Subject: [Wocky] Adium and Zephyr

From: Ken Raeburn <[email-masked]>
Date: Thu, 7 Feb 2008 16:28:11 -0500

I've been hacking on this a bit -- actually, trying to get the Adium/ 
libpurple build process to work for me at all was the annoying part,  
the Zephyr bits were easy -- and I seem to have an Adium executable  
based on current (svn) sources that supports Zephyr with Kerberos 4.

Disk image is available at /mit/raeburn/adium-hack.dmg (a.k.a /afs/ 
athena.mit.edu/user/r/a/raeburn/adium-hack.dmg or http://web.mit.edu/ 
raeburn/adium-hack.dmg) if anyone wants to play with it.  The image  
includes Adium.app and the sources (and maybe build trees, I'm not  
thinking about it that hard, but it's under GPL and I'm not going to  
maintain my own source distribution, so you get the whole ball of wax  
at once).  Patches will be supplied to the Adium project soon.

(Now that I've got the build process working, next up, in my copious  
free time: Authenticating to MIT's Jabber server.)

-- 
Ken Raeburn, Senior Programmer
MIT Kerberos Consortium

---

From: William Cattey <[email-masked]>
Date: Thu, 7 Feb 2008 18:02:58 -0500

I've just installed Ken's hacked up Adium, and so far it seems to  
work just fine.
The zephyr setup was a breeze, though non mit-sites may need a  
different default.

-Bill

----

William Cattey
Linux Platform Coordinator
MIT Information Services & Technology

N42-040M, 617-253-0140, [email-masked]
http://web.mit.edu/wdc/www/

On Feb 7, 2008, at 4:28 PM, Ken Raeburn wrote:

> _______________________________________________
> Wocky mailing list
> [email-masked]
> http://mailman.mit.edu/mailman/listinfo/wocky

---

From: Ken Raeburn <[email-masked]>
Date: Thu, 7 Feb 2008 18:43:13 -0500

> The zephyr setup was a breeze, though non mit-sites may need a  

Another difference to note: This version tries to launch its own copy  
of zhm (with servers listed in new Zephyr account preferences).  If  
you're already running one (maybe you have an old copy of MacZephyr  
installed?), it'll complain at you, but will still work.  I suspect  
two users on one host, or a user starting Adium and then MacZephyr,  
may get unhappy when the first Adium invocation quits and kills its  
zhm process.  For most cases, I expect the new behavior to be a win.

Ken

---

From: Ken Raeburn <[email-masked]>
Date: Thu, 14 Feb 2008 20:04:52 -0500

The new Adium beta (1.2.2b1) has the Zephyr fixes incorporated.

I think there may have been changes in 1.3svn regarding password  
storage; I'm getting prompted to re-enter passwords for most of my  
accounts now that I switched back to 1.2.2b1.

And I do still have to enter my password for jabber.mit.edu, that  
problem hasn't been fixed.

Ken

---

From: Ken Raeburn <[email-masked]>
Date: Tue, 25 Mar 2008 11:12:00 -0400

Adium 1.2.4b2 is out.  As near as I can tell, it fixes the bug where  
the Kerberos service principal name used depends on whether or not  
you specified the host explicitly as a "connect host".  Which means,  
it always uses the correct principal name now, but then always runs  
into the OpenFire server bug that, as in previous versions, it  
doesn't recover from.  So it prompts for passwords over and over.   
And specifying the connect host no longer bypasses the second bug by  
triggering the first.

In other words, this version doesn't work with the mit.edu jabber  
service.

Ken

-- 
Ken Raeburn, senior programmer
MIT Κέρβερος Consortium

---

From: Patrick McNeal <[email-masked]>
Date: Tue, 25 Mar 2008 11:33:34 -0400

> In other words, this version doesn't work with the mit.edu jabber

Thanks for the heads up on this.  Since there are bound to be users  
that download this new version, or come with it already on their  
machines, perhaps it will motivate our Jabber admins to update the  
server.

---

From: Ken Raeburn <[email-masked]>
Date: Tue, 25 Mar 2008 18:06:28 -0400

From traffic on the Adium developers list, it sounds like 1.2.4 will  
be released soon with the OpenFire authz problem not fixed.  While  
beta releases aren't generally brought to random users' attention,  
Adium release versions can (and do by default?) check for newer  
releases.  So in the next day or two, we can probably expect some  
people to start losing.

Ken

---

From: Patrick McNeal <[email-masked]>
Date: Wed, 26 Mar 2008 09:18:42 -0400

> releases.  So in the next day or two, we can probably expect some

To encourage users not to upgrade, I'd like to send a message to  
MacPartners about this problem.  Here's some draft text:

> Adium 1.2.4 is scheduled to be released sometime in the next few  
> days.  Through some initial testing, IS&T has determined it not to  
> be compatible with MIT's Jabber servers.  To avoid any service  
> interruptions, we recommend that users remain on their current  
> version of Adium as we work to resolve this issue.
>
> We'll continue to update MacPartners on this problem, and let users  
> know when it has been resolved.

