Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:28582
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 64.233.162.224 as permitted sender)
DomainKey-Status: bad
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=beta;
        h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
        b=J/0Pr9WzPYLAe0CEyQlVY2yQy8JCtiHU5fY2CfNyjEdzant/p+vhD7BltNXre9rDkFfHEYFhKV30/rkYOvNtnkpair14jFGBeYlo5kphvEEJgnHWo1C/zRZ9Xsa9VbKmp3CuM7PYcXUiPKw2KazMaMqwFi/irVtQcM99S6+Bhfo=
Message-ID: <3e1c67bc0703232232x7eece58foc05c0bb1319192b1@mail.gmail.com>
Date: Sat, 24 Mar 2007 10:32:41 +0500
To: "Michael B Allen" <mba2000@ioplex.com>
Cc: internals@lists.php.net
In-Reply-To: <20070322153530.01de5971.mba2000@ioplex.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <3e1c67bc0703220002x12faf6c6oa6f5796603f31561@mail.gmail.com>
	 <20070322153530.01de5971.mba2000@ioplex.com>
Subject: Re: [PHP-DEV] Bug # 33500 | imap auth fails when server advertises gssapi
From: backports@gmail.com ("Back Ports")

Mike,

Thanks for your reply.

On 3/23/07, Michael B Allen <mba2000@ioplex.com> wrote:
> On Thu, 22 Mar 2007 12:02:50 +0500
> "Back Ports" <backports@gmail.com> wrote:
>
> > Hi all,
> >
> > Is there any progress on the following bug report:
> >
> > http://bugs.php.net/bug.php?id=33500&thanks=6
> >
> > It was reported quite a while ago -- I also saw a relevant post on the
> > mit kerberos mailing list where discussed patches fixed the issue,
> > however, they appear impossible to track down.
> >
> > http://mailman.mit.edu/pipermail/kerberos/2006-April/009629.html
>
> I'm not a php dev and I don't know the status of this bug but I have a
> possible solution for you anyway.
>
> If you're on an Active Directory network (very possible if your IMAP
> server is offering GSSAPI) then you could use our product to get the
> necessary credential so that the IMAP extension's GSSAPI auth works.

We're on MIT kerberos, openldap & dovecot is the imap server. Our
gssapi bit works well for all clients, etc. -- it's only the php imap
call which chokes.

> With our Plexcel PHP extension (see sig) you can acquire Kerberos
> credentials in three ways - 1 Single Sign-On (the delegated credential
> from the web client); 2 use the HTTP service account cred; or 3 explicit
> logon with username and password.

The problem is that php doesn't go ahead and try plain auth if gssapi
doesn't work out -- I don't think supplying krb5 credentials would
work -- however, I will go ahead and give that a shot. We're using
stanford's webauth and a user ticket can easily be made available when
trying gssapi.

ldap_sasl_auth() doesn't support gssapi either, though my earlier post
to this list ended up on a web site somewhere with a note saying
'theoretically it's possible'.

Appreciate your help.

mustafa.