Subject: [Imap-uw] uw-imap and kerberos via GSS

From: Paul Fardy <[email-masked]>
Date: Mon, 10 Apr 2006 12:06:11 -0400

[I sent a message on Friday that's not in the imap-uw archive and has  
a incorrect subject. Sorry if this becomes a duplicate message.]

I'm attempting to Kerberize our UW IMAP service. I've run into some  
trouble with service principals.

I'm working, first, with my own Mail client Mac OS X Mail.app which  
looks like its do "a" right thing (perhaps not "the"). It requests  
access to the principal "host/host.name@DOMAIN". My Kerberized imapd  
looks for the principal "imap/host.name@DOMAIN" and fails to find it.

I expect that I would not succeed if I attempted to relabel the  
principal name in the server's keytab--thus using the same key. I  
assume that Kerberos would fail if the principal names don't match.  
And, if that would work, the kadmin tool randomizes keys as it puts  
them in keytabs, so I don't think it's possible to create two service  
principals with the same key.

Can someone point in the right direction?

BTW, I'm looking use this with Pubcookie and IMP so any additional  
notes about that would be appreciated.

Thanks,

Paul
-- 
Paul Fardy
Network Services Group
Computing and Networking Services
University of Toronto

_______________________________________________
Imap-uw mailing list
[email-masked]
https://mailman1.u.washington.edu/mailman/listinfo/imap-uw

---

From: Mark Crispin <[email-masked]>
Date: Mon, 10 Apr 2006 14:39:17 -0700 (Pacific Daylight Time)

On Mon, 10 Apr 2006, Paul Fardy wrote:
> I'm working, first, with my own Mail client Mac OS X Mail.app which looks 
> like its do "a" right thing (perhaps not "the"). It requests access to the 
> principal "host/host.name@DOMAIN". My Kerberized imapd looks for the 
> principal "imap/host.name@DOMAIN" and fails to find it.

imapd is doing the right thing.  Refer to RFC 2222, section 7.2.1:

    The client calls GSS_Init_sec_context, passing in 0 for
    input_context_handle (initially) and a targ_name equal to output_name
    from GSS_Import_Name called with input_name_type of
    GSS_C_NT_HOSTBASED_SERVICE and input_name_string of
    "service@hostname" where "service" is the service name specified in
    the protocol's profile, and "hostname" is the fully qualified host
    name of the server.

The service name in the IMAP protocol's profile is "imap", not "host" as 
per RFC 3501, section 6.2.2.

> BTW, I'm looking use this with Pubcookie and IMP so any additional notes 
> about that would be appreciated.

I think that IMP uses PHP which uses c-client, which will also use the 
"imap" service name.  So will Pine.

So, if your report is correct, this looks to be a bug in Mail.app.  I 
don't recall if I ever tried Mail.app with our (kerberized) IMAP servers. 
I tried it once, then went back to Pine.

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.
Si vis pacem, para bellum.
_______________________________________________
Imap-uw mailing list
[email-masked]
https://mailman1.u.washington.edu/mailman/listinfo/imap-uw

---

From: BuildSmart <[email-masked]>
Date: Mon, 10 Apr 2006 20:13:21 -0400

On Apr 10, 2006, at 17:39 , Mark Crispin wrote:

>> I'm working, first, with my own Mail client Mac OS X Mail.app  
>> which looks like its do "a" right thing (perhaps not "the"). It  
>> requests access to the principal "host/host.name@DOMAIN". My  
>> Kerberized imapd looks for the principal "imap/host.name@DOMAIN"  
>> and fails to find it.
>
> The service name in the IMAP protocol's profile is "imap", not  
> "host" as per RFC 3501, section 6.2.2.
>
> I think that IMP uses PHP which uses c-client, which will also use  
> the "imap" service name.  So will Pine.
>
> So, if your report is correct, this looks to be a bug in Mail.app.   
> I don't recall if I ever tried Mail.app with our (kerberized) IMAP  
> servers. I tried it once, then went back to Pine.

I have no issues using Apple's Mail.app and UW-IMAP as kerberized.

Mail.app - Version 2.0.7 (746.2/749.3)

---

From: Mark Crispin <[email-masked]>
Date: Mon, 10 Apr 2006 17:15:46 -0700 (Pacific Daylight Time)

On Mon, 10 Apr 2006, BuildSmart wrote:
>> So, if your report is correct, this looks to be a bug in Mail.app.  I don't 
>> recall if I ever tried Mail.app with our (kerberized) IMAP servers. I tried 
>> it once, then went back to Pine.

Thanks for the information.  Paul, is it possible that you have an old 
version of Mail.app that buggily uses the host principal instead of the 
imap principal?  Does upgrading your Mac system help?

-- Mark --

---

From: Paul Fardy <[email-masked]>
Date: Tue, 11 Apr 2006 11:41:22 -0400

On Mon, 10 Apr 2006, BuildSmart wrote:
>>> So, if your report is correct, this looks to be a bug in  
>>> Mail.app.  I don't recall if I ever tried Mail.app with our  
>>> (kerberized) IMAP servers. I tried it once, then went back to Pine.

Mea culpa. The report is not correct.

>> Mail.app - Version 2.0.7 (746.2/749.3)

I have the same version. Mail.app did not request a Kerberos ticket  
for "host/host.name".

I misinterpreted the log files. Our KDC logged this

   TGS_REQ (7 etypes {...}) 128.100.x.y(88): ISSUE: authtime  
1144433149, etypes {...},
       [email-masked] for host/[email-masked]

and I assumed that the transaction was initiated by Mail.app, which  
had requested the password and the IMAP session failed. And imapd  
logged this:

   Failed to acquire credentials for imap/[email-masked]

and I assumed the two events were directly related. If I'd looked  
closer the timestamps were a minute apart (KDC and IMAP servers are  
NTP-synced).

What happened? I'd turned one SSH session into log watcher "tail -f / 
var/log/mail". After Mail.app failed, I decided to create a second  
session. Mail.app had saved the Kerberos credentials and ssh found  
them, so it requested Kerberos token for the remote host. That failed  
and ssh silently fell back to using identities and keys, so I was  
none the wiser.

I experimented with several keytabs, but it seems I'd never replayed  
test with a proper keytab entry for "imap/host.name". With that  
entry, Mail.app's Kerberos (GSSAPI) authentication works as expected.

Paul