IMAP users continually prompted for password when switching folders

I've sifted through /var/log/mailaccess.log and I notice the following message is logged when the above behavior occurs:
Jan 19 00:59:49 hostname imap[3879]: badlogin: [XXX.XXX.XXX.XXX] GSSAPI [SASL(-13): authentication failure: user username is not allowed to proxy]
XServe Dual G5   Mac OS X (10.4.8)   latest updates as of 1/19/07

to elaborate on this issue a bit more.
This issue seems to be isolated to imap clients only and started occurring two days ago on a server that has worked great for a long time. The exception is Squirrelmail which works flawlessly (Thunderbird, entourage, mail.app, etc. seem to have the problem)
The only change (that we are aware of) is a shift in the spamassassin kill rates (from 7 to 6). However reverting this doesn't help.
A user can log into their imap account without problem but when navigating to a different iMap folder the authentication information is sent, fails and reprompts then for their credentials. The second attempt (retyping of the password) works and they see their email.
The problem seems to be isolated to a few users and does not affect everybody. We can not find a commonality between them though.
The error message (posted above) is what we see in the log files. We see this in
system.log
asl.log
if it helps we are also getting some skiplist errors in mail.log
"Message skiplist: recovered"
Finally we ran all of the latest updates and are fully "upped" so to speak.
POSTCONF -n
alias_maps = hash:/etc/aliases,hash:/var/mailman/data/aliases
command_directory = /usr/sbin
config_directory = /etc/postfix
content_filter = smtp-amavis:[127.0.0.1]:10024
daemon_directory = /usr/libexec/postfix
debugpeerlevel = 2
defaultprocesslimit = 75
disablevrfycommand = yes
enableserveroptions = yes
html_directory = no
inet_interfaces = all
localrecipientmaps =
luser_relay = undeliverable
mail_owner = postfix
mailboxsizelimit = 0
mailbox_transport = cyrus
mailq_path = /usr/bin/mailq
manpage_directory = /usr/share/man
messagesizelimit = 0
mydestination = $myhostname,localhost.$mydomain,localhost,youthchannel.org,mnn.org
mydomain = mnn.org
mydomain_fallback = localhost
myhostname = mail.mnn.org
mynetworks = 127.0.0.0/8,192.168.0.0/16,216.164.83.166/32
mynetworks_style = host
newaliases_path = /usr/bin/newaliases
ownerrequestspecial = no
queue_directory = /private/var/spool/postfix
readme_directory = /usr/share/doc/postfix
recipient_delimiter = +
sample_directory = /usr/share/doc/postfix/examples
sendmail_path = /usr/sbin/sendmail
setgid_group = postdrop
smtpdclientrestrictions = permitsaslauthenticated, permit_mynetworks, rejectrblclient cbl.abuseat.org, rejectrblclient bl.spamcop.net, rejectrblclient sbl-xbl.spamhaus.org
smtpddatarestrictions = permit_mynetworks, rejectunauthpipelining, rejectmulti_recipientbounce, permit
smtpdhelorequired = yes
smtpdhelorestrictions = permitsaslauthenticated, permit_mynetworks, checkheloaccess hash:/etc/postfix/helo_access, rejectnon_fqdnhostname, rejectnon_fqdnsender, rejectnon_fqdnrecipient, rejectunknown_senderdomain, rejectunknown_recipientdomain, rejectinvalidhostname
smtpdpw_server_securityoptions = login,plain,cram-md5,gssapi
smtpdrecipientrestrictions = permitsaslauthenticated, permit_mynetworks, rejectnon_fqdnhostname, rejectnon_fqdnsender, rejectnon_fqdnrecipient, rejectunknown_senderdomain, rejectunauthdestination, rejectunlistedrecipient, rejectrblclient sbl-xbl.spamhaus.org, rejectrblclient cbl.abuseat.org, rejectrblclient bl.spamcop.net, permit
smtpdreject_unlistedrecipient = yes
smtpdsasl_authenable = yes
smtpdsenderrestrictions = permitsaslauthenticated, permit_mynetworks, rejectunknownaddress, rejectunknown_senderdomain, rejectnon_fqdnsender, permit
smtpdtls_certfile = /etc/certificates/Default.crt
smtpdtls_keyfile = /etc/certificates/Default.key
smtpduse_pwserver = yes
smtpdusetls = no
strictrfc821envelopes = yes
unknownaddress_rejectcode = 554
unknownclient_rejectcode = 554
unknownhostname_rejectcode = 554
unknownlocal_recipient_rejectcode = 550
Thanks for any insight.
xServe Dual G5 Mac OS X (10.4.8) powerbooks, ibooks, imacs, n' more
xServe Dual G5   Mac OS X (10.4.8)   powerbooks, ibooks, imacs, n' more

