[Dovecot] gssapi, kerberos and webmail

[Denis Cardon]

Hi every one,

first thanks for the great job, I switched successfully from courier 
imap a few months ago and both the migration and maintenance went 
smoothly from then on.

The reason I switched was gssapi support (and the easier debug) and now 
I have thunderbird on Linux connecting in an SSO fashion through 
kerberos/GSSAPI (works great).

Users should be able to access their mail throught a webmail too (eg. 
eGroupware). I have already checked for kerberos authentication on 
Apache, however there seems to be no way to have ticket forwarding 
throught PHP. AFIAK there is thus no way to use kerberos for php-imap 
--> dovecot authentication. The only information available seems to be 
the username.

So here is my question :

how do people on this mailing list handle kerberos authentication with 
webmail? Do you use other kind of authentication on privileged port (ie 
with access only from apache) and just do a login/nopassword 
authentication (like an uid base authentication through ldapi:/// on an 
ldap directory for example) ?

Here is what we have with thunderbird :

Thunderbird -------kerberos-------> dovecot on standard port

Here is what I would guess for webmail auth :

Firefox ------kerberos----> Apache ----gssapi-auth-just-using-login----> 
dovecot on privileges port

Cheers,

Denis

-- 
Denis Cardon
Tranquil IT Systems
44 bvd des pas enchantés
44230 Saint Sébastien sur Loire
tel : +33 (0) 2.40.97.62.67
http://www.tranquil-it-systems.fr