Re: Connecting to imap on a Microsoft Exchange server with gsasl

[Simon Josefsson]

address@hidden (Adam Sjøgren) writes:

> On Wed, 12 Sep 2012 14:08:49 +0200, Simon wrote:
>
>>> Chromium needed --auth-server-whitelist and
>>> --auth-negotiate-delegate-whitelist to be set to match our intranet
>>> domain and also --disable-auth-negotiate-cname-lookup, while in Firefox
>>> I had to configure network.negotiate-auth.delegation-uris and
>>> network.negotiate-auth.trusted.uris to match our intranet domain.
>  
>>> Maybe I need something akin to that for gsasl?
>
>> gsasl is just a thin layer to the GSS-API library you are using, so all
>> these kind of configurations would go to the GSS-API library.  Alas, the
>> GSS-API interface provides little tuning, so this is typically done
>> through configuration files or out of band.  I think you need to check
>> with the community for the GSS-API library you use.
>
> Ok, thanks. I don't quite know what I would ask, but it _was_ also just
> a whim, to see if I could get gssapi going with Gnus :-)

Have you some indication that anyone got a SASL GSSAPI client to work
with a server like that?  Including any Windows clients?  If there is a
client that works, maybe you can listen to the network traffic and see
what it looks like.  Still, modulo parsing issues like the one you
discovered, I suspect any incompatibility is at the GSS-API library
layer.  Or just incorrect configuration that leads to no Kerberos ticket
or something like that.

/Simon