mailing list archives

I have been tasked to identify which IMAP servers support the SASL concept
of authorization vs. authentication ID and if it is suitable to allow
impersonation; that is to proxy to various user accounts.

I have the following data:

Panda IMAP:		Yes
 	;; Authenticated userids in system group "mailadm" may authorize
 	;; to any other userid.

UW IMAP:		Yes, in newer versions
 	;; Same as Panda


Probably yes, but not sure and need details:

Cyrus:
Dovecot:
Communigate Pro:
Sendmail:
Zimbra:

-- Mark --

http://panda.com/mrc
Democracy is two wolves and a sheep deciding what to eat for lunch.
Liberty is a well-armed sheep contesting the vote.

Hi Mark,

On 13/01/2012 15:44, Mark Crispin wrote:
> I have been tasked to identify which IMAP servers support the SASL 
> concept
> of authorization vs. authentication ID and if it is suitable to allow
> impersonation; that is to proxy to various user accounts.
>
> I have the following data:
>
> Panda IMAP:        Yes
>     ;; Authenticated userids in system group "mailadm" may authorize
>     ;; to any other userid.
>
> UW IMAP:        Yes, in newer versions
>     ;; Same as Panda

Isode M-Box supports that as well. A user configured in the "admin_user" 
option in ms.conf (configuration file) can act as any other user. This 
feature can be disabled by not providing the "admin_user" option value.

On 01/13/12?07:44?-0800, Mark Crispin wrote:
>I have been tasked to identify which IMAP servers support the SASL concept
>of authorization vs. authentication ID and if it is suitable to allow
>impersonation; that is to proxy to various user accounts.
>
>I have the following data:
>
>Panda IMAP:		Yes
>	;; Authenticated userids in system group "mailadm" may authorize
>	;; to any other userid.
>
>UW IMAP:		Yes, in newer versions
>	;; Same as Panda
>
>
>Probably yes, but not sure and need details:
>
>Cyrus:
>Dovecot:
>Communigate Pro:
>Sendmail:
>Zimbra:

Cyrus supports this function using the 'proxyservers' configuration option.
See:

http://www.cyrusimap.org/docs/cyrus-imapd/2.4.13/man/imapd.conf.5.php
http://www.cyrusimap.org/docs/cyrus-imapd/2.4.13/install-murder.php

Fine grained control can be accomplished by delegating 'a' ACL rights for
a user's INBOX and then enabling the 'loginuseacl' config option:

-- 
Dan White

On Jan 13, 2012 at 07:44 -0800, Mark Crispin wrote:
=>I have been tasked to identify which IMAP servers support the SASL concept
=>of authorization vs. authentication ID and if it is suitable to allow
=>impersonation; that is to proxy to various user accounts.
=>
=>I have the following data:
=>
=>Panda IMAP:		Yes
=>	;; Authenticated userids in system group "mailadm" may authorize
=>	;; to any other userid.
=>
=>UW IMAP:		Yes, in newer versions
=>	;; Same as Panda
=>
=>
=>Probably yes, but not sure and need details:
=>
=>Cyrus:
=>Dovecot:
=>Communigate Pro:
=>Sendmail:
=>Zimbra:

Non-Authoritative answer as I am just a admin/user, but

Sun's Communication Suite, now know as Oracle Communications Messaging 
Exchange Server seems to per

<https://wikis.oracle.com/pages/viewpage.action?pageId=15467378>


(We use the non-standard PROXYAUTH command with the imapsync perl script 
for mailbox migrations, etc.)

-- 
***********************************************************************
Derek Diget                            Office of Information Technology
Western Michigan University - Kalamazoo  Michigan  USA - www.wmich.edu/
***********************************************************************

> I have been tasked to identify which IMAP servers support the SASL
> concept of authorization vs. authentication ID and if it is suitable
> to allow impersonation; that is to proxy to various user accounts.

Zimbra supports this.  (I won't get into the details of the rules that
govern when a given authzid/authcid pair will work unless you really
care.  It can get complicated.)

- Dan

On 13.1.2012, at 17.44, Mark Crispin wrote:

> I have been tasked to identify which IMAP servers support the SASL concept
> of authorization vs. authentication ID and if it is suitable to allow
> impersonation; that is to proxy to various user accounts.

Yes, Dovecot supports as well. It can be configured to work pretty much any way you want.

Actually this week there was an interesting use case for it, kind of the reverse of what is normally done: Shared mailboxes are accessed via one shared user account, but each user logs in with their own authentication ID so they get different access to the mailboxes because they have different ACLs. (All of this is actually hidden from the user, they don't configure this in their clients.)

On Fri, 13 Jan 2012, Mark Crispin wrote:
> I have been tasked to identify which IMAP servers support the SASL concept
> of authorization vs. authentication ID and if it is suitable to allow
> impersonation; that is to proxy to various user accounts.

Sendmail: yes
	;; proxy authorization can be permitted based on LDAP attributes
	;; marking accounts as delegatees


Philip