[Kolab-devel] Single-Sign-On for IMAP (was: Re: Kolab and FreeIPA article)

Jochen Hein <[email protected]> Fri, 05 Oct 2018 22:52:19 +0200

Newsgroups	gmane.comp.kde.devel.kolab,gmane.comp.kde.kolab.user
Message-ID	<83woqwxgjg.fsf_-___23188.2014581517$1538772647$gmane$org@jochen.org>

kvaps <[email protected]> writes:

> OK, here is my article about Kolab and FreeIPA integration:
>
> https://medium.com/@kvapss/install-kolab-and-integrate-it-with-freeipa-c80c3b34b7b7

Here's what is needed to activate SSO with IMAP.  Thunderbird works
fine.  Feedback and comments are welcome - sasl config has been tricky.

# IMAP
ipa-getkeytab -p imap/[email protected] -k /etc/cyrus.keytab
# keytab is only accessible for cyrus
chmod 600 /etc/cyrus.keytab
chown cyrus:root /etc/cyrus.keytab

# sieve
ipa-getkeytab -p sieve/[email protected] -k /etc/sieve.keytab
# keytab is only accessible for cyrus
chmod 600 /etc/sieve.keytab
chown cyrus:root /etc/sieve.keytab

# That's what is needed in /etc/imapd.conf:
# sasl_mech_list: PLAIN LOGIN GSSAPI
# sasl_keytab: /etc/cyrus.keytab
# sasl_saslauthd_path: /var/run/saslauthd/mux
# sieve_sasl_keytab: /etc/sieve.keytab
# loginrealms: EXAMPLE.ORG

-- 
This space is intentionally left blank.