similar to: authn_name and authz_name differ: not supported

Attached is a patch which in my environment (Linux/Heimdal 1.2.1) fixes cross-realm GSSAPI authentication. Changes it makes: 1. When using krb5_kuserok, do not call gss_compare_name to check that authn_name and authz_name are the same. Instead, make TWO calls to krb5_kuserok, one for each ID. If both IDs are acceptable, allow the login. 2. Disable checking that the name is a

I've been trying to track down some problems with Dovecot in a Kerberos 5 cross-realm environment, and there seem to be a few issues. LOGIN/PLAIN work fine using pam_krb5, but GSSAPI is a bit harder to handle. On line 436 of src/auth/mech-gssapi.c, the authn_name and the authz_name are compared using gss_compare_name. This dates back to the message at:

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, Attached is a patch against current CVS that adds support for the GSSAPI SASL mechanism. It was written from scratch, after reading the patch from Colin Walters against a much older version of dovecot. Other then support for the 'GSSAPI' mechanism, it contains the following changes: - - Added 'auth_krb5_keytab' option for

I've been trying to use Kerberos and PLAIN text file for authentication. I've setup deliver in postfix master.cf and make sure correct username are expanded but deliver is always told me "user unknown". I can logon into mailbox using Kerberos w/o problems and can send emails. Looks like Dovecot lookup up passwd files and not finding users which are in Kerberos realm. #

Hi, I'm currently trying to configure Dovecot to use kerberos. My KDC is Windows 2003 and I successful generated keytab file for Dovecot machine. Problem is when I'm trying to use GSSAPI it told me Obtaining credentials for imap at debian5 - and of course this fails because debian5 isn't KDC, it should look for imap/debian5.inblock.local at INBLOCK.LOCAL. What I'm missing?

What is correct way to backup dovecot store? Is am I right what is just enough to copy all maildir and my configuration. So in case failure I can just prepare new machine copy config, maildirs and I'm good to go with this.

I've upgraded mine Dovecot 1.0.15 to 1.2.4 also moved to new Sieve. I have simple sieve rule: if header :contains "Delivered-To" ["bcc at bcc.inblock.ru"] { setflag "\\Seen"; } It basically mark my own messages which are saved to Sent folder. When I was on 1.0.15 I never seen unread count in Thunderbird, but suddenly after upgrade I seen unread

Hi All. I have a problem with authorization users AD via kerberos in Dovecot&Postfix. Windows SRV 2008 Standart - AD mail server: Gentoo + cyrus-sasl + postfix + dovecot with support ldap&kerberos. I am created a 4 keytabs on Windows box. C:\Users\Admin>ktpass -princ host/srv-mail.cn.energy at CN.ENERGY -mapuser ldapmail at CN.ENERGY -pass "superpasswd" -crypto RC4-HMAC-NT

This morning I upgraded a dovecot installation from 1.1.16 to 1.2.4 on a FreeBSD 7.2 server, and then spent 3 hours trying to figure out why GSSAPI authentication had broken. It turned out to be a recent change in Dovecot's mech-gssapi.c to do with checking for NULs in usernames: everything worked fine when I disabled that test. <http://hg.dovecot.org/dovecot-1.2/rev/5d53b1d66d1b> This

Hi, we're facing problem where dovecot 1.2rc5 is not able to authenticate user via gssapi. (I'm forwarding information from red hat's bugzilla) Steps to reproduce: 1. Install dovecot with kerberos support, create mailboxes for the client 2. Get initial credentials on client side 3. Attempt to log in via dovecot using gssapi -> login failed Client side 1. Email client displays:

> Namespaces are supported everywhere now. Does this means what we can finally use "deliver" to deliver messages in namespaces?

On 20.05.2010 13:55, Timo Sirainen wrote: > On 20.5.2010, at 11.10, Nikolay Shopik wrote: > >> What you think about this draft is it good enough to make patch based on it for dovecot? We would like to see this functionality in 2.0 dovecot release but it's not clear when this draft become standards track. Will you accept patch based on drafts? > > Have you read the discussion

Running dovecot 1.0.5 on Debian testing. I've just tried to create folder using Russian charters after that I'm tried to renamed it without luck. Folder removed and no new created and I still subscribed to old folder even its not exist anymore.

Hi list, I was wondering about server-side search inside entire message, is dovecot support only english encoding now? I'm using Thunderbird but it can't find anything if I'm using language other than English.

Hi list, I would like to test new functionality in latest 1.1 release, but can't find information on wiki. How can I deliver messages to different namespaces using "deliver"?

I'm getting user unknown when trying to deliver to Sent folder messages. My master.cf part is: copy2sent unix - n n - - pipe flags=DRhu user=vmail:vmail argv=/usr/lib/dovecot/deliver -d ${sasl_username} -m Sent But it still won't work. I'm running 1.0.15 pluto postfix/pipe[30934]: 7470890C4DA: to=<bcc at bcc.example.com>,

Hi Timo, Does this intended %u isn't expanding REALM name, so I've only see user names.

Hi List, Is anyone is running Dovecot with Kerberos and tried to authenticate user from different REALM and have same user principal with default domain. Currently Dovecot only logs user principal w/o REALM. So before I go in production maybe somebody already run into this using Dovecot? If not I just create virtual machines and see how it behaves.

I'm running KDC with all users and passwords, but have to manage clients who doesn't support GSSAPI like mobile phones. Is it possible to dovecot SASL check password in KDC when user sends plain text login? I know this is possible to do with saslauthd from Cyrus but prefer to stick with dovecot SASL.

I have few such messages should I aware about them or just ignore? Disconnected: Mailbox is in inconsistent state, please relogin.