Re: Cyrus IMAP + Client certificate authentication

------------=_1691091382-36196-0
Content-Language: en-US
Content-Type: multipart/signed;
 boundary=------------ms000807020806050606070105; micalg=sha-256;
 protocol="application/pkcs7-signature"
Content-Transfer-Encoding: 7bit


--------------ms000807020806050606070105
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit

Finally I convinced Thunderbird too. I had the certificate imported and 
all settings correct. Only "mistake" was to configure Thunderbird to ask 
which certificate to use for authentication. Thunderbird never asked 
me... Changing this setting to "Let Thunderbird decide which certificate 
to use" did the trick. Maybe a bug in the latest Thunderbird 115 
(Supernova)....

If anyone else is interested I would be glad to assist and share my 
configuration.

Best,

Johannes



On 03.08.2023 20:29, Ken Hornstein via SASL wrote:

>> It works when trying with openssl and the K-9 mobile client. Thunderbird
>> still refuses connection - I'll need to spent some more time.
> Thunderbird, unfortunately, doesn't have GREAT error messaging.  I have
> run into a lot of cases where the "real" error is hidden and it flattens
> down the error message to something that is generic and misleading.
> You can sometimes find the right error by setting the MOZ_LOG environment
> variable (I do not remember the format of that variable, but I am sure
> a search will give it).
>
> But I am wondering if Thunderbird even supports client certificate
> authentication?  The options I see for authentication are "Normal
> password", "Encrypted password", "Kerberos/GSSAPI", and "NTLM".  None
> of those are really client certificate authentication (and they all
> correspond to a specific SASL mechanism).  To contrast. Apple Mail lists
> all of those mechanisms but ALSO has one called "External (TLS client
> certificate)" and you explicitly pick the client certificate to use, and
> that's what I'd expect for client certificate support.  The certificate
> settings I know about in Thunderbird are for S/MIME support and those
> have nothing to do with client authentication.
>
> It sounds like from your other email that you've done all of the difficult
> bits on the Cyrus side.  I know if you crank up logging in Cyrus you
> should see if a client certificate was supplied by the client; if you
> don't even get that from Thunderbird then I suspect either Thunderbird
> doesn't support it or something else is failing early.
>
> Oh, I realize that I had actually downloaded the Thunderbird source code
> (not the latest one but not too old) for debugging purposes, and it DOES
> look like it supports EXTERNAL.  I see this in
> comm/mailnews/imap/src/nsImapProtocol.cpp:
>
>    MOZ_LOG(IMAP, LogLevel::Debug,
>            ("IMAP: trying auth method 0x%" PRIx64, m_currentAuthMethod));
>
>    if (flag & kHasAuthExternalCapability) {
>      char* base64UserName = PL_Base64Encode(userName, strlen(userName), nullptr);
>      nsAutoCString command(GetServerCommandTag());
>      command.AppendLiteral(" authenticate EXTERNAL ");
>      command.Append(base64UserName);
>      command.Append(CRLF);
>      PR_Free(base64UserName);
>      rv = SendData(command.get());
>      ParseIMAPandCheckForNewMail();
>
> I see stuff like this in ChoseAuthMethod():
>
>    MOZ_LOG(IMAP, LogLevel::Debug,
>            ("IMAP auth: server caps 0x%" PRIx64 ", pref 0x%" PRIx64
>             ", failed 0x%" PRIx64 ", avail caps 0x%" PRIx64,
>             serverCaps, m_prefAuthMethods, m_failedAuthMethods, availCaps));
>    // clang-format off
>    MOZ_LOG(IMAP, LogLevel::Debug,
>            ("(GSSAPI = 0x%" PRIx64 ", CRAM = 0x%" PRIx64 ", NTLM = 0x%" PRIx64
>             ", MSN = 0x%" PRIx64 ", PLAIN = 0x%" PRIx64 ", LOGIN = 0x%" PRIx64
>             ", old-style IMAP login = 0x%" PRIx64
>             ", auth external IMAP login = 0x%" PRIx64 ", OAUTH2 = 0x%" PRIx64 ")",
>             kHasAuthGssApiCapability, kHasCRAMCapability, kHasAuthNTLMCapability,
>             kHasAuthMSNCapability, kHasAuthPlainCapability, kHasAuthLoginCapability,
>             kHasAuthOldLoginCapability, kHasAuthExternalCapability,
>             kHasXOAuth2Capability));
>
> So that suggests to me you should be able to glean some ideas as to what
> is going on with the appropriate MOZ_LOG level.  I am wondering if you
> imported your client certificate into Thunderbird?  That would be under
> Preferences -> Privacy & Security -> Manage Certificates.
>
> --Ken
>
> ------------------------------------------
> Cyrus: SASL
> Permalink: https://cyrus.topicbox.com/groups/sasl/Tc3867934b82f1aa6-Me442139a5e56e1642e46014b
> Delivery options: https://cyrus.topicbox.com/groups/sasl/subscription