Similar Messages

  • SharePoint prompting for password when saving word document

    Saving a word document back to SharePoint always prompts for credentials.
    I am the administrator for a SharePoint farm. We have enabled kerberos, and added the portal to the intranet zone in Internet Explorer by group policy. Most of the time this limits the amount of password prompts our customers see (including viewing the portal
    in a browser, and opening documents); however, we are still getting the prompt for credentials when trying to save a word document back to SharePoint.
    Here are some details: - SharePoint 2010 - Word 2010 - Kerberos enabled - Portal added to intranet zone in IE - Checkbox for passing automatic credentials enabled
    Can anyone help? Is there something I've missed? Is this prompt just unavoidable?

    Hi,
    Internet Explorer uses the Web Client service when you use Internet Explorer to access a
    WebDAV resource. The Web Client Service uses Windows HTTP Services (WinHTTP) to perform the network I/O to the remote host.  WinHTTP sends user credentials only in response to requests that occur on a local intranet site. 
    However, WinHTTP does not check the security zone
    settings in Internet Explorer to determine whether a Web site is in a zone that lets credentials be sent automatically.
    Click Start, type regedit in the Start Search box, and then press
    ENTER.
    Locate and then click the following registry subkey:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WebClient\Parameters
    On the Edit menu, point to New, and then click
    Multi-String Value.
    Type AuthForwardServerList, and then press ENTER.
    On the Edit menu, click Modify.
    In the Value data box, type the URL of the server that hosts the Web share, and then click
    OK.
    Note   You can also type a list of URLs in the
    Value data box. For more information, see the "Sample URL list" section in this article.
    Exit Registry Editor.
    After this registry entry is created, the WebClient service will read the entry value. If the client computer tries to access a URL that matches any of the expressions in the list,   the user credential will be sent successfully to authenticate
    the user, even if no proxy is configured.
    Note You have to  restart the WebClient service after you modify the registry.
    Reference: http://support.microsoft.com/kb/943280?wa=wsignin1.0
    -Ivan
    Ivan Sanders My LinkedIn Profile,
    My Blog,
    @iasanders.

  • Outlook 2007 Clients Prompt For Password When Opening

    I am running Exchange 2007 Standard.  New outlook 07 clients prompt for password each time it is opened.  Older clients do not prompt for password.  Is there any way for outlook 07 to not prompt for password?  Users already logged into domain, should their credentials not be recognized automatically like with outlook 03?

    This fixed it for me.
    http://social.technet.microsoft.com/Forums/en-US/exchangesvrgeneral/thread/383d130e-869f-4fce-9502-8b340904b0ba/#636c5a5e-c61f-414b-8e85-562c888b83cc
    Quote:
    Same problem here after restarting SBS 2008 for upgrades (annoying login box popping up after starting Outlook and also other times). 
    This solved the problem for me:
    IIS Mgr on SBS 2008 / - / SBS Web Applications /
    - SSL Settings / Client certificates - Stop / Start web server after changing settings: 
    Autodiscover: Ignore 
    EWS: Ignore 
    OAB: Accept *) 
    owa: Accept *) 
    Rpc: Accept *) 
    RpcWithCert: Accept *) 
    *) All these have to be Accept to get rid of login box 
    Best regards 
    Bjorn
    I was having the same issue. SBS2008, Exchange 2007. Only being prompted in Outlook 2007 clients. Tried a lot of different things to fix it, but none worked. This started happening after a round of security updates but I could not find KB2412171 on the list.

