Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm setting up a mail system using Postfix (OpenLDAP backend) and Cyrus-IMAP on Debian.

Goal: I'd love to go ahead with GSSAPI authentication. I've tested the whole setup on virtual machines on my laptop, and everything works.

Problem: I need mail server(s) running sooner than I have time to migrate a few hundreds of Windows machines. That means, the Windows users will have to use separate username/passwords for their e-mail accounts only. Which is ugly. Which I'd like to avoid.

Ideally, I'd need a behavior of GSSAPI-enabled sshd. If there's a valid ticket, it just lets you in, if there's none, it asks for a password. Is it possible to do a similar trick with Cyrus-IMAP? Or am I trying to both eat the cookie and to have it?

share|improve this question

Can you use a REALM Trust and configure your DNS to have suitable REALM mappings?

share|improve this answer
There's nothing to map, that's the whole point. There is no AD in place, everything has been managed on computer-by-computer basis (don't ask why). The AD is considered 'too expensive', so I have to figure out some el cheapo solution based on Kerberos/GSSAPI/OpenLDAP/Samba stack, and the Samba part is missing at the moment... – badbishop Feb 3 '12 at 10:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.