--------------ms000807020806050606070105
Content-Type: application/pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
Content-Description: S/MIME Cryptographic Signature

MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG
9w0BBwEAAKCCDXowggaMMIIEdKADAgECAhEAsIjdKBiFqVQIGBUCMN0JijAN
BgkqhkiG9w0BAQwFADBGMQswCQYDVQQGEwJOTDEZMBcGA1UEChMQR0VBTlQg
VmVyZW5pZ2luZzEcMBoGA1UEAxMTR0VBTlQgUGVyc29uYWwgQ0EgNDAeFw0y
MTExMDgwMDAwMDBaFw0yNDExMDcyMzU5NTlaMIHpMQ0wCwYDVQQREwQxMDgw
MUswSQYDVQQKDEJJbnN0aXR1dCBmw7xyIEjDtmhlcmUgU3R1ZGllbi1JbnN0
aXR1dGUgZm9yIEFkdmFuY2VkIFN0dWRpZXMgKElIUykxITAfBgNVBAkMGEpv
c2Vmc3TDpGR0ZXIgU3RyYcOfZSAzOTENMAsGA1UECBMEV2llbjENMAsGA1UE
BxMEV2llbjELMAkGA1UEBhMCQVQxGjAYBgNVBAMTEUpvaGFubmVzIEVja2hh
cmR0MSEwHwYJKoZIhvcNAQkBFhJqb2hhbm5lc0BpaHMuYWMuYXQwggEiMA0G
CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHUC7R/i9ODG+skdq8TAU3hqnc
wBtHDO6rTJFunDbSvyk3jYJiZ76wEf+fKHbR+oCDI5Sd8KqykQ1HyWwUUl8r
65NlCo6Iw8WLauUnlFLH4WNys4lTSHud0uXdd4ey0/NJAhgWr/qZlrzS2L+U
BA8+vz31CB0WEw4zQWwVMovPdd9M5fNtTYhVtOv9bra/LaeNaAKrFuRbtnGY
pGiLJwuyvNhX37QQdzJTNtaOB5TP0Gona0HqI37oKVesd2B/EVA113Elnf+v
yCKA5HKMUpeD5nDsfG+ayXEh9PEYbrg96UMCUmlIaqbiNNVOFqsNhJHQKyjk
hPIE7bIUKu7r87Y1AgMBAAGjggHPMIIByzAfBgNVHSMEGDAWgBRpAKHHIVj4
4MUbILAK3adRvxPZ5DAdBgNVHQ4EFgQUyJoz+WNI7uAeTqJ0j6hCWrMbYpIw
DgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwHQYDVR0lBBYwFAYIKwYB
BQUHAwQGCCsGAQUFBwMCMD8GA1UdIAQ4MDYwNAYLKwYBBAGyMQECAk8wJTAj
BggrBgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9DUFMwQgYDVR0fBDsw
OTA3oDWgM4YxaHR0cDovL0dFQU5ULmNybC5zZWN0aWdvLmNvbS9HRUFOVFBl
cnNvbmFsQ0E0LmNybDB4BggrBgEFBQcBAQRsMGowPQYIKwYBBQUHMAKGMWh0
dHA6Ly9HRUFOVC5jcnQuc2VjdGlnby5jb20vR0VBTlRQZXJzb25hbENBNC5j
cnQwKQYIKwYBBQUHMAGGHWh0dHA6Ly9HRUFOVC5vY3NwLnNlY3RpZ28uY29t
ME0GA1UdEQRGMESBG0pvaGFubmVzLkVja2hhcmR0QGlocy5hYy5hdIERaG90
bGluZUBpaHMuYWMuYXSBEmpvaGFubmVzQGlocy5hYy5hdDANBgkqhkiG9w0B
AQwFAAOCAgEAk88tD84oCgTEVZUmI2WatrEAYK2lSl7xePrLvd+EP5ttSnRr
I/SdaMOW8QtyiQJEL0EuZ7+Ps44Ltxh99FeDFrcmqIMreH81iEBzauDapCZP
IeUEk8bRaK4qSsE+uhwfYwR0wcONpXq9kl6f1VOgYsnjsNAw7/3ohegShKyB
XijTuVC4XYNTIREXC/hmOy+ai8/SaFOIBumbIz9TZnmmgmu7w+jutmZv2ZoB
OtUdJzWL6fPXdz36FY4oNlayKY2Er+keJBsa6Lt/SUcqOEArqGaGT08n2Rdi
qyt+RVxe6CtdljcB9R1cT0/dxnlf6a8hkiZPeiW7lfJlZYLBWD8jbT35BCuL
