I'm trying to set up Dovecot as authenticating reverse proxy, in front of an already running IMAP server to accomplish the following:

  • Have Dovecot authenticate users using Kerberos/GSSAPI (to allow Single-Sign-On).
  • If properly authenticated, have Dovecot proxy to the existing IMAP server with the authenticated username using the regular AUTH=PLAIN method, but with a random/empty password. I want exactly that, since I will have the backend IMAP server trust the authenticating proxy, but it still requires a PLAIN IMAP login with a dummy password.

How far did I get?

The main challenge I'm dealing with, is the combination of the two. The Kerberos/GSSAPI authentication page starts off with this:

The Kerberos authentication mechanism doesn't require having a passdb, but you do need a userdb so Dovecot can lookup user-specific information, such as where their mailboxes are stored.

Well, this reads like a double anti-feature to me: I need a passdb to proxy in the first place, and I don't want it to be aware of "such as where their mailboxes are stored", as it should just proxy everything onto the backend server.

So, could anyone point me into the right direction here?

(I'm just starting with Dovecot, so please bear with me. Also, it's not a requirement to use Dovecot, by the way. The IMAP server I use as backend is Kopano Gateway, which seems to lack SSO support, but it does let me bypass password authentication.)

2 Answers 2


Set the passdb attrs to include pass=master password. Dovecot needs a password to try against the proxy. With GSSAPI it obviously doesn't have one, so provide your master password (or with kopano you can put anything if you have bypass_auth set). See Dovecot Docs, specifically the section "master password".

  • Thanks! I'll try this out some time soon. Since it's been half a year that I was working on this, it may take a bit.
    – gertvdijk
    Jul 23, 2019 at 22:46
  • No worries, sorry for resurrecting! I have just set this up with dovecot and kopano-server and came across your question whilst struggling myself. It's all working now so it is possible. Also recommend not disabling pipelining in the proxy command otherwise IMAP will be super slow.
    – Alex
    Jul 29, 2019 at 23:34
  • Could you share a bit more on your configuration? I fail to set up a virtual user mapping. Dovecot keeps complaining Error: mail_location not set and autodetection failed: Mail storage autodetection failed with home=(not set), but that seems so weird for a passdb with args = proxy=y... fail to understand.
    – gertvdijk
    Aug 1, 2019 at 1:12
  • I seem to fail to set up a simple proxy already, so I posted a new Q. Thanks for your help.
    – gertvdijk
    Aug 1, 2019 at 1:54

Got it to work in the end with the hints by Alex in the other answer and some final help on the Dovecot mailing list where Timo - the Dovecot original author - responded.

Full example of a dovecot.conf below. The main trick is the full args line in the passdb section. Without password=something or nopassword=y, it thinks mail is locally stored and proxying isn't turned on and you'll see an error Error: mail_location not set and autodetection failed: Mail storage autodetection failed with home=(not set). More small caveats inline in the comments.

protocols = imap

passdb {
  driver = static
  args = proxy=y host= port=1143 pass=masterpass nopassword=y

# Deliberately omitted userdb, because this is a proxy.

# Kerberos authentication settings
auth_mechanisms = gssapi
auth_gssapi_hostname = mailhost.mydomain.tld
auth_realms = MY-REALM.DOMAIN.TLD
auth_default_realm = MY-REALM.DOMAIN.TLD
# This keytab file contains keys for principal imap/mailhost.mydomain.tld@MY-REALM.DOMAIN.TLD
# Unlike SSL keys/certs, do not use '= <', but plain '=' to path of file.
auth_krb5_keytab = /etc/dovecot/imap.keytab
# Pass only local username part to the backend.
auth_username_format = %n

# Logging to foreground with some verbose logging for authentication.
log_path = /dev/stderr
auth_verbose = yes

# Require StartTLS or plain TLS for any interaction.
ssl = required
ssl_cert = </path/to/cert.crt
ssl_key = </path/to/key.pem
ssl_prefer_server_ciphers = yes
ssl_min_protocol = TLSv1.2

The log will then show:

imap-login: Info: proxy(username): started proxying to user=<username>, method=GSSAPI, rip=, lip=, TLS, session=<iJvnvg6P8KEKAAYE>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.