Re: Cyrus IMAP + Client certificate authentication

------------=_1691057793-985476-0
Content-Language: en-US
Content-Type: multipart/signed;
 boundary=------------ms050000060501010002080209; micalg=sha-256;
 protocol="application/pkcs7-signature"
Content-Transfer-Encoding: 7bit


--------------ms050000060501010002080209
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit

Thanks for your thoughts about that. Just one stupid question: How do I 
tell cyrus-imap to accept TLS certificate at login? Should be possible 
with SASL/EXTERNAL, right? If I add EXTERNAL to sasl_mech_list that 
changes nothing. Trying to connect with Thunderbird (configured to 
authenticate with a TLS certificate) it tells me the authentication 
method isn't supported by the server.

Johannes


>> I'm looking for some information to setup cyrus imap authentication with
>> client certificates. Anyone here to give me some advise? Tried to google
>> ist but without success. Any help would be appreciated!!
> Strangely enough, this came up AGAIN for me so I decided to trace this
> down.  I haven't tested it, but here's what I believe to be true:
>
> 1) When you submit a client certificate as part of the TLS exchange
>     the "authenticated name" is set to value of the commonName portion
>     of the client certificate's subject.
> 2) The "authorization id" can be optionally passed in as part of the
>     SASL EXTERNAL authentication by the client.  If it isn't passed in
>     then the authorization id defaults to the authenticated name.
> 3) Both of these identities are subject to routines that can "canonify"
>     a name, and it's possible that could do a lookup via LDAP if it is
>     configured correctly but I don't know the details there.
> 4) There are two ways to allow access to a Cyrus account: you can have the
>     authenticated name match the account name, OR you can set "loginuseacl"
>     to "1" and give the authenticated name "a" rights to the INBOX.
>
> So, for example, if you have a client certificate with a common name of
> "foo", and you want to login to the Cyrus "foo" account, then that's easy.
> If you have a client certificate with a common name of "MISTER.FOO" and
> you want to login to the Cyrus "foo" account, the simplest thing might be
> set loginuseacl and give MISTER.FOO admin rights to the "foo" INBOX.
>
> I suspect your pain points will be (a) configuring all of the certificate
> stuff correctly and (b) figuring out the right magic on the clients to
> make it send the client certificate _and_ the correct authorization id.
>
> --Ken
>
> ------------------------------------------
> Cyrus: SASL
> Permalink: https://cyrus.topicbox.com/groups/sasl/Tc3867934b82f1aa6-M0aab7e4ee4f9374ab5168454
> Delivery options: https://cyrus.topicbox.com/groups/sasl/subscription

--------------ms050000060501010002080209
Content-Type: application/pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
Content-Description: S/MIME Cryptographic Signature

MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG
9w0BBwEAAKCCDXowggaMMIIEdKADAgECAhEAsIjdKBiFqVQIGBUCMN0JijAN
BgkqhkiG9w0BAQwFADBGMQswCQYDVQQGEwJOTDEZMBcGA1UEChMQR0VBTlQg
VmVyZW5pZ2luZzEcMBoGA1UEAxMTR0VBTlQgUGVyc29uYWwgQ0EgNDAeFw0y
MTExMDgwMDAwMDBaFw0yNDExMDcyMzU5NTlaMIHpMQ0wCwYDVQQREwQxMDgw
MUswSQYDVQQKDEJJbnN0aXR1dCBmw7xyIEjDtmhlcmUgU3R1ZGllbi1JbnN0
aXR1dGUgZm9yIEFkdmFuY2VkIFN0dWRpZXMgKElIUykxITAfBgNVBAkMGEpv
c2Vmc3TDpGR0ZXIgU3RyYcOfZSAzOTENMAsGA1UECBMEV2llbjENMAsGA1UE
BxMEV2llbjELMAkGA1UEBhMCQVQxGjAYBgNVBAMTEUpvaGFubmVzIEVja2hh
cmR0MSEwHwYJKoZIhvcNAQkBFhJqb2hhbm5lc0BpaHMuYWMuYXQwggEiMA0G
CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHUC7R/i9ODG+skdq8TAU3hqnc
wBtHDO6rTJFunDbSvyk3jYJiZ76wEf+fKHbR+oCDI5Sd8KqykQ1HyWwUUl8r
65NlCo6Iw8WLauUnlFLH4WNys4lTSHud0uXdd4ey0/NJAhgWr/qZlrzS2L+U
BA8+vz31CB0WEw4zQWwVMovPdd9M5fNtTYhVtOv9bra/LaeNaAKrFuRbtnGY
pGiLJwuyvNhX37QQdzJTNtaOB5TP0Gona0HqI37oKVesd2B/EVA113Elnf+v
yCKA5HKMUpeD5nDsfG+ayXEh9PEYbrg96UMCUmlIaqbiNNVOFqsNhJHQKyjk
hPIE7bIUKu7r87Y1AgMBAAGjggHPMIIByzAfBgNVHSMEGDAWgBRpAKHHIVj4
4MUbILAK3adRvxPZ5DAdBgNVHQ4EFgQUyJoz+WNI7uAeTqJ0j6hCWrMbYpIw
DgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwHQYDVR0lBBYwFAYIKwYB
BQUHAwQGCCsGAQUFBwMCMD8GA1UdIAQ4MDYwNAYLKwYBBAGyMQECAk8wJTAj
BggrBgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9DUFMwQgYDVR0fBDsw
OTA3oDWgM4YxaHR0cDovL0dFQU5ULmNybC5zZWN0aWdvLmNvbS9HRUFOVFBl
cnNvbmFsQ0E0LmNybDB4BggrBgEFBQcBAQRsMGowPQYIKwYBBQUHMAKGMWh0
dHA6Ly9HRUFOVC5jcnQuc2VjdGlnby5jb20vR0VBTlRQZXJzb25hbENBNC5j
cnQwKQYIKwYBBQUHMAGGHWh0dHA6Ly9HRUFOVC5vY3NwLnNlY3RpZ28uY29t
ME0GA1UdEQRGMESBG0pvaGFubmVzLkVja2hhcmR0QGlocy5hYy5hdIERaG90
bGluZUBpaHMuYWMuYXSBEmpvaGFubmVzQGlocy5hYy5hdDANBgkqhkiG9w0B
AQwFAAOCAgEAk88tD84oCgTEVZUmI2WatrEAYK2lSl7xePrLvd+EP5ttSnRr
I/SdaMOW8QtyiQJEL0EuZ7+Ps44Ltxh99FeDFrcmqIMreH81iEBzauDapCZP
IeUEk8bRaK4qSsE+uhwfYwR0wcONpXq9kl6f1VOgYsnjsNAw7/3ohegShKyB
XijTuVC4XYNTIREXC/hmOy+ai8/SaFOIBumbIz9TZnmmgmu7w+jutmZv2ZoB
OtUdJzWL6fPXdz36FY4oNlayKY2Er+keJBsa6Lt/SUcqOEArqGaGT08n2Rdi
qyt+RVxe6CtdljcB9R1cT0/dxnlf6a8hkiZPeiW7lfJlZYLBWD8jbT35BCuL
9XEbn/pU41Q2h7+FF0n5YRqd0S6730onoVrNsCkY8xBJK95KGTuQnUwUfnp+
Ng8WdVHOa7u8OYnrWfK7wFgQ7DK+zFK7pRM+cY8Sf13IVJQ7CobRwQjyOHQd
