[Dovecot] dovecot Digest, Vol 44, Issue 53

[Lars Skovgaard]

Den 25/12/2006 kl. 13.00 skrev Adrian Gill:

> Date: Sun, 24 Dec 2006 16:43:40 -0000
> From: "Adrian Gill" <adrian at ssinternet.co.uk>
> Subject: Re: [Dovecot] NTLM authentication woes
> To: <dovecot at dovecot.org>
> Message-ID: <023001c7277a$ae1bcf60$4107a8c0 at AdeLaptop>
> Content-Type: text/plain; format=flowed; charset="iso-8859-1";
> 	reply-type=response
>
> Lars wrote:
> [Re Outlook handling of SPA/NTLM]
>> Turning on auth_debug and auth_verbose has led me to discover that MS
>> Outlook uses the users full name as login, instead of whatever is   
>> entered
>> in the account-information - if the user "John Doe" has the  login
>> "jd at domain.com", Outlook sends "John Doe" instead. This of  course  
>> fails.
>> Strangely enough, if I turn off "Use Secure  Authentication" from  
>> within
>> Outlook, the login-name from the account- information is used as  
>> it should
>> be.
>
> Not a solution I'm afraid, but just to let you know that I've been
> experimenting with NTLM (actually with Exim for authenticated SMTP)  
> for a
> while with a few users and had the same problems - different  
> versions of
> Outlook behave slightly differently, but none (that I've found)  
> seem to work
> properly.  Usually Outlook sends the users Windows Logon username and
> password (which is often their name, but often something else too like
> 'Administrator') initially, and sometimes then retries  
> automatically with
> the correct details.
>
> Things never seem to be that consistent though, except that they're
> consistently bad.  Frustratingly, the only option I have is to tell  
> users
> that have problems to use Thunderbird or something else and use  
> cram-md5
> instead.
>
> As far as Outlook goes I think Microsoft seem to only bother  
> testing NTLM
> running with MS Exchange on a local network... v.annoying!
>
> (Sorry not that helpful a post)
>
> Adrian

Hi Adrian

Thanks for your reply. I suspected as much, though I had hoped that  
there was an easy applicable solution. Sadly my MS-using clients are  
reluctant at best to change their applications, flawed as they may  
be, so I guess they'll have to live with things as they are for now.  
MS really should fix their apps, but that's a topic for a discussion  
of it's own.

I use a mysql-backend, and suspect I could change the login-call to  
match whatever Outlook or Entourage choose to send, but that would be  
difficult to make consistent enough to be truly workable, I think...

Thanks for your time

/Lars