[Classpathx-javamail] CRAM-MD5 authentication to cyrus imapd fails

[Boris Folgmann]

Hi,

I use cyrus-imapd-2.2.12-8.1.RHEL4 on CentOS 4.6 on two different servers.
Both cyrus installations are mostly identical with SSL/TLS enabled. Both
are successfully used by mozilla mail clients for years now.

One is in my LAN and is configured with

sasl_mech_list: PLAIN

Using your javamail implementation I can successfully log in to my account:

Jul 25 16:48:43 gaia imap[15630]: starttls: TLSv1 with cipher RC4-MD5
(128/128 bits new) no authentication
Jul 25 16:48:43 gaia imap[15630]: login: MY_PCNAME [MY_PCIP] boris
PLAIN+TLS User logged in

Using the same code log in fails to the other server which is located in
the Internet and requires the use of SASL for secure logins:

allowplaintext: no
sasl_mech_list: NOANONYMOUS NOPLAIN DIGEST-MD5 CRAM-MD5

Here's the logfile:

Jul 25 17:28:52 osiris imap[12148]: starttls: TLSv1 with cipher RC4-MD5
(128/128 bits new) no authentication
Jul 25 17:28:52 osiris imap[12148]: badlogin: MY_ROUTERNAME [MY_ROUTERIP]
CRAM-MD5 [SASL(-13): authentication failure: incorrect digest response]

My code gets this exception:

org.jpackage.mail.inet.imap.IMAPException: Client canceled authentication
at
org.jpackage.mail.inet.imap.IMAPConnection.authenticate(IMAPConnection.java:736)
at gnu.mail.providers.imap.IMAPStore.protocolConnect(IMAPStore.java:221)
at javax.mail.Service.connect(Service.java:244)
at javax.mail.Service.connect(Service.java:111)
at javax.mail.Service.connect(Service.java:94)

Unfortunately I'm still stuck with classpathx-mail-1.1.1-4jpp since
jpackage.org didn't release an update to 1.1.2.

My JDK is
java version "1.5.0_16"
Java(TM) 2 Runtime Environment, Standard Edition (build 1.5.0_16-b02)
Java HotSpot(TM) Server VM (build 1.5.0_16-b02, mixed mode)

With 'mail.debug=true' I get this on stdout:

-----------------------------------------------------------------------
25.07.2008 17:28:52 javax.mail.Session <init>
INFO: using GNU JavaMail 1.3
25.07.2008 17:28:52 javax.mail.Session loadProviders
INFO: no default providers
25.07.2008 17:28:52 javax.mail.Session loadProviders
INFO: loaded custom providers
25.07.2008 17:28:52 javax.mail.Session <init>
WARNUNG: no system providers
java.io.FileNotFoundException:
/usr/lib/jvm/java-1.5.0-sun-1.5.0.16/jre/lib/javamail.providers (No such
file or directory)
at java.io.FileInputStream.open(Native Method)
at java.io.FileInputStream.<init>(FileInputStream.java:106)
at javax.mail.Session.<init>(Session.java:130)
at javax.mail.Session.getInstance(Session.java:320)
at [...]

25.07.2008 17:28:52 javax.mail.Session <init>
FEIN: Providers by class name:
{gnu.mail.providers.nntp.NNTPTransport=javax.mail.Provider[TRANSPORT,nntp-post,gnu.mail.providers.nntp.NNTPTransport,***@gnu.org],
gnu.mail.providers.nntp.NNTPStore=javax.mail.Provider[STORE,nntp,gnu.mail.providers.nntp.NNTPStore,***@gnu.org],
gnu.mail.providers.imap.IMAPStore=javax.mail.Provider[STORE,imap,gnu.mail.providers.imap.IMAPStore,***@gnu.org],
gnu.mail.providers.maildir.MaildirStore=javax.mail.Provider[STORE,maildir,gnu.mail.providers.maildir.MaildirStore,***@gnu.org],
gnu.mail.providers.mbox.MboxStore=javax.mail.Provider[STORE,mbox,gnu.mail.providers.mbox.MboxStore,***@gnu.org],
gnu.mail.providers.pop3.POP3Store=javax.mail.Provider[STORE,pop3,gnu.mail.providers.pop3.POP3Store,***@gnu.org],
gnu.mail.providers.smtp.SMTPTransport=javax.mail.Provider[TRANSPORT,smtp,gnu.mail.providers.smtp.SMTPTransport,***@tapsellferrier.co.uk]}
25.07.2008 17:28:52 javax.mail.Session <init>
FEIN: Providers by protocol:
{nntp-post=javax.mail.Provider[TRANSPORT,nntp-post,gnu.mail.providers.nntp.NNTPTransport,***@gnu.org],
mbox=javax.mail.Provider[STORE,mbox,gnu.mail.providers.mbox.MboxStore,***@gnu.org],
nntp=javax.mail.Provider[STORE,nntp,gnu.mail.providers.nntp.NNTPStore,***@gnu.org],
imap=javax.mail.Provider[STORE,imap,gnu.mail.providers.imap.IMAPStore,***@gnu.org],
maildir=javax.mail.Provider[STORE,maildir,gnu.mail.providers.maildir.MaildirStore,***@gnu.org],
pop3=javax.mail.Provider[STORE,pop3,gnu.mail.providers.pop3.POP3Store,***@gnu.org],
smtp=javax.mail.Provider[TRANSPORT,smtp,gnu.mail.providers.smtp.SMTPTransport,***@tapsellferrier.co.uk]}
25.07.2008 17:28:52 javax.mail.Session loadAddressMap
INFO: no default address map
25.07.2008 17:28:52 javax.mail.Session loadAddressMap
INFO: loaded custom address map
25.07.2008 17:28:52 javax.mail.Session <init>
WARNUNG: no system address map
java.io.FileNotFoundException:
/usr/lib/jvm/java-1.5.0-sun-1.5.0.16/jre/lib/javamail.address.map (No such
file or directory)
at java.io.FileInputStream.open(Native Method)
at java.io.FileInputStream.<init>(FileInputStream.java:106)
at javax.mail.Session.<init>(Session.java:149)
at javax.mail.Session.getInstance(Session.java:320)
at [...]
-----------------------------------------------------------------------

I'm not sure if these missing files are really a problem. It seems that the
guys at jpackage.org didn't put them in the noarch.rpm.

I've seen in README.imap that you haven't tested with cyrus yet.

Any help appreciated. :-)

cu,
boris

[Boris Folgmann]

Hi,

I've hoped to get some comments on this.

Post by Boris Folgmann
Using the same code log in fails to the other server which is located in

Now I've had to allow plain logins to get my JavaMail code working. Should
I file a bug report about this somewhere else?

cu,
boris

[Chris Burdess]

Post by Boris Folgmann
I've hoped to get some comments on this.

Post by Boris Folgmann
Using the same code log in fails to the other server which is located in

Now I've had to allow plain logins to get my JavaMail code working. Should
I file a bug report about this somewhere else?

Sorry about the delay.

First, the missing files are not a problem given that you're loading
custom files in any case.

I don't honestly know why this is not working for you. The first thing
to do would be to try to disable SSL and look at the raw bytes being
passed for the CRAM digest using a tool like netcat or tcpflow. It may
be that there is a bug in the HMAC computation (the method hmac_md5 in
gnu.inet.util.SaslCramMD5, for instance) that computes the wrong value
for some input. This has been successfully tested with a number of
inputs, however - perhaps you could try changing the authentication
credentials and see if it is specific to particular values?