MBOX-Line: From dkarp at zimbra.com  Sun Jun  1 13:08:31 2008
To: imap-protocol@u.washington.edu
From: Dan Karp <dkarp@zimbra.com>
Date: Fri Jun  8 12:34:41 2018
Subject: [Imap-protocol] Proxy IP forwarding
In-Reply-To: <259504957.21571212350751310.JavaMail.root@dogfood.zimbra.com>
Message-ID: <1070904325.21591212350911669.JavaMail.root@dogfood.zimbra.com>

> The idea would be that there's a frontend IMAP proxy that looks up
> the backend IMAP server based on the username, tells the backend
> server the user's IP and then logs in using the provided user+password.

We currently do this with a separate nginx process.  We tell the IMAP
server the client's actual IP by having nginx do an

   A001 ID ("X-ORIGINATING-IP" "<actual-client-IP>")

as the first command, before authenticating.

Since this won't work for GSSAPI, we've also extended nginx to do
GSSAPI auth locally and then use an AUTH PLAIN variant to authenticate
the server connection.

