Subject: Re: AFS-aware IMAP daemon?

From: [email-masked] (Michael Grubb)
Date: 25 Oct 1995 19:21:57 -0400

In article <[email-masked]>,
Trey Harris <[email-masked]> wrote:
 
>My question has to do with my IMAP users.  Mail spools will continue to
>reside in the Unix filesystem, not AFS.  Thus, as I understand it, there
>is no need for an 'AFS-ized' IMAP daemon just to get at the inboxes of
>users.  AFS does not come into this scenario.  A Kerberized daemon is
>required so that the plaintext login can be authenticated to Kerberos. 
 
>However, when an IMAP client makes a request for an archived mail folder
>(such as the sent or saved messages), the daemon must get this information
>from the user's home directory--which resides in AFS. 

There's no reason for folders to be in AFS unless the user puts them there.
(The user can define folder locations in the client, as with pine's 
folder collections definitions in the .pinerc.) You can configure the IMAP 
server so that folders and inboxes alike are located on local filesystems.  
How to do that depends on which imapd you are running.

>Now, if we use the Cyrus imapd, a plaintext login (such as Pine, 
>MailDrop, Siren Mail or Simeon Email use) will cause the imap daemon to 
>get a Kerberos ticket.

If you use the Cyrus imapd, your users should not be logging in to the IMAP
server, and your users' login sessions on other machines should have no 
effect on authentication of the imapd processes.  A fortiori, the Cyrus 
imapd handles all folders on local disk.  Trying to wedge that into AFS 
would be a supremely bad idea.

>This is where I get fuzzy, however.  I believe that a Kerberos ticket is
>necessary but not sufficient to grant a process access to the AFS
>filespace.  An AFS token is also required for a process to be able to 
>read and write to an AFS filesystem.  Am I correct?

That's right, but it shouldn't enter into your IMAP server configuration 
at all.

If you need some boilerplate code to serve as an example of how a process 
can get a Kerberos ticket and an AFS token, let me know and I'll be glad to 
send you a sample or two.  Getting such code to build is highly dependent 
on your particular platform, Kerberos libraries, and AFS version.

     -- Mike

--
Michael Grubb <[email-masked]>
Duke University Office of Information Technology
phone +1 919 660 6903 / 417 North Building, Durham NC 27708-0132 USA

---

From: [email-masked] (Trey Harris)
Date: 26 Oct 1995 15:43:12 GMT

>would be a supremely bad idea.

I don't know if "wedge" is the proper word.  This is unfortunately a
drop-dead issue if I can't get IMAPd to work with AFS, though, and if they
won't work together then I need to know so that I can cancel this project
and rework (we're supposed to sign the contract tomorrow!). 

The reason this is a drop-dead issue is that this system is primarily (as
far as the chancellorial-level management cares, exclusively) for email. 
Users get an X-megabyte quota for their use of *everything*. 

Trying to segregate users' diskspace into two pieces (mail folder space 
for mail use, home directory for other use) presents two problems which 
are politically unsolvable.

First, how to break down the ten megabyte quota into mail use and other
use?  From the upper management, the answer would be clear: ten megabytes
for mail use and zero for other use.  That's not very practical, but
enough people use our machine that way (*never* logging in and *always*
using IMAP clients) to where it would make sense for some users.  For some
of our web-publishing users, the answer would be one megabytes mail and
nine megabytes other, or ten megabytes other and none for mail. 

Second, no matter how you break it down, what's the point of going to AFS
in the first place if the majority of user disk usage is going to have to
remain in UFS?  We're hitting NFS scalability problems big time right now,
and our environment won't let us go to multiple IMAP servers until
IMAP4/IMSP redirection support is there; we need to put mail folders in
the user home directories to maintain the transparency that our users 
take for granted.
-- 
Trey Harris                             http://sunsite.unc.edu/harris/
  System Administrator, Project Isis, Office of Information Technology
                       The University of North Carolina at Chapel Hill

---

From: [email-masked] (Tobias Schaefer)
Date: 26 Oct 1995 14:01:31 GMT

In article <[email-masked]>, [email-masked] (Trey Harris) writes:

|> If so, are there any IMAP daemons out there (or any easy modifications to 
|> existing ones) that will allow access to AFS?

I've hacked imapd (V3.5) to allow this. The source compiles on AIX 3.x.
(And should compile on most system with an ANSI C compiler.)
It is a "proof of concept" hack. I don't know anything about
Performance and scalability in a 26,000 user environment.
It is not in general use in our 2,000 user environment!

The source is in /afs/uni-hohenheim.de/sw/src/imap-3.5.afs.hoh/src/imap-3.5
Binaries for RS/6000 are in
	/afs/uni-hohenheim.de/sw/rs_aix32/imap-3.5.afs.hoh/sbin

-- 
Tobias Schaefer                             [email-masked]

---

From: [email-masked] (Trey Harris)
Date: 25 Oct 1995 21:55:37 GMT

I administer an email system with approximately 26,000 users, of which 
several thousand are using IMAP.  We currently run on a cluster of 
workstations, but are soon to upgrade to an IBM RS/6000 parallel SP 
system.  At this time, we will be migrating our users to AFS.

At this time we anticipate using MIT Kerberos v4 for both AFS and SP 
authentication (since both AFS and the SP are compatible with Kerberos v4 
but not with each other's proprietary Kerberos).  However, we may end up 
using the AFS kaserver for reasons of expediency.  I don't think this 
changes the answer to my question, though.

If so, are there any IMAP daemons out there (or any easy modifications to 
existing ones) that will allow access to AFS?
-- 
Trey Harris                             http://sunsite.unc.edu/harris/
  System Administrator, Project Isis, Office of Information Technology
                       The University of North Carolina at Chapel Hill