CoSign: Collaborative Single Sign-On  

cosign-discuss at
general discussion of cosign development and deployment

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Cosign and cyrus imap and IMP

On 06 Nov 2004, at 06:12, Brett Lomas on vxchange wrote:
Has anyone gotten cosign working Cyrus IMAP through IMP?

This is exactly what we're running at UMich today, tho we're using Cyrus Murder, so maybe it's more complex than you require. We're also using up-imapproxy:

(which appears to be down just now) to cache IMAP connections, thus reducing load on the IMAP servers. /etc/imapproxy.conf has these lines:

	listen_port 8143

to tell it to just talk to the local proxyd and to listen on the loopback on an alternate port.

We also made a small change to proxyd: devel&msg=755

which has been accepted into the cyrus imap CVS. Cyrus proxyd is running locally on the IMP machines, with the above -N option. IMP has been modified to authenticate to port 8143 using the REMOTE_USER as provided by Cosign for both ID & password.

I've attached a picture. This set up works much better than our old setup, which used the Cosign provided TGT to make a new connection for each HTTP transaction.


Attachment: Cyrus IMP.pdf
Description: Adobe PDF document

I have gotten IMAP to work with Kerberos tickets locally and it all seems fine. When I use cosign and mod_apache on an apache 2 server I get the ticket successfully, but because of the address in the ticket, my KDC is refusing to issue the imap service ticket for it.

To get around this (at least temporarily - to test the IMP/imap GSSAPI) I did a kinit on the CC which mod_cosign created for me, then attempted again. It fails then with an error that I am not allowed to proxy (and a klist on the CC reveals a nice imap service ticket). So I added myself to the proxyservers config in imapd.conf, and then it worked. But this isn't good... it appears something (IMP) is authenticating as me and then attempting to proxy as the user apache (which the web server is running as).

Copyright © 2002 - 2004 Regents of the University of Michigan :  Page last updated 15-December-2010