Skip to content

client_auth: Document GSSAPI channel binding and GSSAPI client usage - #1706

Open
cmouse wants to merge 1 commit into
dovecot:mainfrom
cmouse:sasl-gssapi-client-fixes
Open

cmouse wants to merge 1 commit into
dovecot:mainfrom
cmouse:sasl-gssapi-client-fixes

Conversation

@cmouse

@cmouse cmouse commented Oct 26, 2026

Copy link
Copy Markdown
Contributor
  • client_auth_gssapi_channel_binding setting.
  • GSSAPI and GSS-SPNEGO in client_auth_mechanism: no password, loaded from
    libdovecot-gssapi when configured.
  • gssapi.md: using GSSAPI as a client (credentials, chroot, Kerberos-only
    GSS-SPNEGO, channel binding).

Core: dovecot/core!6615

JIRA: DOV-10022

@github-actions

This comment has been minimized.

@cmouse
cmouse force-pushed the sasl-gssapi-client-fixes branch from ba7c401 to 1fa913a Compare October 26, 2026 07:49
@github-actions

This comment has been minimized.

@cmouse
cmouse force-pushed the sasl-gssapi-client-fixes branch from 1fa913a to 190ef02 Compare October 26, 2026 07:54
service, because a chrooted process can't reach `krb5.conf`, the credential
cache or the GSSAPI module.
* As a client GSS-SPNEGO negotiates only Kerberos, never NTLM.
* Over TLS a channel binding is sent by default. See

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This sentence is a bit difficult to read. At least add a comma after TLS or make it a bit longer like: "When TLS is used, a channel binding is sent by default."

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants