search

cyrusimap / cyrus-imapd

Cyrus IMAP is an email, contacts and calendar server
http://cyrusimap.org
Other
541 stars 148 forks source link

allow proxyd to run in noauth mode #902

Closed brong closed 14 years ago

brong commented 17 years ago

From: Wes Craig Bugzilla-Id: 2972 Version: 2.3.x Owner: Ken Murchison

brong commented 17 years ago

From: Wes Craig

This change:

https://bugzilla.andrew.cmu.edu/cgi-bin/cvsweb.cgi/src/cyrus/imap/Attic/proxyd.c.diff?r1=1.187;r2=1.188

didn't get ported forward when proxyd's functionality was included in imapd. The patch to imapd.c is simple, if you'd like me to submit it.

brong commented 17 years ago

From: Ken Murchison

Are you using this for webmail or something? Would it make more sense to use EXTERNAL for this?

brong commented 17 years ago

From: Wes Craig

I'm using up.imapproxy to cache webmail connections through cyrus imap(proxy)d. AFAIK, SASL EXTERNAL isn't really suitable, since it has no facility to determine the user. The -N option, which was committed to proxyd some time ago, allows me to pass the user over the protocol with a dummy password. I start proxyd on these servers bound to localhost, so only other processes (up.imapproxyd) on the host can connect. up.imapproxyd is similarly limited, and IMP contacts up.imapproxyd through the loopback. HTTPd actually authenticates the user with a WebSSO (cosign).

brong commented 17 years ago

From: Ken Murchison

If we "preauth" the connection as an admin, then the client can pass an authorization id as a parameter to EXTERNAL.

I'm just thinking out "loud". The old patch might still be the easiest, but I think a preauth'd connection using EXTERNAL sounds more like what is happening.

brong commented 17 years ago

From: Wes Craig

I think you're right, if we invoke imapd with sufficient preauth, then a client issuing appropriate SASL EXTERNAL commands will get the same effect that I'm looking for. However, that would require changes to up.imapproxyd in addition to IMP. I'm not averse to making those changes, but I don't see much upside. I guess it would depend on whether the maintainer of up.imapproxyd would accept the changes. I don't think up.imapproxyd does any sort of SASL today.

brong commented 17 years ago

From: Ken Murchison

The maintainer is now a CMU employee, so I can probably strong arm Dave. I'll take a look at the source myself. I promised Dave that I would look at something else, which I've since forgotten.

brong commented 16 years ago

From: Wes Craig

Any movement on this? Or should I just port -N forward.

brong commented 16 years ago

From: Ken Murchison

I haven't done anything. Feel free to port -N