[horde] Re: IMP 4.0.2 integration

[Jan Schneider]

Zitat von Przemyslaw Nogaj <pn at tey.pl>:

> some time ago we developed administration tool for support our work that
> uses IMP 2.6 as a mail client. Currently we are working on new version
> of this tool, and we want to upgrade IMP to version 4.0.2 and Horde to
> version 3.0.3, but... there is a problem with auto-login. Our
> application make use of our own framework, so integration is not the
> best world for this...
>
> Our system logins into horde users when they are login into our tool:
> - setup all $_POST variables required during login process,
> - include imp/redirect.php,
> - horde authorization is set to:
>     $conf['auth']['driver'] = 'application';
>     $conf['auth']['params']['app']  = 'imp';
>
> In maillog I can see that IMP do his job (authorization), all session
> data and cookies are created, and mainpage of our tool is loaded. But
> when I try to go to e.g. inbox by url:
>
> https://ouraplication.pl/horde/imp/mailbox?no_newmail_popup=1&mailbox=INBOX
>
> the login form appears... This same thing occures with no-ssl

You might have been hit by the fact that Horde/IMP start a new session 
after the login to avoid session fixation attacks. This means that any 
session that was started before the login doesn't exist anymore at this 
point.
This should at least give you a starting point for further investigations.

You might also want to consider creating a transparent authentication 
driver for your system instead.

Jan.

-- 
Do you need professional PHP or Horde consulting?
http://horde.org/consulting/