Re: [Evolution] SMTP AUTH and Evo

[Adam Williams <awilliam whitemice org>]

> > GSSAPI is what provides Kerberos V, yes?
> No, Kerberos V provides Kerberos V.

It Cyrus IMAPd, OpenLDAP, PHP, and Samba; Kerberos V *IS* provided via 
GSS.  "gssapi.h" is found under  /usr/kerberos/include/gssapi/.  But I
don't know if there is another -direct- API that can be used.  I only
use Kerberos V not develope on it

> > I've asked about this on the
> > list a couple of times.  I've seen other people ask about it.  Kerberos
> > networks are hardly rare, and becoming more common.
> I'd dispute that. I would assert that Kerberos is an outdated system
> from the beginning of time that is rapidly being overtaken by more
> recent technology. And I know, because I have to know how to configure
> and use it.

I'll have to flat out disagree. Windows 2000, XP, and Active Directory
*finally* brought Kerberos V to the M$ platform.  It is the ONLY
authentication method supported by an AD "domain" (mixed mode aside). 
Don't see how  that makes it outdated.  And I certainly don't see
anything standing in line to compete with it.  It is the ONLY
single-sign-on technology I've ever encountered that actually works.

> > Linux boxes in a
> > WinY2k domain are almost certainly using Kerberos V.
> That is not so.

?  Then what do they do.  winbind, etc..., only support NT4 domains. 
Turn off mixed-mode on the server, and what have your got - Kerberos V.

> > Please consider
> > this requested.  Evolution is the only app that I actually have to enter
> > a password (beyond gdm of course) to access stuff.
> You wouldn't have to enter a password unless someone (a sysadmin?) made
> that mandatory. 

I am the sys-admin.  So people should be able to access mailboxes
without authenticating to the mail server?

> Having to enter a password does not mean anything else
> than that you are required to authenticate yourself by any one of
> several different means. 

Yea, that is the point.

> If you have to enter a password in Evo, you'd
> have to enter it in Mozilla or Outlook as well.

Don't know about mozilla.  But not in Outlook on WinY2k, or pine on
UNIX.  They support Kerberos V and perform ticket forwarding and
negotiation and I'm authenticated to the mail server with no password,
as I already authenticated to the KDC (when I logged in).  Kerberos V is
a single sign-on system.