If that looks okay, I'd like to send it out this afternoon.

--Patrick

---

From: Ken Raeburn <[email-masked]>
Date: Wed, 26 Mar 2008 10:26:02 -0400

>> version of Adium as we work to resolve this issue.

"servers", plural?  I think it should work okay with the test server  
wocky (which probably no one uses), and with Jeff's server on  
jis.mit.edu.  It's just the official server for mit.edu, running on  
jabber.mit.edu, that'd be a problem.  Unless we've got other servers  
I'm not aware of.

Otherwise, it looks accurate to me.

Ken

---

From: Ken Raeburn <[email-masked]>
Date: Wed, 26 Mar 2008 13:27:36 -0400

On Mar 26, 2008, at 12:30, Adam Seering wrote:
> I actually tried using it at one point.  I thought that it let me  
> sign on at first, but it hasn't for a while.  Is it a general- 
> access server?; does it still work?

I just signed on with Adium 1.2.4b2, using GSSAPI authentication.  It  
seems to have my contacts from mit.edu, but raeburn@wocky isn't  
actually authorized to see any of them.

I assume it's a test server and shouldn't be assumed to be  
*supported* for general use, may be taken down for work at random  
times, etc., but I'm only assuming...

Ken

---

From: Patrick McNeal <[email-masked]>
Date: Thu, 27 Mar 2008 09:23:04 -0400

> releases.  So in the next day or two, we can probably expect some

FWIW, DITR's Andrew Munchbach pointed out that Adium 1.2.4b2 does  
connect to the MIT Jabber server when you use port 5223 and check  
"Force old-style SSL."  Do we want to let folks know that this is a  
valid workaround, or do we not want people using these settings?

---

From: Greg Hudson <[email-masked]>
Date: Thu, 27 Mar 2008 10:10:18 -0400

> valid workaround, or do we not want people using these settings?

There's nothing particularly wrong with using these settings.  It's not
"the new way" but it's just as secure as using passwords over TLS
negotiated over port 5222.

Though I am a bit curious why it works.

---

From: Ken Raeburn <[email-masked]>
Date: Thu, 27 Mar 2008 13:22:53 -0400

> valid workaround, or do we not want people using these settings?

Ah, for some reason I didn't try that... maybe I was thinking about  
some other server that's not set up to support old-style SSL.  For  
whatever reason, it appears that in this mode, it never attempts  
GSSAPI authentication, even though the server offers it; it jumps  
straight to PLAIN (password) authentication.  So it does look like a  
possible work-around.

If we tell them to make this change, and then we update the server,  
do we have a way of telling them that the configuration change isn't  
needed any more?  Unless something changes on the Adium side, to try  
GSSAPI in this mode, they'll keep getting prompted for passwords,  
even after the software is fixed so that GSSAPI sign-ons work; we'll  
keep having them entering their Kerberos passwords into every program  
that asks for it (adium, mail, whatever), they'll keep saving their  
Kerberos passwords in keychains, etc.

Ken

---

From: Patrick McNeal <[email-masked]>
Date: Thu, 27 Mar 2008 13:52:33 -0400

On Mar 27, 2008, at 1:22 PM, Ken Raeburn wrote:
> needed any more?

Without using server logs to determine exactly what users are using a  
specific configuration, we'd have to rely on a wider, generic  
mailing.  Past experiences indicate that some users would never change  
back to the "correct" setting because the "wrong" setting works just  
fine.

>  Unless something changes on the Adium side, to try GSSAPI in this  
> mode, they'll keep getting prompted for passwords, even after the  
> software is fixed so that GSSAPI sign-ons work; we'll keep having  
> them entering their Kerberos passwords into every program that asks  
> for it (adium, mail, whatever), they'll keep saving their Kerberos  
> passwords in keychains, etc.

I'm a big fan of using GSSAPI whenever possible, and am inclined not  
to advertise this fix too widely to avoid the problem you describe.

---

From: Chris Murphy <[email-masked]>
Date: Thu, 27 Mar 2008 14:16:24 -0400

I just wanted to mention that this configuration is the same as is  
needed for using jabber.mit.edu with iChat (not a supported client but  
there is a stock answer at http://itinfo.mit.edu/answer.php?id=8061).   
Most Mac users I know, myself included, are using iChat so there is  
probably a sizable community out there.

-Chris

> to advertise this fix too widely to avoid the problem you describe.

===========================================
Chris Murphy
Network Engineer
MIT Information Services & Technology
Room W92-189
77 Massachusetts Avenue
Cambridge, MA  02139
[email-masked]