.scindex IIDdcotauth1 "&(dovecot)& authenticator"
.scindex IIDdcotauth2 "authenticators" "&(dovecot)&"
This authenticator is an interface to the authentication facility of the
-Dovecot POP/IMAP server, which can support a number of authentication methods.
+Dovecot 2 POP/IMAP server, which can support a number of authentication methods.
Note that Dovecot must be configured to use auth-client not auth-userdb.
If you are using Dovecot to authenticate POP/IMAP clients, it might be helpful
to use the same mechanisms for SMTP authentication. This is a server
connection, a client certificate has been verified, the &"valid-client-cert"&
option is passed. When authentication succeeds, the identity of the user
who authenticated is placed in &$auth1$&.
+
+.new
+The Dovecot configuration to match the above wil look
+something like:
+.code
+conf.d/10-master.conf :-
+
+service auth {
+...
+#SASL
+ unix_listener auth-client {
+ mode = 0660
+ user = mail
+ }
+...
+}
+
+conf.d/10-auth.conf :-
+
+auth_mechanisms = plain login ntlm
+.endd
+.wen
+
.ecindex IIDdcotauth1
.ecindex IIDdcotauth2
.cindex "authentication" "DIGEST-MD5"
.cindex "authentication" "CRAM-MD5"
.cindex "authentication" "SCRAM-SHA-1"
-The &(gsasl)& authenticator provides server integration for the GNU SASL
+The &(gsasl)& authenticator provides integration for the GNU SASL
library and the mechanisms it provides. This is new as of the 4.80 release
and there are a few areas where the library does not let Exim smoothly
scale to handle future authentication mechanisms, so no guarantee can be
made that any particular new authentication mechanism will be supported
without code changes in Exim.
-Exim's &(gsasl)& authenticator does not have client-side support at this
-time; only the server-side support is implemented. Patches welcome.
+.new
+.option client_authz gsasl string&!! unset
+This option can be used to supply an &'authorization id'&
+which is different to the &'authentication_id'& provided
+by &%client_username%& option.
+If unset or (after expansion) empty it is not used,
+which is the common case.
+
+.option client_channelbinding gsasl boolean false
+See &%server_channelbinding%& below.
+
+.option client_password gsasl string&!! unset
+This option is exapanded before use, and should result in
+the password to be used, in clear.
+
+.option client_username gsasl string&!! unset
+This option is exapanded before use, and should result in
+the account name to be used.
+.wen
.option server_channelbinding gsasl boolean false
-Do not set this true without consulting a cryptographic engineer.
+Do not set this true and rely on the properties
+without consulting a cryptographic engineer.
Some authentication mechanisms are able to use external context at both ends
of the session to bind the authentication to that context, and fail the
this option causes some clients to start failing. Some future release
of Exim might have switched the default to be true.
-However, Channel Binding in TLS has proven to be broken in current versions.
+However, Channel Binding in TLS has proven to be vulnerable in current versions.
Do not plan to rely upon this feature for security, ever, without consulting
with a subject matter expert (a cryptographic engineer).
&`DKIM`& domain verified in incoming message
&`DN `& distinguished name from peer certificate
&`DS `& DNSSEC secured lookups
-&`DT `& on &`=>`& lines: time taken for a delivery
+&`DT `& on &`=>`&, &'=='& and &'**'& lines: time taken for, or to attempt, a delivery
&`F `& sender address (on delivery lines)
&`H `& host name and IP address
&`I `& local interface used
&` arguments `& command line arguments
&`*connection_reject `& connection rejections
&`*delay_delivery `& immediate delivery delayed
-&` deliver_time `& time taken to perform delivery
+&` deliver_time `& time taken to attempt delivery
&` delivery_size `& add &`S=`&&'nnn'& to => lines
&`*dkim `& DKIM verified domain on <= lines
&` dkim_verbose `& separate full DKIM verification result line, per signature
git://git.exim.org / exim.git / blobdiff