fTwpeDr5k0mhkMiR95MbfLNI7CfG0IUiGktoJg6N/o+6bpjiJYnbTSgzmMT+
D2bOHiCLI9nDmqSovx45R/i82bhTHgkhQ6fr+INeSYI5TNuiKkcHhzaOmoD6
LzMnq1KntnVt7XQwHC/2Gem+FSCPwRi4QkCCDQSxftzygJh9772EgbQEtZD6
cn8Hcl8elJCcIOJbCsgx7rulpOKXV5xvq+8wggbmMIIEzqADAgECAhAxAnDU
Nb6bJJr4VtDh4oVJMA0GCSqGSIb3DQEBDAUAMIGIMQswCQYDVQQGEwJVUzET
MBEGA1UECBMKTmV3IEplcnNleTEUMBIGA1UEBxMLSmVyc2V5IENpdHkxHjAc
BgNVBAoTFVRoZSBVU0VSVFJVU1QgTmV0d29yazEuMCwGA1UEAxMlVVNFUlRy
dXN0IFJTQSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0yMDAyMTgwMDAw
MDBaFw0zMzA1MDEyMzU5NTlaMEYxCzAJBgNVBAYTAk5MMRkwFwYDVQQKExBH
RUFOVCBWZXJlbmlnaW5nMRwwGgYDVQQDExNHRUFOVCBQZXJzb25hbCBDQSA0
MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAs0riIl4nW+kEWxQE
NTIgFK600jFAxs1QwB6hRMqvnkphfy2Q3mKbM2otpELKlgE8/3AQPYBo7p7y
eORuPMnAuA+oMGRb2wbeSaLcZbpwXgfCvnKxmq97/kQkOFX706F9O7/h0yeh
HhDjUdyMyT0zMs4AMBDRrAFn/b2vR3j0BSYgoQs16oSqadM3p+d0vvH/YrRM
tOhkvGpLuzL8m+LTAQWvQJ92NwCyKiHspoP4mLPJvVpEpDMnpDbRUQdftSpZ
zVKTNORvPrGPRLnJ0EEVCHR82LL6oz915WkrgeCY9ImuulBn4uVsd9ZpubCg
M/EXvVBlViKqusChSsZEn7juIsGIiDyaIhhLsd3amm8BS3bgK6AxdSMROND6
hiHT182Lmf8C+gRHxQG9McvG35uUvRu8v7bPZiJRaT7ZC2f50P4lTlnbLvWp
Xv5yv7hheO8bMXltiyLweLB+VNvg+GnfL6TW3Aq1yF1yrZAZzR4MbpjTWdEd
SLKvz8+0wCwscQ81nbDOwDt9vyZ+0eJXbRkWZiqScnwAg5/B1NUD4TrYlrI4
n6zFp2pyYUOiuzP+as/AZnz63GvjFK69WODR2W/TK4D7VikEMhg18vhuRf4h
xnWZOy0vhfDR/g3aJbdsGac+diahjEwzyB+UKJOCyzvecG8bZ/u/U8PsEMZg
07iIPi8CAwEAAaOCAYswggGHMB8GA1UdIwQYMBaAFFN5v1qqK0rPVIDh2JvA
nfKyA2bLMB0GA1UdDgQWBBRpAKHHIVj44MUbILAK3adRvxPZ5DAOBgNVHQ8B
Af8EBAMCAYYwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHSUEFjAUBggrBgEF
BQcDAgYIKwYBBQUHAwQwOAYDVR0gBDEwLzAtBgRVHSAAMCUwIwYIKwYBBQUH
AgEWF2h0dHBzOi8vc2VjdGlnby5jb20vQ1BTMFAGA1UdHwRJMEcwRaBDoEGG
P2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZp
Y2F0aW9uQXV0aG9yaXR5LmNybDB2BggrBgEFBQcBAQRqMGgwPwYIKwYBBQUH
MAKGM2h0dHA6Ly9jcnQudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FBZGRU
cnVzdENBLmNydDAlBggrBgEFBQcwAYYZaHR0cDovL29jc3AudXNlcnRydXN0
LmNvbTANBgkqhkiG9w0BAQwFAAOCAgEACgVOew2PHxM5AP1v7GLGw+3tF6rj
Acx43D9Hl110Q+BABABglkrPkES/VyMZsfuds8fcDGvGE3o5UfjSno4sij0x
dKut8zMazv8/4VMKPCA3EUS0tDUoL01ugDdqwlyXuYizeXyH2ICAQfXMtS+r
