-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi Craig
I am actually working on this very thing at the moment. there is a very basic config here (http://freeipa.org/page/Dovecot_Integration), however this is using pam for everything The end goal of course is sso in which I have managed to get gssapi for authentication working and pam is used for the user lookups.. Here is what I have in a working state on rhel 6.2 ##### yum install -y oddjob-mkhomedir chkconfig oddjobd on service oddjobd start ipa-client-install -U -p admin -w redhat123 --mkhomedir # configure dovecot chkconfig dovecot on sed -i 's/#protocols = imap pop3 lmtp/protocols = imap/g' /etc/dovecot/dovecot.conf sed -i "s-#mail_location-mail_location = mbox:~/mail:INBOX=/var/spool/mail/%u-g" /etc/dovecot/conf.d/10-mail.conf echo "userdb {" >> /etc/dovecot/conf.d/10-auth.conf echo " driver = static" >> /etc/dovecot/conf.d/10-auth.conf echo " args = uid=dovecot gid=dovecot home=/var/spool/mail/%u" >> /etc/dovecot/conf.d/10-auth.conf echo "}" >> /etc/dovecot/conf.d/10-auth.conf sed -i 's/auth_mechanisms = plain/auth_mechanisms = gssapi/g' /etc/dovecot/conf.d/10-auth.conf sed -i "s/#auth_gssapi_hostname =/auth_gssapi_hostname = $(hostname)/g" /etc/dovecot/conf.d/10-auth.conf sed -i "s-#auth_krb5_keytab =-auth_krb5_keytab = /etc/dovecot/krb5.keytab-g" /etc/dovecot/conf.d/10-auth.conf sed -i "s/#auth_realms =/auth_realms = $(hostname --domain)/g" /etc/dovecot/conf.d/10-auth.conf sed -i "s/#auth_default_realm =/auth_default_realm = $(hostname --domain)/g" /etc/dovecot/conf.d/10-auth.conf kinit admin ipa service-add imap/$(hostname) ipa service-add imaps/$(hostname) ipa-getkeytab -s ds01.example.com -p imap/$(hostname) -k /etc/dovecot/krb5.keytab ipa-getkeytab -s ds01.example.com -p imaps/$(hostname) -k /etc/dovecot/krb5.keytab chown dovecot:dovecot /etc/dovecot/krb5.keytab service dovecot restart #### By having the system tapped into the ipa domain, pam allows dovecot to pass user lookups successfully. With the gssapi changes to /etc/dovecot/conf.d/10-auth.conf and using a keytab for the service principles, users can log in successfully without issue (i have only tested this with gssapi only at the moment) successful authentication appears in /var/log/maillog as follows Feb 2 22:50:45 mail04 dovecot: imap-login: Login: user=<[email protected]>, method=GSSAPI, rip=192.168.122.61, lip=192.168.122.44, mpid=2216, TLS the only issue I am presently facing is with the mail_location directive in dovecot.. unless the users homedir actually exists you will get errors like this. Feb 2 21:52:34 mail04 dovecot: imap(user1): Error: user user1: Initialization failed: Initializing mail storage from mail_location setting failed: mkdir(/home/user1/mail) failed: Permission denied (euid=1201600003(user1) egid=1201600003(user1) missing +w perm: /home, euid is not dir owner) I have been experimenting with how best to address this, however I am constantly being pushed back to the only way of having a userdir that actually exists would be a homdir which would be created when a user first logs in. Yes, if you ssh to the dovecot server as the user (with oddjobd running in the background) it will create the homedir with no problems and the issue is resolved, however users should not *have to* interactively log into a server just to allow them to access mail. my only thinking here is shared homedirs (nfs?) between clients and servers, however my thoughts on this are "if dovecot is redirecting a users mail to their homedir, then why do we need dovecot to access it via imap when the mail will already appear in their homedir?" does anyone have any thoughts on this? Dale On 02/03/2012 04:33 AM, Craig T wrote: > hi, > > Has anyone setup Dovecot IMAP to work with IPA 2.x yet? > I'm thinking the best config would be to use; > * IMAPS between the mail clients and Dovecot server > * LDAPS with "Passdb LDAP with authentication binds" to connect to IPA? > ref: http://wiki2.dovecot.org/AuthDatabase/LDAP/AuthBinds > > cya > > Craig > > _______________________________________________ > Freeipa-users mailing list > [email protected] > https://www.redhat.com/mailman/listinfo/freeipa-users -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQIcBAEBAgAGBQJPK408AAoJEAJsWS61tB+qjy4P/A5+y69wZg7hxg6xgohA6256 pTPEaSAi77zZZ1X3CgEbgGcRjlN8iRECbzb+2QDZ501uP4v+IrKSrE9VPwQuGIek baLbHExVBhusUGxQ8l51aZrM0FZMtNnidCtGPVl7pp2EHcGGnquNdNs8T4FuNSfz ngGaekSOWlvENUzYpMFxdxTJJZJ7+7ensV4Jaoe6MgOgGW8ytPuFxECO8kMrcqPq tOJ1Vb4gaeAfJWLPnKSU1lw9nIMW8ze4ftxaSSbdyiLl8cU9LMC16Sz4Lrkg/B1c PnT7thLI1yLjNfPwiGXQUtSc8VE/29f3g1D1ky0hnaZz1HYX34lQ85Eqw9hQ14lm 1/YY/M6DhFqiO3uxUSMRsL5iCWG6fP6LIxRrHZYenS20qRhEcjwi90z/DNqs5wH1 j5ERuTQFGFBfnhFX7bPs9EDrh736icQc1GJE8rOFvUnvenEZRCm/3NhxW1XrNmr0 lftzbE0X7U+eEANOsNzOS+37bxo3rfcPbafZFYfgyf7WUorEkMUvbRaUNaiGr6FS cZyLU6jioJjVIqhDGnst5rP8JZdIcKI+Xfmmh0V3LoAGLzz+9NzncV+MV/Bq71uJ UyJHArk5RJ4NDxTM34OjIvzlwwsKP9kGNw3RB1IyEv4iDBkcf9hBtwqHMN4F0rd5 cnXJyulO0T4fDU5iFXxb =tYFH -----END PGP SIGNATURE-----
0xB5B41FAA.asc
Description: application/pgp-keys
0xB5B41FAA.asc.sig
Description: PGP signature
_______________________________________________ Freeipa-users mailing list [email protected] https://www.redhat.com/mailman/listinfo/freeipa-users
