MBOX-Line: From dwhite at olp.net  Fri Jan 13 08:09:44 2012
To: imap-protocol@u.washington.edu
From: Dan White <dwhite@olp.net>
Date: Fri Jun  8 12:34:47 2018
Subject: [Imap-protocol] Re: which IMAP servers support support SASL
 authorization vs. authentication ID?
In-Reply-To: <alpine.OSX.2.00.1201130725430.38441@hsinghsing.panda.com>
References: <alpine.OSX.2.00.1201130725430.38441@hsinghsing.panda.com>
Message-ID: <20120113160943.GB4601@dan.olp.net>

On 01/13/12?07:44?-0800, Mark Crispin wrote:
>I have been tasked to identify which IMAP servers support the SASL concept
>of authorization vs. authentication ID and if it is suitable to allow
>impersonation; that is to proxy to various user accounts.
>
>I have the following data:
>
>Panda IMAP:		Yes
>	;; Authenticated userids in system group "mailadm" may authorize
>	;; to any other userid.
>
>UW IMAP:		Yes, in newer versions
>	;; Same as Panda
>
>
>Probably yes, but not sure and need details:
>
>Cyrus:
>Dovecot:
>Communigate Pro:
>Sendmail:
>Zimbra:

Cyrus supports this function using the 'proxyservers' configuration option.
See:

http://www.cyrusimap.org/docs/cyrus-imapd/2.4.13/man/imapd.conf.5.php
http://www.cyrusimap.org/docs/cyrus-imapd/2.4.13/install-murder.php

Fine grained control can be accomplished by delegating 'a' ACL rights for
a user's INBOX and then enabling the 'loginuseacl' config option:

-- 
Dan White