az7mf741CZvO50OxMUMxqljeRfVPDJQJNHOYi2pxuxgjKDYx4hdZ9G2o+oLl
Hhu5+anMDkE8g0tffjRKn8I1D1BmrDdWR/IdbBOj6870abYvqys1qYlPotv5
N5dm+XxQ8vlrvY7+kfQaAYeO3rP1DM8BGdpEqyFVa+I0rpJPhaZkeWW7cImD
QFerHW9bKzBrCC815a3WrEhNpxh72ZJZNs1HYJ+29NTB6uu4NJjaMxpk+g2p
uNSm4b9uVjBbPO9V6sFSG+IBqE9ckX/1XjzJtY8Grqoo4SiRb6zcHhp3mxj3
oqWi8SKNohAOKnUc7RIP6ss1hqIFyv0xXZor4N9tnzD0Fo0JDIURjDPEgo5W
Tdti/MdGTmKFQNqxyZuT9uSI2Xvhz8p+4pCYkiZqpahZlHqMFxdw9XRZQgrP
+cgtOkWEaiNkRBbvtvLdp7MCL2OsQhQEdEbUvDM9slzZXdI7NjJokVBq3O4p
ls3VD2z3L/bHVBe0rBERjyM2C/HSIh84rfmAqBgklzIOqXhd+4RzadUxggM7
MIIDNwIBATBbMEYxCzAJBgNVBAYTAk5MMRkwFwYDVQQKExBHRUFOVCBWZXJl
bmlnaW5nMRwwGgYDVQQDExNHRUFOVCBQZXJzb25hbCBDQSA0AhEAsIjdKBiF
qVQIGBUCMN0JijANBglghkgBZQMEAgEFAKCCAbEwGAYJKoZIhvcNAQkDMQsG
CSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMjMwODAzMTAxNTI4WjAvBgkq
hkiG9w0BCQQxIgQgXtW8ccBkyG6DBAslLc+ZpeDZKx3P7LP3mtZpUpUpO9Mw
agYJKwYBBAGCNxAEMV0wWzBGMQswCQYDVQQGEwJOTDEZMBcGA1UEChMQR0VB
TlQgVmVyZW5pZ2luZzEcMBoGA1UEAxMTR0VBTlQgUGVyc29uYWwgQ0EgNAIR
ALCI3SgYhalUCBgVAjDdCYowbAYJKoZIhvcNAQkPMV8wXTALBglghkgBZQME
ASowCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqGSIb3DQMCAgIAgDAN
BggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDBsBgsqhkiG
9w0BCRACCzFdoFswRjELMAkGA1UEBhMCTkwxGTAXBgNVBAoTEEdFQU5UIFZl
cmVuaWdpbmcxHDAaBgNVBAMTE0dFQU5UIFBlcnNvbmFsIENBIDQCEQCwiN0o
GIWpVAgYFQIw3QmKMA0GCSqGSIb3DQEBAQUABIIBAClJDNU19GnxPRo0ZCba
WarZH9DDY76v1cRBRP2e+QarepWwq2fgi3h0Ohkk+H8hZyFgHAgpzOm+3SWh
GE6muwBA9lhZTHqGYmM1DCrSREMdQiVVxt6HQ8ceJtuQCSBMNQljt45kh+yj
dvdd63WQchDhtH3S8SxGygPhfVGoCQYpnCIKSmRI9FYNzezkA9PGo/bKesao
ffnsHY7C91g58Uhgcev9jnfGWFTpZdBcVN5yXnxVULVtzsCfolS6jA0u1sIp
kxZKoJjNWd5ZCLuIivjOi+AWkItDwZwG0Pq169iHxBEf77Q+pgMNRHiCgPvX
Pj1pxOTp2ZyNVy5rO7SPL5AAAAAAAAA=

--------------ms050000060501010002080209--

------------=_1691057793-985476-0
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-Mailer: MIME-tools 5.508 (Entity 5.508)


------------------------------------------
Cyrus: SASL
Permalink: https://cyrus.topicbox.com/groups/sasl/Tc3867934b82f1aa6-Med8b82=
c4563b3d8b865fab5e
Delivery options: https://cyrus.topicbox.com/groups/sasl/subscription

------------=_1691057793-985476-0--