As I continue to test freeipa-server-4.9.3-1, on Fedora 33 with dovecot-2.3.14-1 I've run into the following issues with web mail and Dovecot integration.

1. I followed https://www.freeipa.org/page/Dovecot_IMAPS_Integration_with_FreeIPA_using_Si... but I couldn't get web mail to login until I used the suggestion from https://blog.delouw.ch/2017/02/19/integrate-dovecot-imap-with-freeipa-using-... and changed logins auth_mechanisms = plain gssapi login which allowed logins of FreeIPA Kerberos users.

2. even with auth_mechanisms = plain gssapi login, I could then no longer login to SquirrelMail webmail with any local Unix (non-Kerberized) users. The dovecot logs show:

auth: Error: policy(localuser@ourdomain.edu,127.0.0.1,): Policy server HTTP error: connect(x.x.x.x:8084) failed: Connection refused auth: Debug: policy(localuser@ourdomain.edu,127.0.0.1,): Policy report action finished auth: Debug: http-client[1]: request [Req2: POST https://x.x.x.x:8084/?command=report]: Destroy (requests left=1) auth: Debug: http-client[1]: request [Req2: POST https://x.x.x.x:8084/?command=report]: Free (requests left=0) auth: Debug: http-client: conn x.x.x.x[2]: Connection close auth: Debug: http-client: conn x.x.x.x[2]: Connection disconnect auth: Debug: http-client: conn x.x.x.x[2]: Disconnected: connect() failed: Connection refused (fd=23) auth: Debug: http-client: conn x.x.x.x[2]: Detached peer auth: Debug: http-client: conn x.x.x.x[2]: Connection destroy auth: Debug: http-client: host x.x.x.x: Idle host timed out auth: Debug: http-client: host x.x.x.x: Host destroy auth: Debug: http-client: host x.x.x.x: Host session destroy auth: Debug: http-client[1]: queue https://x.x.x.x:8084: Destroy auth: Debug: client passdb out: FAIL 1 user=localuser@ourdomain.edu original_user=localuser imap-login: Debug: Ignoring unknown passdb extra field: original_user imap-login: Info: Aborted login (auth failed, 1 attempts in 3 secs): user=< localuser@ourdomain.edu>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured, session=

3. If a user was over quota there was no way to tell on the webmail page that they were over quota but the dovecot logs show imap(ouruser): Error: mkdir(/path/to/ouruser/mail/.imap) failed: Disk quota exceeded.

Would there be a security risk if the web page displayed a warning that could be generalized to inform the user to either check their quota or password reset being needed?