Kerberos SSO: ドメイン PC、Outlook、メール アプリでパスワードなしのサインイン

# 1. Service account (password never expires, AES only)
New-ADUser -Name svc-nextxch -AccountPassword (Read-Host -AsSecureString) `
  -Enabled $true -PasswordNeverExpires $true -KerberosEncryptionType AES256

# 2. Register the service principals (host name = name clients use)
setspn -S HTTP/mail.example.com  CORP\svc-nextxch
setspn -S imap/mail.example.com  CORP\svc-nextxch
setspn -S smtp/mail.example.com  CORP\svc-nextxch
setspn -S pop/mail.example.com   CORP\svc-nextxch
setspn -S sieve/mail.example.com CORP\svc-nextxch

# 3. Create the keytab (resets the account password)
ktpass -princ HTTP/mail.example.com@CORP.LOCAL -mapuser CORP\svc-nextxch `
  -crypto AES256-SHA1 -ptype KRB5_NT_PRINCIPAL -pass * -out nextxch.keytab

# 4. nextxch Admin > Identity sources > Kerberos
#    realm CORP.LOCAL, SPNs as above, upload the keytab, "Check Kerberos"

# Machine account mode (nextxch on domain member MAILSRV, no keytab):
setspn -S HTTP/mail.example.com CORP\MAILSRV$
setspn -S imap/mail.example.com CORP\MAILSRV$

# MIT / Heimdal
kadmin -q "addprinc -randkey HTTP/mail.firma.de@FIRMA.LOCAL"
kadmin -q "addprinc -randkey imap/mail.firma.de@FIRMA.LOCAL"
kadmin -q "addprinc -randkey smtp/mail.firma.de@FIRMA.LOCAL"
kadmin -q "ktadd -k /tmp/nextxch.keytab HTTP/mail.firma.de imap/mail.firma.de smtp/mail.firma.de"

# FreeIPA
ipa service-add HTTP/mail.firma.de
ipa service-add imap/mail.firma.de
ipa-getkeytab -s ipa.firma.local -p HTTP/mail.firma.de -k /tmp/nextxch.keytab
ipa-getkeytab -s ipa.firma.local -p imap/mail.firma.de -k /tmp/nextxch.keytab

# Test vom Client:
kinit anna && curl --negotiate -u : https://mail.firma.de/api/auth/kerberos

# Auf einem Domänen-PC als normaler Benutzer:
klist purge
Invoke-WebRequest https://mail.firma.de/api/auth/kerberos -UseDefaultCredentials
klist                     # zeigt Ticket für HTTP/mail.firma.de
# Erwartet: 200 {"ok":true,"email":"anna@firma.de"}

# IMAP mit GSSAPI (Linux-Client in der Domäne):
kinit anna@FIRMA.LOCAL
curl -v --login-options AUTH=GSSAPI --negotiate -u : imaps://mail.firma.de/INBOX