  • Exchange 2013/2010 Co-existance Outlook Users Always Prompted for Password

    Hello,
    We are in the process of attempting to migrate to Exchange 2013, but during the migration time, we need to coexist with the two versions.  Our outlook clients are a mix of Office 2007, 2010, and 2013.  When a user is migrated from 2010 to 2013,
    they start getting prompted for their password in Outlook every few minutes.  They can click cancel and continue working, but they continue to get prompts for their password.  If they click the update folder button in outlook, it updates fine, and
    the password prompt goes away for awhile. 
    Most topics on this state that this is caused by a certificate issue.  We have an internally deployed CA, with the Root certificate trusted by all clients.  The exchange 2013 server has a certificate that was created by this CA.
    I believe that this is caused by OAB (address book) still being hosted on the Exchange 2010 server (with a self signed cert), that is causing the connection to fail.  Is there anyway to test this without breaking outlook connections for the users that
    are on Exchange 2010?  Or is there any other reason that this would occur?
    Thanks for any assistance.

    Sorry for taking so long to reply, other items came up that rank higher then this migration.
    I ran the Test-OutlookWebServices CMD and got this result:
    [PS] C:\Windows\system32> Test-OutlookWebServices
    Source                              ServiceEndpoint                    
    Scenario                       Result  Latency
    (MS)
    EXCHANGE13.company.local           exchange10.company.local           Autodiscover: Outlook Provider Failure     229
    EXCHANGE13.company.local                                              
    Exchange Web Services          Skipped       0
    EXCHANGE13.company.local                                              
    Availability Service           Skipped       0
    EXCHANGE13.company.local                                              
    Offline Address Book           Skipped       0
    I
    am currently thinking that this may be the error.  Is there a way to
    change the first failing result to the hostname of the
    exchange13.company.local without breaking the current settings for the
    exchange10.company.local autodiscover?

  • Prompted for Password when Moving Item to Trash

    Whenever I attempt to send anything from my Startup Disk to the Trash (This problem only happens when moving to the trash from the Startup disk, not with my external hard drive or any USB drives attached) it prompts for my Administrator Username and Password. When I do that, the file then skips the trash and is deleted immediately. Items already in the trash are seemingly unnaffected.
    I did some research online, which led me to believe it might be my trashes.db file. I followed some steps to fix this file in the UNIX Terminal, but I can't do that without a SU (SuperUser) account, so I enabled the root account and used that for the repair. However, nothing has changed and I am continuing to see this problem.
    I am running OS X Lion, 10.7.2, and it is a 2010 Mac Mini. I am an administrator account and I have access to UNIX sudo commands through the root user set up on my computer. Any help would be greatly appreciated.

    Thanks to both for your replies.
    Eric,
    Thanks much for that link and the Apple Token workaround. That did the trick!
    Thanks a lot for your help.
    Best,
    Andre

  • Outlook 2013 repeatedly prompts for password when connecting to Exchange Server 2010

    I am trying to configure Outlook 2013 on a Windows 8.1 Pro client.  The exchange server is 2010 SP1 and works just fine with OL 2010.
    When I configure OL 2013, the configuration prompts for a password for the account repeatedly with both NTLM and Basic Authentication chosen.  OL 2013 tries to connect and then it disconnects with the password for the account repeatedly prompted. When
    the credentials are entered, the prompt reappears immediately.
    Might anyone help?
    Many thanks in advance
    Shuvo

    Hi Shuvo,
    Please check whether this user can access mailbox in OWA. Please manual setup this account in Control Panel to have a try. Make sure your
    Server name and User name are configured correctly. If you are configure the account in internal domain environment, please click
    More Settings, set Negotiate Authentication in
    Security tab and uncheck Connect to Microsoft Exchange using HTTP in Connection tab.
    If there is any updates, please feel free to let us know.
    Thanks,
    Winnie Liang
    TechNet Community Support

  • After Migrating To Exchange 2013 All Outlook 2010 Users Constantly Prompted For Password (BUT OUTLOOK WORKS).

