Re: 5.1.7
Bret Miller <bret.miller <at> wcg.org>
2007-03-01 14:50:31 GMT
> So pronto is looking better.
>
> - don't seem to be able to search domain contacts
> - XIMSS for external auth don't work
> - msi installer found :
>
> ftp://ftp.stalker.com/pub/client/CGatePro-MAPI-Intel-1.2.7.zip
> ftp://ftp.stalker.com/pub/client/CGatePro-MAPI-Intel-1.2.7.msi.zip
>
> whats the difference?
>
> As for external auth, Bret says, "In order for what you want
> to work, you'd need to modify authLDAP.pl to implement the
> SASL authentication method."
>
> How do you do this exactly? Pronto is kind of worthless to
> me without that right now. Agree with bret this should be
> native to CGP
I can answer that, actually. SASL authentication involves getting a
"test data" and a "hashed test data", taking the "test data" and
applying the known private key to hash it and then comparing the result.
The problem is that with external authentication methods, the password
isn't known, so you have no way to hash the test data and compare the
result to what the client provided.
In other words, clear text login is the only supported method when you
can't retrieve the password programmatically. So, if Pronto would
support clear text login, that would work, but it doesn't.
The semi-solution to this is to provide a place where the user can
"clear text login", maybe an SSL web page to "synchronize password". The
user would enter the password there, which would be transmitted via SSL
(thus securely, but still clear text as far as the program sees). The
external authenticator can then successfully test the password. At this
point, if the login is successful, something needs to set the CGPro
password for that account to the correct password. Then, assuming CGPro
passwords are either stored plain text or A-Crypt, the user will be able
to use clients like Pronto that insist on secure login methods.
I can fix authLDAP.pl to do that. It's trivial. But authLDAP takes
immesurably longer than the OS integration here. I don't know why-- it
just does. So, I'd rather use OS integration. But I can't modify the OS
integration to set the CGPro password if authentication is successful.
So that's the option I really want added.
Most of our users that this affects use the MAPI connector, which I
think uses clear text authentication, so this addition would essentially
solve the problem here because the first time OS integration was invoked
when Outlook used a password that didn't match CGPro's, it would
immediately sync the password to match and Pronto would work from then
on.
HTH,
Bret
#############################################################
This message is sent to you because you are subscribed to
the mailing list <CGatePro <at> mail.stalker.com>.
To unsubscribe, E-mail to: <CGatePro-off <at> mail.stalker.com>
To switch to the DIGEST mode, E-mail to <CGatePro-digest <at> mail.stalker.com>
To switch to the INDEX mode, E-mail to <CGatePro-index <at> mail.stalker.com>
Send administrative queries to <CGatePro-request <at> mail.stalker.com>
RSS Feed