Subject: [Imap-uw] php_imap , c-client , GSSAPI bug

From: Erik <[email-masked]>
Date: Mon, 27 Jun 2005 12:34:30 -0400

Hi-
	I'm affected by a bug which concerns a few different pieces of
software, namely, php4 , php_imap , the c-client , and the cyrus imap
server.  A detailed bug report is available here on RedHat's website:

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=57522

	Basically: php_imap uses the c-client library to do imap stuff.  When
the webserver is not doing authentication, php's imap_open call fails.
It calls c-client to try and talk to the cyrus server, but c-client
tries to authenticate with GSSAPI (which fails).
	Has anyone encountered this bug?  A suggested workaround is to disable
GSSAPI on the cyrus server, but we need it for other clients (like pine).

thanks,
Erik
Columbia University AcIS
_______________________________________________
Imap-uw mailing list
[email-masked]
https://mailman1.u.washington.edu/mailman/listinfo/imap-uw

---

From: Mark Crispin <[email-masked]>
Date: Mon, 27 Jun 2005 09:59:16 -0700 (PDT)

Hi -

Thanks for calling my attention to this.  I agree with Julio Sanchez 
Fernandez's comment.  That is, the correct fix to address this problem is 
to locate the module in IMP that glues IMP to c-client and insert the 
following line:
   mail_parameters (NIL,DISABLE_AUTHENTICATOR,"GSSAPI");

This glue module would be a C source file in the IMP sources where 
something like:

#include "c-client/linkage.c"

is located (that is, including linkage.c from the c-client library). 
Insert that mail_parameters() call right after the #include.

If you can't find a reference to linkage.c anywhere, it's possible that 
IMP does manual linkage (it shouldn't, but some people don't listen to 
me).  If so, then there is probably a line that reads:
   auth_link (&auth_gss);
Delete that line.

You should report this issue to the IMP maintainers.  This isn't a Cyrus 
issue; nor is it a UW c-client issue.  Both Cyrus and c-client are working 
as intended.  The problem is that IMP doesn't know how to acquire Kerberos 
credentials so it needs to disable Kerberos.

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.
Si vis pacem, para bellum.
_______________________________________________
Imap-uw mailing list
[email-masked]
https://mailman1.u.washington.edu/mailman/listinfo/imap-uw

---

From: Erik <[email-masked]>
Date: Tue, 28 Jun 2005 12:13:28 -0400

Hi Mark-
	Thanks for your response.  To clarify, I'm not using IMP , I'm trying
to write my own PHP scripts to talk to a cyrus server.  The php imap
extension (see docs here: http://us3.php.net/manual/en/ref.imap.php )
uses your c-client.  So, this could be a bug in the php imap code, or
rather, the lack of an option for disabling GSSAPI.  I have filed a bug
report with PHP here:

http://bugs.php.net/bug.php?id=33500&thanks=6

	One question I have is, why does the process default to using GSSAPI
when a username and pw is provided?  And / or, if it wants to try using
GSSAPI, but that doesn't work, why doesn't it continue and try the plain
method?

thanks,
Erik

Mark Crispin wrote:
> Fernandez's comment.  That is, the correct fix to address this problem
> is to locate the module in IMP that glues IMP to c-client and insert the
> following line:
> issue; nor is it a UW c-client issue.  Both Cyrus and c-client are
> working as intended.  The problem is that IMP doesn't know how to
> acquire Kerberos credentials so it needs to disable Kerberos.
> 
> -- Mark --
>

---

From: Mark Crispin <[email-masked]>
Date: Tue, 28 Jun 2005 09:21:11 -0700 (PDT)

On Tue, 28 Jun 2005, Erik wrote:
> when a username and pw is provided?

There is no such thing as "providing a password" in the c-client library. 
c-client only obtains passwords on demand.

Any user name provided to c-client is used by GSSAPI.  The server verifies 
that the Kerberos credentials authenticated by c-client are allowed to use 
that user name.  There is a mechanism in c-client to permit setting up 
administrative users that can log in as other users; the administrative 
user uses his credentials for GSSAPI and supplies the victim's user name 
as the name to log in.

> And / or, if it wants to try using

c-client does, but only SASL mechanisms; it never uses the LOGIN command 
if the server offers SASL mechanisms.  So, if the server advertises GSSAPI 
and PLAIN, it will try GSSAPI first and then PLAIN.

Perhaps there is something wrong in PHP that causes the problem.

-- Mark --

---

From: Erik <[email-masked]>
Date: Wed, 29 Jun 2005 09:09:47 -0400

Hi-
	I've posted this bug also to RedHat (Bug # 161826) and to bugs.php.net
(33500).

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=161826
http://bugs.php.net/bug.php?id=33500

	PHP (thus far) is denying responsibility.  RedHat (thus far) suggests
that php_imap should be fixed (add another flag in the function), but
that also the c-client *should* be trying the other auth method as well.
	Thanks for everyone's help so far.

thanks,
Erik

---

From: Mark Crispin <[email-masked]>
Date: Wed, 29 Jun 2005 07:38:11 -0700 (PDT)

> that also the c-client *should* be trying the other auth method as well.

I agree that c-client should try the other authentication method, but 
perhaps my definition of "should" is different.  I don't mean "should" as 
in "should be fixed to"; I mean "should" as "it does already."

I believe that the problem is in how PHP uses c-client.

-- Mark --