Re: OX and CAS SSO

[Peter Schober]

hi nicolas,

(cc'ing the developer list and juergen)

* Nicolas Schmitz <Nicolas.Schmitz@...> [2008-03-21 14:37]:
> in this mail :
> http://article.gmane.org/gmane.comp.cms.open-xchange.devel/1081/match=sso
> you are talking about enable cas for OpenXchange. Do you know if
> it's going to happen ?

Juergen Ulbts started this with this mail in Feb 2007:
http://article.gmane.org/gmane.comp.cms.open-xchange.user/4027
I have not heard back if he ever implemented this.

the whole thread from my email (3 messages) can be found here:
http://thread.gmane.org/gmane.comp.cms.open-xchange.devel/1081
this is all I ever heard from Netline/Open-Xchange Inc./the community
in this regard.
apparently there is no interest in this kind of integration (I suppose
the focus is on other aspects and other markets, mostly small and
medium-sized companies, most of which probably have other problems and
other needs).

six months later there has also been this message from Bradley
Beddoes, the main developer of the "Enterprise Sign On Engine"
(another open source SSO system which integrates with Shibboleth,
OpenID and Active Directory on the desktop), which provoked no answer
from anyone whatsoever:
http://thread.gmane.org/gmane.comp.cms.open-xchange.devel/1119

I'm not involved with OX anymore and I haven't followed the recent
development so I can't comment on this in more detail.

re-reading my old email I might add that at least for CAS there is a
clean solution to the webmail problem with the CAS PAM module --
http://www.ja-sig.org/wiki/display/CASC/PAM+Module which should allow
authentication to the application via apache (mod_cas, passing
REMOTE_USER to the application server via mod_proxy_ajp or mod_jk) and
to the imapd via PAM (pam_cas), effectively extending Web-SSO to
n-tier services.
(for completeness: SSO-systems other than CAS would currently require
hacks such as a privileged imap proxy[1] like Wes Craig implemented
for the University of Michigan or the one from CMU with Kerberos and
the imtest utility[2]).

so unless you're willing to hack several components yourself I don't
see this happening.

best regards,
-peter

[1] http://www.umich.edu/~umweb/software/cosign/cosign-discuss/msg00265.html
[2] http://cyrusimap.web.cmu.edu/twiki/bin/view/Cyrus/SquirrelMailKerberos

--
peter.schober@... - vienna university computer center
Universitaetsstrasse 7, A-1010 Wien, Austria/Europe
Tel. [phone], Fax. [phone]

_______________________________________________
Devel mailing list
Devel@...
http://www.open-xchange.org/cgi-bin/mailman/listinfo/devel