Email IMAP SSL issue ( with error log )

[clearlink]

We're looking to deploy Sugar 5.0 with email functionality. We're having trouble connection to our exchange server from our application server. Connecting from outlook through IMAP works perfectly.

We're running php 5.1.4 with mysql 5.

I've turned on the error log and when attempting to test the connection we get the following:

STARTING FINDOPTIMUMS LOOP----------------
Thu Feb 21 16:57:16 2008,928 [26716] DEBUG SugarCRM - 1: I-E testing string: {owa3.intermedia.net:993/service=imap/ssl/tls/validate-cert/secure}INBOX
Thu Feb 21 16:57:17 2008,206 [26716] DEBUG SugarCRM - 1: I-E failed using [{owa3.intermedia.net:993/service=imap/ssl/tls/validate-cert/secure}INBOX] - error: Unable to negotiate TLS with this server
Thu Feb 21 16:57:17 2008,207 [26716] DEBUG SugarCRM - 1: I-E clearing error and alert stacks.
Thu Feb 21 16:57:17 2008,207 [26716] DEBUG SugarCRM - 2: I-E testing string: {owa3.intermedia.net:993/service=imap/ssl/tls/validate-cert}INBOX
Thu Feb 21 16:57:17 2008,453 [26716] DEBUG SugarCRM - 2: I-E failed using [{owa3.intermedia.net:993/service=imap/ssl/tls/validate-cert}INBOX] - error: Unable to negotiate TLS with this server
Thu Feb 21 16:57:17 2008,454 [26716] DEBUG SugarCRM - 2: I-E clearing error and alert stacks.
Thu Feb 21 16:57:17 2008,454 [26716] DEBUG SugarCRM - 3: I-E testing string: {owa3.intermedia.net:993/service=imap/ssl/validate-cert/secure}INBOX
Thu Feb 21 16:57:17 2008,771 [26716] DEBUG SugarCRM - 3: I-E failed using [{owa3.intermedia.net:993/service=imap/ssl/validate-cert/secure}INBOX] - error: Can not authenticate to IMAP server: The AUTH protocol exchange was canceled by the client.
Thu Feb 21 16:57:17 2008,772 [26716] DEBUG SugarCRM - 3: I-E clearing error and alert stacks.
Thu Feb 21 16:57:17 2008,772 [26716] DEBUG SugarCRM - 4: I-E testing string: {owa3.intermedia.net:993/service=imap/ssl/validate-cert}INBOX
Thu Feb 21 16:57:18 2008,086 [26716] DEBUG SugarCRM - 4: I-E failed using [{owa3.intermedia.net:993/service=imap/ssl/validate-cert}INBOX] - error: Can not authenticate to IMAP server: The AUTH protocol exchange was canceled by the client.
Thu Feb 21 16:57:18 2008,087 [26716] DEBUG SugarCRM - 4: I-E clearing error and alert stacks.
Thu Feb 21 16:57:18 2008,087 [26716] DEBUG SugarCRM - 5: I-E testing string: {owa3.intermedia.net:993/service=imap/ssl/tls/secure}INBOX
Thu Feb 21 16:57:18 2008,333 [26716] DEBUG SugarCRM - 5: I-E failed using [{owa3.intermedia.net:993/service=imap/ssl/tls/secure}INBOX] - error: Unable to negotiate TLS with this server
Thu Feb 21 16:57:18 2008,334 [26716] DEBUG SugarCRM - 5: I-E clearing error and alert stacks.
Thu Feb 21 16:57:18 2008,334 [26716] DEBUG SugarCRM - 6: I-E testing string: {owa3.intermedia.net:993/service=imap/ssl/tls}INBOX
Thu Feb 21 16:57:18 2008,581 [26716] DEBUG SugarCRM - 6: I-E failed using [{owa3.intermedia.net:993/service=imap/ssl/tls}INBOX] - error: Unable to negotiate TLS with this server
Thu Feb 21 16:57:18 2008,581 [26716] DEBUG SugarCRM - 6: I-E clearing error and alert stacks.
Thu Feb 21 16:57:18 2008,581 [26716] DEBUG SugarCRM - 7: I-E testing string: {owa3.intermedia.net:993/service=imap/ssl/notls/novalidate-cert/secure}INBOX
Thu Feb 21 16:57:18 2008,921 [26716] DEBUG SugarCRM - 7: I-E failed using [{owa3.intermedia.net:993/service=imap/ssl/notls/novalidate-cert/secure}INBOX] - error: Can not authenticate to IMAP server: The AUTH protocol exchange was canceled by the client.
