Hi, Just writing here my note about auth_default_realm, pam_krb5 and gssapi. It seems that 'pam' passdb and 'gssapi' auth_mechanism doesn't honor 'auth_default_realm' setting, at least in several setups I deal with. Here is a part of the config: passdb { args = max_requests=100 cache_key=%u%r dovecot driver = pam } auth_default_realm = REALM.COM auth_mechanisms = plain login apop gssapi auth_username_format = %Uu

The problem is that pam_krb5 strips default realm from username (by default), even if auth_default_realm is specified and even if user logs in as 'user1@realm.com' (with domain part). A part of auth.log: mail auth: pam_krb5(dovecot:auth): user USER1 authenticated as USER1@REALM.COM

The same for GSSAPI auth, if specified authorization name doesn't contain domain part. A part of mail.log: mail dovecot: imap-login: Login: user=<USER1>, method=GSSAPI, rip=172.16.0.1, lip=192.168.1.1, mpid=5828, TLS, session=<bpzvRmDwPACsFwCX>

For several reasons I do need username inside dovecot to contain domain part. So, I found a solution to this problem - modifying /etc/krb5.conf this way: [libdefaults] default_realm = REALM.COM [realms] REALM.COM = { auth_to_local = RULE:[1:$1@$0] }

This will add realm part to the local username despite using default realm. Maybe it's better to put this example to the wiki? Tested with ubuntu 12.04 and dovecot 2.2.10, mit kerberos 1.10, amd64.

Taking the opportunity, I'd like to ask, is there a way to make usernames case insensitive while using GSSAPI. The case: klist shows: Principal: user1@REALM.COM username in thunderbird 'uSer1@REALM.COM'. Dovecot gives me this message (I use auth_username_format=%Uu for pam_krb5 to be able to login with lowercase realm): dovecot: auth: gssapi(USER1@REALM.COM,172.16.0.1,<IIgwMGbw3ACsFgA4>): User not authorized to log in as USER1@REALM.COM

As I know kerberos usernames are case insensitive (user part), at least kinit and windows against AD works that way. Seems that k5credentials passdb extra field will not help here too. Does anyone have an idea?

Thanks.

-- Best regards, Sergey Urushkin