Re: AUTH=PLAIN support

[James Cloos <cloos@jhcloos.com>]

>>>>> "LMI" == Lars Magne Ingebrigtsen <larsi@gnus.org> writes:

LMI> Ok...  then we have one server type that says "AUTH=PLAIN", but doesn't
LMI> accept "AUTHENTICATE PLAIN" anyway (Exchange 2010), and we have another
LMI> user with a server that says "AUTH=PLAIN" (Zimbra) that doesn't accept
LMI> anything but "AUTHENTICATE PLAIN" ("LOGIN" doesn't work).

If clients MUST use AUTHENTICATE, then the server MUST report LOGINDISABLED
in its capabilities.

It seems that the idea was to elimitate the LOGIN command on STARTTLS-capable
servers, but they still needed a plain-text passwd option.  And so created
AUTH=PLAIN to cover that requirement.

The IMAP-TLS RFC (2505) does say that AUTH=PLAIN should never be used on
an unencrypted socket.  (It was necessary because systems which use
/etc/passwd cannot authenticate unless the plain text passwd is available
server-side.)

Or at least that is what I divine from the RFCs. ☺

LMI> So does anybody know what combinations of capabilities should trigger
LMI> "AUTHENTICATE PLAIN" that works across the board?

Probably 'AUTH=PLAIN LOGINDISABLED'.

LMI> You don't authenticate via SSL, do you?  That's just a transport,
LMI> not an authentication mechanism?  (If I have my terminologies right.)

If the server and client support TLS client certs, all of AAA can happen
at that layer.  Once such a TLS session is up, then the IMAP level would
be PREAUTH.

If the session uses port 993 w/ a client cert, then the intial IMAP
greeting would be PREAUTH.

If the session uses STARTTLS, then the first prompt after TLS starts
would be PREAUTH.

In practice, though, I'm not aware of any clients or servers which
support using TLS client certs to pre-authenticate the IMAP session.

But the above is how it is supposed to work, and tls aaa would be the
most secure way to use tls with imap.

(I would note that the certs do not have to be x509.  There are options
to use openpgp keys as either server or client certs in tls, and there is
also a standard for using plain text passwds at the tls layer.)

-JimC
-- 
James Cloos <cloos@jhcloos.com>         OpenPGP: 1024D/ED7DAEA6