Thu Feb 21 16:57:18 2008,921 [26716] DEBUG SugarCRM - 7: I-E clearing error and alert stacks.
Thu Feb 21 16:57:18 2008,922 [26716] DEBUG SugarCRM - 8: I-E testing string: {owa3.intermedia.net:993/service=imap/ssl/notls/novalidate-cert}INBOX
Thu Feb 21 16:57:19 2008,236 [26716] DEBUG SugarCRM - 8: I-E failed using [{owa3.intermedia.net:993/service=imap/ssl/notls/novalidate-cert}INBOX] - error: Can not authenticate to IMAP server: The AUTH protocol exchange was canceled by the client.
Thu Feb 21 16:57:19 2008,236 [26716] DEBUG SugarCRM - 8: I-E clearing error and alert stacks.
Thu Feb 21 16:57:19 2008,237 [26716] DEBUG SugarCRM - 9: I-E testing string: {owa3.intermedia.net:993/service=imap/ssl/novalidate-cert/secure}INBOX
Thu Feb 21 16:57:19 2008,552 [26716] DEBUG SugarCRM - 9: I-E failed using [{owa3.intermedia.net:993/service=imap/ssl/novalidate-cert/secure}INBOX] - error: Can not authenticate to IMAP server: The AUTH protocol exchange was canceled by the client.
Thu Feb 21 16:57:19 2008,553 [26716] DEBUG SugarCRM - 9: I-E clearing error and alert stacks.
Thu Feb 21 16:57:19 2008,553 [26716] DEBUG SugarCRM - 10: I-E testing string: {owa3.intermedia.net:993/service=imap/ssl/novalidate-cert}INBOX
Thu Feb 21 16:57:19 2008,871 [26716] DEBUG SugarCRM - 10: I-E failed using [{owa3.intermedia.net:993/service=imap/ssl/novalidate-cert}INBOX] - error: Can not authenticate to IMAP server: The AUTH protocol exchange was canceled by the client.
Thu Feb 21 16:57:19 2008,872 [26716] DEBUG SugarCRM - 10: I-E clearing error and alert stacks.
Thu Feb 21 16:57:19 2008,872 [26716] DEBUG SugarCRM - 11: I-E testing string: {owa3.intermedia.net:993/service=imap/ssl/notls/secure}INBOX
Thu Feb 21 16:57:20 2008,187 [26716] DEBUG SugarCRM - 11: I-E failed using [{owa3.intermedia.net:993/service=imap/ssl/notls/secure}INBOX] - error: Can not authenticate to IMAP server: The AUTH protocol exchange was canceled by the client.
Thu Feb 21 16:57:20 2008,187 [26716] DEBUG SugarCRM - 11: I-E clearing error and alert stacks.
Thu Feb 21 16:57:20 2008,187 [26716] DEBUG SugarCRM - 12: I-E testing string: {owa3.intermedia.net:993/service=imap/ssl/notls}INBOX
Thu Feb 21 16:57:20 2008,503 [26716] DEBUG SugarCRM - 12: I-E failed using [{owa3.intermedia.net:993/service=imap/ssl/notls}INBOX] - error: Can not authenticate to IMAP server: The AUTH protocol exchange was canceled by the client.
Thu Feb 21 16:57:20 2008,504 [26716] DEBUG SugarCRM - 12: I-E clearing error and alert stacks.
Thu Feb 21 16:57:20 2008,504 [26716] DEBUG SugarCRM - 13: I-E testing string: {owa3.intermedia.net:993/service=imap/ssl/secure}INBOX
Thu Feb 21 16:57:20 2008,821 [26716] DEBUG SugarCRM - 13: I-E failed using [{owa3.intermedia.net:993/service=imap/ssl/secure}INBOX] - error: Can not authenticate to IMAP server: The AUTH protocol exchange was canceled by the client.
Thu Feb 21 16:57:20 2008,821 [26716] DEBUG SugarCRM - 13: I-E clearing error and alert stacks.
Thu Feb 21 16:57:20 2008,822 [26716] DEBUG SugarCRM - 14: I-E testing string: {owa3.intermedia.net:993/service=imap/ssl}INBOX
Thu Feb 21 16:57:21 2008,136 [26716] DEBUG SugarCRM - 14: I-E failed using [{owa3.intermedia.net:993/service=imap/ssl}INBOX] - error: Can not authenticate to IMAP server: The AUTH protocol exchange was canceled by the client.
Thu Feb 21 16:57:21 2008,136 [26716] DEBUG SugarCRM - 14: I-E clearing error and alert stacks.
Thu Feb 21 16:57:21 2008,136 [26716] DEBUG SugarCRM - ---------------end FINDOPTIMUMS LOOP----------------