9XEbn/pU41Q2h7+FF0n5YRqd0S6730onoVrNsCkY8xBJK95KGTuQnUwUfnp+
Ng8WdVHOa7u8OYnrWfK7wFgQ7DK+zFK7pRM+cY8Sf13IVJQ7CobRwQjyOHQd
fTwpeDr5k0mhkMiR95MbfLNI7CfG0IUiGktoJg6N/o+6bpjiJYnbTSgzmMT+
D2bOHiCLI9nDmqSovx45R/i82bhTHgkhQ6fr+INeSYI5TNuiKkcHhzaOmoD6
LzMnq1KntnVt7XQwHC/2Gem+FSCPwRi4QkCCDQSxftzygJh9772EgbQEtZD6
cn8Hcl8elJCcIOJbCsgx7rulpOKXV5xvq+8wggbmMIIEzqADAgECAhAxAnDU
Nb6bJJr4VtDh4oVJMA0GCSqGSIb3DQEBDAUAMIGIMQswCQYDVQQGEwJVUzET
MBEGA1UECBMKTmV3IEplcnNleTEUMBIGA1UEBxMLSmVyc2V5IENpdHkxHjAc
BgNVBAoTFVRoZSBVU0VSVFJVU1QgTmV0d29yazEuMCwGA1UEAxMlVVNFUlRy
dXN0IFJTQSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0yMDAyMTgwMDAw
MDBaFw0zMzA1MDEyMzU5NTlaMEYxCzAJBgNVBAYTAk5MMRkwFwYDVQQKExBH
RUFOVCBWZXJlbmlnaW5nMRwwGgYDVQQDExNHRUFOVCBQZXJzb25hbCBDQSA0
MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAs0riIl4nW+kEWxQE
NTIgFK600jFAxs1QwB6hRMqvnkphfy2Q3mKbM2otpELKlgE8/3AQPYBo7p7y
eORuPMnAuA+oMGRb2wbeSaLcZbpwXgfCvnKxmq97/kQkOFX706F9O7/h0yeh
HhDjUdyMyT0zMs4AMBDRrAFn/b2vR3j0BSYgoQs16oSqadM3p+d0vvH/YrRM
tOhkvGpLuzL8m+LTAQWvQJ92NwCyKiHspoP4mLPJvVpEpDMnpDbRUQdftSpZ
zVKTNORvPrGPRLnJ0EEVCHR82LL6oz915WkrgeCY9ImuulBn4uVsd9ZpubCg
M/EXvVBlViKqusChSsZEn7juIsGIiDyaIhhLsd3amm8BS3bgK6AxdSMROND6
hiHT182Lmf8C+gRHxQG9McvG35uUvRu8v7bPZiJRaT7ZC2f50P4lTlnbLvWp
Xv5yv7hheO8bMXltiyLweLB+VNvg+GnfL6TW3Aq1yF1yrZAZzR4MbpjTWdEd
SLKvz8+0wCwscQ81nbDOwDt9vyZ+0eJXbRkWZiqScnwAg5/B1NUD4TrYlrI4
n6zFp2pyYUOiuzP+as/AZnz63GvjFK69WODR2W/TK4D7VikEMhg18vhuRf4h
xnWZOy0vhfDR/g3aJbdsGac+diahjEwzyB+UKJOCyzvecG8bZ/u/U8PsEMZg
07iIPi8CAwEAAaOCAYswggGHMB8GA1UdIwQYMBaAFFN5v1qqK0rPVIDh2JvA
nfKyA2bLMB0GA1UdDgQWBBRpAKHHIVj44MUbILAK3adRvxPZ5DAOBgNVHQ8B
Af8EBAMCAYYwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHSUEFjAUBggrBgEF
BQcDAgYIKwYBBQUHAwQwOAYDVR0gBDEwLzAtBgRVHSAAMCUwIwYIKwYBBQUH
AgEWF2h0dHBzOi8vc2VjdGlnby5jb20vQ1BTMFAGA1UdHwRJMEcwRaBDoEGG
P2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZp
Y2F0aW9uQXV0aG9yaXR5LmNybDB2BggrBgEFBQcBAQRqMGgwPwYIKwYBBQUH
MAKGM2h0dHA6Ly9jcnQudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FBZGRU
cnVzdENBLmNydDAlBggrBgEFBQcwAYYZaHR0cDovL29jc3AudXNlcnRydXN0
LmNvbTANBgkqhkiG9w0BAQwFAAOCAgEACgVOew2PHxM5AP1v7GLGw+3tF6rj
Acx43D9Hl110Q+BABABglkrPkES/VyMZsfuds8fcDGvGE3o5UfjSno4sij0x
