Re: [PATCH] GSSAPI authentication for nnimap

[Jochen Hein <jochen@jochen.org>]

Lars Ingebrigtsen <larsi@gnus.org> writes:

> Jochen Hein <jochen@jochen.org> writes:
>
>> The following patches add GSSAPI support to nnimap.  I'll comment what I
>> did and why above each patch.  I'm currently cloning the emacs
>> repository and I hope to forward port the patches and add/adapt the
>> documentation accordingly.
>
> Great!

Except that nnimap didn't work for me at all - I'll have a look, but
might want to wait after the cleanup frenzy is over :-)  I've also seem
some fixes already...

While you're at it - it might be a good idea to move starttls.el and
gssapi.el from lisp/gnus to lisp/net.  Both are used by
network-stream.el.  tls.el is already there.

There's also net/imap.el - which also claims to handle GSSAPI.  I have
no idea if that's in use anywhere.

>> I currently know of one difference between gsasl and imtest: connections
>> with gsasl use TLS, imtest doesn't.  If we want that, we can add '-t ""'
>> to the imtest call according to the imtest manpage:
>>
>>        -t keyfile
>>                      Enable TLS.  keyfile contains the TLS public and
>>                      private keys.  Specify "" to negotiate a TLS
>>                      encryption layer but not use TLS authentication.
>>
>> Another option could be to handle STARTTLS in
>> network-stream-open-gssapi.  For my usecase I'll use gsasl, so I've not
>> added code for that.
>
> Hm...  it would have been nice if this all went through our normal TLS
> functions, so that the user could be given the opportunity to use the
> network security manager in Emacs, which handles certificate errors and
> the like.  So I think it would be very nice if
> network-stream-open-gssapi handled TLS itself.

That might not work with the current approach:

$ imtest -m gssapi -p imap imap
...
. STARTTLS
. BAD Can't Starttls after authentication

On the other hand I expect that someone doing Single-Sign-On with his
mail server will also have the right SSL-certificates in place.  For
example, both my server and client have been added to a FreeIPA domain.
So I currently contemplate to add '-t ""' to the imtest command in
gssapi.el, because it matches my use case and we'd use STARTTLS in both
commands.  I think we've reached a time where TLS should be enabled by
default.

In list/net I've found sasl*.el - that doesn't do GSSAPI at all, but it
could possibly be implemented there.  But I expect that this is beyond
my minimal elisp skill, so that's something to explore much later.

Jochen

-- 
The only problem with troubleshooting is that the trouble shoots back.