I was hoping someone could interpret this for me and point me in the right direction. I'm guessin something is missing from my IMAP install or configuration but I don't know what.

[Angel]

Are you by any chance using Exchange 2007?

[michaelbennett]

I'm experiencing the same issue when I try connect to an Exchange 2007 server.

I'm running Centos 5. I've tried both PHP versions 5.1.6 and 5.2.5. The issue seems to be when Exchange 2007 advertises GSSAPI (Kerberos authentication), php-imap only tries to connect using GSSAPI authentication (and fails) and doesn't then try to use plain authentication. There is no setting in imap_open() to change this behaviour.

I haven't found a workaround yet. The general consensus seems to be that php needs to be compiled from source with kerberos disabled. I was hoping to avoid this but it may be the only option.

There is a PHP bug report that seems to be related to this http://bugs.php.net/bug.php?id=33500.

My debug log is below:
Sat Mar 29 23:02:27 2008,002 [15635] DEBUG SugarCRM - 10: I-E testing string: {mailserver:993/service=imap/ssl/novalidate-cert}INBOX
Sat Mar 29 23:02:27 2008,041 [15635] DEBUG SugarCRM - 10: I-E failed using [{mailserver:993/service=imap/ssl/novalidate-cert}INBOX] -
error: GSSAPI failure: Unknown code krb5 194 for mailserver
Sat Mar 29 23:02:27 2008,041 [15635] DEBUG SugarCRM - 10: I-E clearing error and alert stacks.

[Angel]

The reason for my earlier question to the earlier poster was that I had come across an article indicating something similar to what you describe regarding the advertising.

The article mentioned something along the lines of being able to modify this behavior by changing a setting on Exchange. Unfortunately, that was a while back when I stumbled upon the article, and I don't remember offhand what it was that needed to be changed. If I remember correctly it had something to do with forcing Exchange to use one protocol only or something like that.

If I find it again, I'll post the link.

[hydrospace]

any updates cause I have a similar issue when trying to connect via imap and ssl to a scalix server. Whcih advertises gssapi as well.

[jeffreyvsmith]

Same problem for me. Trying to connect to imap on exchange 2007 and get:
Kerberos error: No credentials cache found (try running kinit) for servername

php 5.1.6
fc6
sugarcrm 5.0.0.c
exchange 2007 sp1

[michaelbennett]

I've found a workaround for this issue.

You need to set up an IMAP proxy on the server running SugarCRM. I used http://www.imapproxy.org/. The installation was very simple.
./configure
make
make install
make install-conf
make install-init

Edit /etc/imapproxy.conf to point to your Exchange Server.
/etc/init.d/imapproxy start

Exchange 2007 needs to have IMAP configured to allow IMAP without SSL.
This can be done from the exchange powershell. I think the command is:
Set-imapsettings -LoginType plaintextlogin

You can probably configure it to use SSL, although I haven't tried yet.

In sugarCRM set up the imap server as the localhost (127.0.0.1)

I hope this helps.

