240778 - Request for feature: GSSAPI authentication in IMAP and (possibly) SMTP

Status: RESOLVED DUPLICATE of bug 28200

(MailNews Core :: Networking: IMAP, enhancement)

Description

[Giuseppe Paterno']

User-Agent:       Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7b) Gecko/20040316

Dear developers, I really appreciated the inclusion of SPNEGO in Mozilla 1.7.
I wish to have the support of GSSAPI (i.e. Kerberos V) authentication in IMAP 
and (possibly) also in the SMTP.
Thank you!


Reproducible: Always
Steps to Reproduce:
1.
2.
3.




It would be great to have it cross-platform.

Comment 1

[David :Bienvenu]

We have support for HTTP GSSAPI but it hasn't been extended to mailnews yet. It
looks like it requires an http channel, though this is just to get a uri (though
I 'm not sure if this is true for the other nsIHttpAuthenticator's)

Comment 2

[Darin Fisher]

So, we have to factor the GSSAPI auth code into an implementation of
nsIAuthModule, which will require changing that interface slightly.  Then we
need to implement the HTTP authenticator in terms of that component.  This is
something that I am currently working on because I also want to implement SPNEGO
using SSPI on Win32.

Comment 3

[Marius Strumyla]

Attachment: smtp log

I have set to use username and password for STMP. tbird0.6 asks me for a
password and then I get relaying prohibited error. It used to work some time
ago but then it stopped. 
If I select save password with passwd manager, the passwd manager contains
smtp:// entry but it doesn't have a username, only <>.

Comment 4

[Marius Strumyla]

wrong bug. i meant bug 239376. sorry

Comment 5

[Ben Bucksch (:BenB)]

Possibly dup of bug 28200.

Comment 6

[Wyllys Ingersoll]

This requires SASL support.

The GSSAPI support added for the negotiateauth feature will not work for IMAP
and SMTP authentication.  The IETF standard for auth in these situations is to
use SASL with GSSAPI.   There are  plenty of SASL implementations available,
Cyrus SASL is freely available on most Linux distros, Solaris 10 has a native
SASL library (based on Cyrus) and I think even Microsoft has SASL support.  

Adding SASL-GSSAPI would extend the single-sign on capabilities of the MOzilla
suite to mail clients which is highly desirable in security conscious enterprises.

Comment 7

[Wyllys Ingersoll]

*** Bug 279799 has been marked as a duplicate of this bug. ***

Comment 8

[Wyllys Ingersoll]

This is a dup of 28200, I should have read that one before posting here.
Someone should close this as a duplicate.

Comment 9

[Ben Bucksch (:BenB)]

*** This bug has been marked as a duplicate of 28200 ***