Questions[cas](server)

I use a web sso portal which provides cas tickets. I "cassify" my webmail and my imap server (cyrus-imapd).

When I fetch my emails from the Webmail (proxy CAS), it's ok. Except if I fetch my emails with a classic IMAP client and I try to fetch again from the Webmail, I have bad authentications.

It seems it's a known problem. Indeed (if I understand well) the sasl cache got at the begining a PT like password (from webmail), and after a password (from classic IMAP client). I don't found the good way to correct it. That's why I post my question here. I tried with pam_ccreds but I still have a lot of authentication errors into the mail.log.

So I try to use 2 instances of saslauthd and 2 imap services. Below the OS and Software configuration :

• OS : Debian 8
• sasl2-bin : 2.1.26.dfsg1-13
• cyrus-imapd : 2.4.17+caldav~beta10-18

Below my attempt configuration :

• /etc/default/saslauthd

  START=yes
  DESC="SASL Authentication Daemon"
  NAME="saslauthd"
  MECHANISMS="pam"
  THREADS=5
  OPTIONS="-c -m /var/run/saslauthd/mux -r -n 0"
  

• /etc/default/saslauthd-web

   START=yes
   DESC="SASL Authentication Daemon"
   NAME="saslauthd"
   MECHANISMS="pam"
   THREADS=5
   OPTIONS="-c -m /var/run/saslauthd/muxweb -r -n 0"
  

• /etc/pam.d/imapweb

  auth sufficient /lib/x86_64-linux-gnu/security/pam_cas.so -simap://mail.example.com -f/etc/pam_cas.conf
  auth sufficient /lib/x86_64-linux-gnu/security/pam_ldap.so config=/etc/pam_ldap_imap.conf
  auth sufficient /lib/x86_64-linux-gnu/security/pam_unix.so
  account sufficient /lib/x86_64-linux-gnu/security/pam_ldap.so config=/etc/pam_ldap_imap.conf
  

• /etc/pam.d/imap

  auth sufficient /lib/x86_64-linux-gnu/security/pam_ldap.so config=/etc/pam_ldap_imap.conf
  auth sufficient /lib/x86_64-linux-gnu/security/pam_unix.so
  account sufficient /lib/x86_64-linux-gnu/security/pam_ldap.so config=/etc/pam_ldap_imap.conf
  

• /etc/cyrus.conf

  imap cmd="imapd -U 30" listen="X.X.X.X:imap" prefork=0 maxchild=100
  imapweb cmd="imapd -U 30 -C /etc/imapdweb.conf" listen="X.X.X.X:IMAPWEBPORT" prefork=0 maxchild=100
  

• /etc/imapd.conf

  ...
  sasl_pwcheck_method: auxprop saslauthd
  imap_sasl_saslauthd_path: /var/run/saslauthd/mux
  imapweb_sasl_saslauthd_path: /var/run/saslauthd/muxweb
  sasl_auxprop_plugin: sasldb
  ...
  

I restart saslauthd and cyrus-imapd services.

When I run a testsaslauthd command with the each saslauthd socket it runs very well :

testsaslauthd -u USER -p PASSWORD -f /var/run/saslauthd/mux/mux -s imap
0: OK "Success."
testsaslauthd -u USER -p PASSWORD -f /var/run/saslauthd/muxweb/mux -s imapweb
0: OK "Success."

But when I run a telnet on the imap port on my imap-server from my webmail host, the authentication failed. On the imapweb port it is the same. However into the imap log, I see the stacktrace which show I use the good imap service (imap for imap port and imapweb for "IMAPPORTWEB")

Do you have an idea, which explains why my authentication doesn't work ? Is the right method to accept both CAS and classic IMAP access ?

If I'm deploying an Edge Transport Server to the DMZ, do I need to make the Client Access Server internet facing in order to send / receive mail from the WAN?

Asked another way: If I deploy an Edge Transport server with the CAS in the internal network, and if the CAS is not internet facing, will email flow between WAN and CAS?

I'm using the Exchange Web Services SDK and am getting strange results after these lines run:

ScpUrlGuidString = @"77378F46-2C66-4aa9-A6A6-3E7A48B19596";

ScpPtrGuidString = @"67661d7F-8FC4-4fa7-BFAC-E1D7794C1F68";

configSearcher.Filter =
               "(&(objectClass=serviceConnectionPoint)" +
               "(|(keywords=" + ScpPtrGuidString + ")(keywords=" + ScpUrlGuidString + ")))";

It seems that one of my CAS servers is missing, and the other is misconfigured.

Question

What administrative commands should I run to edit how the CAS publishes or updates the AD SCP?

I'm trying to create an exchange domain service account. I'd like to define the rights in a Group Policy Object.

since this is for both a 2 node DAG, and 2 node CAS Array, I need to know the rights for services like "Exchange Server RPC Client Access" service, etc.

Does anyone know where I can find these GPO rights?

I am migrating from Exchange 2003 to 2010, I would like to setup co-existance and followed the instructions for setup on technet. OWA redirects without issue, the problem I have is with RPC/HTTPS. Exchange 2003 mailboxes and connect directly to the Exchange 2003 server using RPC/HTTPS and Exchange 2010 mailboxes can connect through the Exchange 2010 CAS with RPC/HTTPS. The problem is if I try to use the 2010 CAS to proxy the RPC/HTTPS connections to Exchange 2003, Outlook never connects.

My UCC cert is valid and contains the external name as well as the legacy.domain.com I have tried switch IIS security to basic as was suggested on the technet forums

If anyone has any ideas I could try please let me know. Or even if they could point me to the right log files to see where the connection is failing on the CAS.