back to the Dovecot auth worker).
>
>Thanks for any ideas out there!
In the past, I have had pretty good success posting a question regarding MS
Outlook on these tech forums.

https://social.technet.microsoft.com/Forums/office/en-us/home?forum=outlook

https://answers.microsoft.com/en-us/msoffice/forum?tab=all&auth=1

YMMV of course.

Jerry

On 10/25/2017 at 12:00 PM, Jerry wrote:
> In the past, I have had pretty good success posting a question regarding MS
> Outlook on these tech forums.
> 
> https://social.technet.microsoft.com/Forums/office/en-us/home?forum=outlook
That's an excellent idea, thanks:

For anyone that runs across this Dovecot thread later whilst hurriedly 
Googling for answers, I've posted a question here:

https://social.technet.microsoft.com/Forums/office/en-US/df7177c1-ffc2-453e-82b0-c119185a0fb8/outlook-2016-gssapi-auth-with-dovecot-imap?forum=outlook

Robert

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4305 bytes
Desc: S/MIME Cryptographic Signature
URL:
<https://dovecot.org/pipermail/dovecot/attachments/20171026/0a78a291/attachment.p7s>