dKut8zMazv8/4VMKPCA3EUS0tDUoL01ugDdqwlyXuYizeXyH2ICAQfXMtS+r
az7mf741CZvO50OxMUMxqljeRfVPDJQJNHOYi2pxuxgjKDYx4hdZ9G2o+oLl
Hhu5+anMDkE8g0tffjRKn8I1D1BmrDdWR/IdbBOj6870abYvqys1qYlPotv5
N5dm+XxQ8vlrvY7+kfQaAYeO3rP1DM8BGdpEqyFVa+I0rpJPhaZkeWW7cImD
QFerHW9bKzBrCC815a3WrEhNpxh72ZJZNs1HYJ+29NTB6uu4NJjaMxpk+g2p
uNSm4b9uVjBbPO9V6sFSG+IBqE9ckX/1XjzJtY8Grqoo4SiRb6zcHhp3mxj3
oqWi8SKNohAOKnUc7RIP6ss1hqIFyv0xXZor4N9tnzD0Fo0JDIURjDPEgo5W
Tdti/MdGTmKFQNqxyZuT9uSI2Xvhz8p+4pCYkiZqpahZlHqMFxdw9XRZQgrP
+cgtOkWEaiNkRBbvtvLdp7MCL2OsQhQEdEbUvDM9slzZXdI7NjJokVBq3O4p
ls3VD2z3L/bHVBe0rBERjyM2C/HSIh84rfmAqBgklzIOqXhd+4RzadUxggM7
MIIDNwIBATBbMEYxCzAJBgNVBAYTAk5MMRkwFwYDVQQKExBHRUFOVCBWZXJl
bmlnaW5nMRwwGgYDVQQDExNHRUFOVCBQZXJzb25hbCBDQSA0AhEAsIjdKBiF
qVQIGBUCMN0JijANBglghkgBZQMEAgEFAKCCAbEwGAYJKoZIhvcNAQkDMQsG
CSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMjMwODAzMTkzNTA2WjAvBgkq
hkiG9w0BCQQxIgQgPgZrXGeOhnXeT8p6rJWrR1SYB6o9XkPqhn4+HrTf5o8w
agYJKwYBBAGCNxAEMV0wWzBGMQswCQYDVQQGEwJOTDEZMBcGA1UEChMQR0VB
TlQgVmVyZW5pZ2luZzEcMBoGA1UEAxMTR0VBTlQgUGVyc29uYWwgQ0EgNAIR
ALCI3SgYhalUCBgVAjDdCYowbAYJKoZIhvcNAQkPMV8wXTALBglghkgBZQME
ASowCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqGSIb3DQMCAgIAgDAN
BggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDBsBgsqhkiG
9w0BCRACCzFdoFswRjELMAkGA1UEBhMCTkwxGTAXBgNVBAoTEEdFQU5UIFZl
cmVuaWdpbmcxHDAaBgNVBAMTE0dFQU5UIFBlcnNvbmFsIENBIDQCEQCwiN0o
GIWpVAgYFQIw3QmKMA0GCSqGSIb3DQEBAQUABIIBACPmDnkLjETJmAI1YNA7
ivyPusOXhD6pnCjBpygOS7o6DPrzgF8xv45850SosfrYKITZP2+h3eZBRCeR
xvn07nh1oG2iSnsiugaP2eTDT1xVN6VH7lFedUqsS5IB57vYht0JNtMK441g
B/hBufSSke38oD0hIoC9IDrGBkPs+mOXnCPOvF3ezCK65ilT8Xng5CN657+j
+m9MrFaKBv16l8YNVjNBOvh6o77GKridHAb9KtZblDHguOuYL5g1xRR+E5oG
P0YxqYSuU+52gXNHKKOsOKh4tqVjseJepQeFFK+gjZs/6xXwouS1K68RN7LS
zunQgaXLnmYMSG+KH/8Ez00AAAAAAAA=

--------------ms000807020806050606070105--

------------=_1691091382-36196-0
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-Mailer: MIME-tools 5.508 (Entity 5.508)


------------------------------------------
Cyrus: SASL
Permalink: https://cyrus.topicbox.com/groups/sasl/Tc3867934b82f1aa6-M41d324=
512a8e396105fa8b09
Delivery options: https://cyrus.topicbox.com/groups/sasl/subscription

------------=_1691091382-36196-0--