I'm setting up a mail system using Postfix (OpenLDAP backend) and Cyrus-IMAP on Debian.
Goal: I'd love to go ahead with GSSAPI authentication. I've tested the whole setup on virtual machines on my laptop, and everything works.
Problem: I need mail server(s) running sooner than I have time to migrate a few hundreds of Windows machines. That means, the Windows users will have to use separate username/passwords for their e-mail accounts only. Which is ugly. Which I'd like to avoid.
Ideally, I'd need a behavior of GSSAPI-enabled sshd. If there's a valid ticket, it just lets you in, if there's none, it asks for a password. Is it possible to do a similar trick with Cyrus-IMAP? Or am I trying to both eat the cookie and to have it?
Can you use a REALM Trust and configure your DNS to have suitable REALM mappings?