Subject: RE: Perdition IMAP Proxy

From: "Sobocinski, Todd" <[email-masked]>
Date: Fri, 9 Jul 2004 10:42:13 -0400

Mark,

Assuming you support SSL/TLS, how do you get around matching a server
certificate CN to each of your per-user DNS entries?  Do you use
wildcard certificates?

Todd

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Mark Crispin
Sent: Thursday, July 08, 2004 2:16 PM
To: Brad Arlt
Cc: [email-masked]
Subject: Re: Perdition IMAP Proxy

On Thu, 8 Jul 2004, Brad Arlt wrote:
> Perdition is meant to allow you to have "one" imap server, as far as 
> your users are concerned, and as many real IMAP servers as needed. 
> Perdition chooses the correct server for each user, and proxies the 
> connection to it for the user.  This can also be handled using 
> LOGIN-REFERRALS but sadly not all mail clients support this.

That seems to be a lot of ongoing (and permanent) work and resources
just 
to avoid a simple one-time user configuration.

You can simply have a special DNS zone in which each user is registered 
and points to the correct IMAP server, and dispense with proxies.

mrc.deskmail.washington.edu always points to mrc's IMAP server, even 
though the machine changes over time.

The experience at UW has shown that this is not particularly difficult
to 
explain even to novice users.

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.
Si vis pacem, para bellum.

---

From: Mark Crispin <[email-masked]>
Date: Fri, 9 Jul 2004 10:47:43 -0700 (PDT)

> certificate CN to each of your per-user DNS entries?  Do you use

Yes, we use wildcard certificates.

By the way, the DNS server for that zone is tied to the accounting system, 
as opposed to having manually-edited zone files.

-- Mark --