    I have two servers.  One is Exchange 2010 and the other is Exchange 2013.
    Three of our users had mailboxes on Exchange 2013 for the last few weeks with no problems.  They used Outlook 2013 and Outlook 2010.  After moving the rest of our ~25 users to Exchange 2013 the users with Outlook 2010 began to be prompted for their
    password constantly.
    They try entering it and it immediately reappears.  
    The odd thing is it shows connected and they are able to send and receive emails correctly.  
    I've tested our exchange connectivity using www.testexchangeconnectivity.com and all is well there.
    I'm not really sure what's going on.
    Any help is appreciated.  
    Luke
    Thanks, Luke Pickard

    This can appear if Outlook clients are trying to connect to OAB virtual directory, and don't succeed for some reason. Mailbox and mailflow will work, but password prompt will appear when Outlook tries to contact OAB. Try to investigate in that direction.
    Also, perform Outlook Configuration test (right click Outlook icon in task bar while holding CTRL and select Test email autoconfiguration.
    Please mark as helpful if you find my contribution useful or as an answer if it does answer your question. That will encourage me - and others - to take time out to help you. Thank you! Damir

  • Kerberos - client has TGT, but prompted for password when accessing share.

    I'm getting ready to deploy Leopard to my client base and I'm doing final testing. I have a magic triangle/cylinder of destiny situation, using Active Directory and Open Directory running on 10.5.2.
    With a 10.5.2 client bound to both directories, I can log in to the client machine with an AD account, however when I try to connect to a file share, I am prompted for name & password. I checked /System/Library/CoreServices/Kerberos, and I have a TGT.
    I'm stumped as to why I'm being prompted when I have a TGT. Any ideas?

    Go back to the basics. Time and DNS. Make sure all servers are using the same time server (OD box points to AD domain controller - use ntpq -p to confirm time sync). Make sure forward and reverse resolve works for all servers in the chain. If this all checks out, then look at your AFP service settings or temporarily launch SMB and see if it will issue a service ticket.
    You are talking to two different machines but with a common auth point. The first process, getting the TGT is entirely devoted to communication with the AD domain. The KDC in AD agreed that you are who you claim to be and that you can be trusted, thus granting you access to domain resources. The next step is attempting to access a resource on a server that you believe to be part of the trust. In this case, an OS X Server running AFP (assumably). In this case, the OD system needs to be configured as a domain member of the AD environment and all services "Kerberized". This is an area in which Apple needs a little work under Leopard. Tiger was so easy. I've had better luck using dsconfigad's enablesso than with the GUI tools.
    However, assuming that you performed all the usual steps, first review the contents of your edu.mit.kerberos file and make sure that Leopard did not rewrite the file and place the OD system in as the KDC. That is all wrong. Next, take a look at your principles by using klist -k. Is the realm information correct? And finally, review the settings in the afp configuration file. The realm information in that file is often messed up if you launch AFP before you have the server bound up properly.
    My guess is that the OD box thinks it is the KDC and you will likely need to manually edit the edu.mit.kerberos file and force the file to be static (remove the third and fourth lines). This is common if you joined the AD domain and then promoted the server to OD Master.
    Hope this helps

  • Stop prompting for password when uninstalling an application

    Is there any way to turn off OS X from prompting for my password when deleting/uninstalling an application?

    This is a security feature I would not want to disable. In addition to helping prevent accidentally deleting an app, it also protects against potential installation of nefarious malware.
    True, it is a little bit of inconvenience, but, really, how often is it necessary to uninstall something?

  • Ipad not prompting for password when trying to access a wireless router

    bought new ipad cannot access internet thru wireless router have 2 iphones that work.  try to access a protected wireless network but is not asked for password just told cannot access.

    This link may be helpful.
    http://support.apple.com/kb/TS1398

  • Mac users prompted for password when reading PDFs from Internet

    We produce PDFs with a randomly generated password to "protect" them from being editted.
    Periodically, we get complaints from Mac users who, upon clicking the PDF link, are prompted to enter the password.  My guess at this point is that they have Acrobat (not Reader) installed and it's wanting to open the PDF in an editable mode by default. 
    Does this sound correct?
    What instructions should we give them to work around this issue?  Is there a settings change for this (least desireable) or a Ctrl-Click sequence to get it in "read-only" mode?
    We're not Mac folks -- don't have one in-house -- so we haven't had an environment to experiment in.
    BTW:  The issue is with our clients' customers so we need something fairly non-technical for directions.
    Thanks, Scott

    Scott, Check your private messages.

