IMAP proxy usage

[Igor Sysoev]

On Tue, 17 Oct 2006 Vittorio Tracy wrote:

> I was wondering if you could share with me how you configure nginx for
> doing IMAP/POP proxying.
>
> I have tried the nginx IMAP/POP proxy config example that was posted on the
> ngix wiki. I setup an auth.cgi script on my webserver for nginx to
> access, and according to my webserver logs it does access it but exits
> with an error:
>
> $ telnet localhost 110
> Trying 127.0.0.1...
> Connected to localhost.localdomain.
> Escape character is '^]'.
> +OK POP3 ready
> user user
> +OK
> pass pass
> -ERR internal server error
> Connection closed by foreign host.
>
>
> My cgi script just logs params that are posted to it, though none are
> posted by nginx. What is the purpose of this script? The name suggests
> it is used for authenticating IMAP/POP logins, why is a cgi script used
> for auth when the IMAP/POP server does this? Also how does one configure
> nginx to use multiple backend IMAP servers and direct users to one or
> the other?

nginx uses external HTTP-like server to learn which IMAP/POP backend it
should connect to. nginx passes authorization information in HTTP
headers, but not in query string:

GET /auth HTTP/1.0
Host: auth.server.hostname
Auth-Method: plain
Auth-Login: user
Auth-Pass: password
Auth-Protocol: imap
Auth-Login-Attempt: 1
Client-IP: 192.168.1.1

The good response is:

HTTP/1.0 200 OK      # this line is actually ignored and may not exist at all
Auth-Status: OK
Auth-Server: 192.168.1.10
Auth-Port: 110
Auth-User: newname   # you may override the user name to login to a backend

The failed response is:

HTTP/1.0 200 OK      # this line is actually ignored and may not exist at all
Auth-Status: Invalid login or password
Auth-Wait: 3         # nginx will wait 3 seconds before reading
                      # client's login/passwd again


Igor Sysoev
http://sysoev.ru/en/