  • Continuously Prompted for Password In Discoverer Viewer

    When trying to open a workbook or drill to see the sheets in the workbook i'm getting the error:
    ENTER PASSWORD
    The item you are requesting requires you to enter a password.
    This could occur beacuse this is a private connection or because the public connection password was invalid.Please enter the correct password now to continue.
    Username -
    database -
    End user Layer -
    Connect to -
    Locale :
    Password:
    I'm Using Full host.domain name in my configuration files
    Can Some one help me with this Issue?
    Edited by: user10177051 on May 13, 2009 5:20 PM

    Hello
    You obviously are using a full application server with the capability to have Portal and both private and public connections.
    If you are using a public connection then the password will be stored within the system and whenever the user clicks on the connection the password will be provided automatically. This is fine unless someone changes the password in the database. If this happens you will need to edit the definition for the public connection, using application server control, and provide the password.
    If you are using a private connection then the passwords for these are not held centrally and you are required to provide the password at run time. This is normal behavior. After you have logged in, providing you stay within the same browser session you will not be prompted again. This happens with cookies. Upon successful logging in a temporary cookie is provided indicating to the local machine that the browser session has authenticated. If you close the session you will have to provide the password again. It goes without saying that you must have cookies enabled. Without these you will have some issues.
    The only way to get private connections to store their passwords centrally is to use Single Sign-On. With this enabled and set up on the application server then even private connection passwords are stored.
    I hope this helps
    Best wishes
    Michael

  • Prompted for password when opening icloud mail

    Hi,
    I downloaded Mavericks a week or so ago and everything's fine except one glitch:
    Whenever I open the Mail app, it prompts me to enter my password before retrieving anything. As soon as I enter my password it connects to iCloud fine. Under Preferences (General account tab) there is a password slot into which the password can be entered. But when I do that, and then save the changes, it doesn't retain the information. When I re-open the Mail app, the same prompt re-appears. When I check Preferences, the password slot is still empty.
    I also have a pop account separate from iCloud IMAP, and that works just fine. Like it did under Mountain Lion.
    Is there some kind of glitch still? I downloaded today the 11-08-2013 Maverick mail update from the App store, but that didn't solve this particular problem. It appears to be related to GMail accounts only anyway.
    Any thoughts on how I can get the Mail app to retain my password info for the iCloud account so that I don't have to keep re-entering it?
    Many TIA for any hints!
    (P.S: My machine is a 2012 15" RD MacBook Pro)

    Thanks to both for your replies.
    Eric,
    Thanks much for that link and the Apple Token workaround. That did the trick!
    Thanks a lot for your help.
    Best,
    Andre

  • How to disable the prompt for password when receiving a call on Lync mobile on iPhone

    We are doing a pilot on Lync 2013.  We have mobile phones: i Phones.
    When we are receiving a call, we are prompted to enter password to take the call, which in certain cases, might be a real irritant.  Is there a way to bypass, or simply removing this prompt?

    I am not aware of any password to receive calls (and certainly there's no option I am aware of within Lync mobility policy settings)
    Is this a phone password (i.e. such as the PIN code) or do you enter your AD password? 
    If it's the phone password then you can turn it off through Settings > Passcode, unless it set by company policy (i.e through ActiveSync policies in which case this is set through Exchange). Bear in mind that if it is your phone password then you'll have
    no security on your phone.
    If this helped you please click "Vote As Helpful" if it answered your question please click "Mark As Answer"
    Georg Thomas | Lync MVP
    Blog www.lynced.com.au | Twitter
    @georgathomas
    Lync Edge Port Check (Beta)

  • XFA Pdf form call secure webservice without prompt for password

    Hi,
    We are using XFA forms within the company. We have created many (400+) interactive forms with fields to fill manually.
    Now the business would like to lookup account details. They want user to be able to enter account number and then lookup details through webservice.
    The webservice is created on HOST/CICS and in COBOL. We need security on HTTPS and we cannot accept that the user is prompted for password.
    Our security department state that normal practice is to use KERBEROS token that gets authenticated later - is that possible with Adobe Reader??
    Have anyone developed this functionality within XFA forms and Adobe Reader?
    Thanks in advance,
    Thomas Groenbaek

    Reader can make Web Service calls but the form must be Reader Extended by LiveCycle Server to allow this. It does support secure web service calls but it does uid/pwsd or certificate authentication. Note that the web service can only return simple types. Objects cannot be returned.
    Paul

Maybe you are looking for