[asiderop]

Has anyone been able to find a solution to this problem without going through an IMAP proxy?
Also, if you're running into the problem, go to the PHP Bug Report (linked above) and vote for the bug.

[steve.goldner]

OK. I am having a very similar issue to the original post. My error log is as follows:

Mon 27 Oct 2008 02:29:14 PM EDT [5329][82b4d031-30e5-2087-f747-43c40ee0c91a][DEBUG] ---------------STARTING FINDOPTIMUMS LOOP----------------
Mon 27 Oct 2008 02:29:14 PM EDT [5329][82b4d031-30e5-2087-f747-43c40ee0c91a][DEBUG] 1: I-E testing string: {myserver.com:993/service=imap/ssl/tls/validate-cert/secure}INBOX
Mon 27 Oct 2008 02:29:14 PM EDT [5329][82b4d031-30e5-2087-f747-43c40ee0c91a][DEBUG] 1: I-E failed using [{myserver.com:993/service=imap/ssl/tls/validate-cert/secure}INBOX] - error: Unable to negotiate TLS with this server
Mon 27 Oct 2008 02:29:14 PM EDT [5329][82b4d031-30e5-2087-f747-43c40ee0c91a][DEBUG] 1: I-E clearing error and alert stacks.
Mon 27 Oct 2008 02:29:14 PM EDT [5329][82b4d031-30e5-2087-f747-43c40ee0c91a][DEBUG] 2: I-E testing string: {myserver.com:993/service=imap/ssl/tls/validate-cert}INBOX
Mon 27 Oct 2008 02:29:14 PM EDT [5329][82b4d031-30e5-2087-f747-43c40ee0c91a][DEBUG] 2: I-E failed using [{myserver.com:993/service=imap/ssl/tls/validate-cert}INBOX] - error: Unable to negotiate TLS with this server
Mon 27 Oct 2008 02:29:14 PM EDT [5329][82b4d031-30e5-2087-f747-43c40ee0c91a][DEBUG] 2: I-E clearing error and alert stacks.
Mon 27 Oct 2008 02:29:14 PM EDT [5329][82b4d031-30e5-2087-f747-43c40ee0c91a][DEBUG] 3: I-E testing string: {myserver.com:993/service=imap/ssl/validate-cert/secure}INBOX
Mon 27 Oct 2008 02:29:14 PM EDT [5329][82b4d031-30e5-2087-f747-43c40ee0c91a][DEBUG] 3: I-E failed using [{myserver.com:993/service=imap/ssl/validate-cert/secure}INBOX] - error: Can't do secure authentication with this server
Mon 27 Oct 2008 02:29:14 PM EDT [5329][82b4d031-30e5-2087-f747-43c40ee0c91a][DEBUG] 3: I-E clearing error and alert stacks.
Mon 27 Oct 2008 02:29:14 PM EDT [5329][82b4d031-30e5-2087-f747-43c40ee0c91a][DEBUG] 4: I-E testing string: {myserver.com:993/service=imap/ssl/validate-cert}INBOX
Mon 27 Oct 2008 02:29:15 PM EDT [5329][82b4d031-30e5-2087-f747-43c40ee0c91a][DEBUG] 4: I-E failed using [{myserver.com:993/service=imap/ssl/validate-cert}INBOX]
Mon 27 Oct 2008 02:29:15 PM EDT [5329][82b4d031-30e5-2087-f747-43c40ee0c91a][DEBUG] 4: I-E ERROR: $ie->findOptimums() failed due to bad user credentials for user login: myuser

Originally, it was complaining about the ssl certificate on my Exchange 2003 server. Fixed that. Now, the above errors. When I select 'Test settings' in the email setting page for secure IMAP, I get the popup window that complains that the login or password is incorrect. However, if I simply change it back to pop3 (non-secure), the login works just fine. Just as a side note, I can connect to the same account using Evolution 2.12.3 with IMAPS.

Now, I see a ton of posts about this issue for Exchange 2007 - I am not running 2007.
SugarCRM Ver. 5.1.0 (Build 4732) on RHEL4 (Nahant Update 1)
connecting to Exchange 2003 SP2

Thanks for the help.

[steve.goldner]

OK. Fixed my issue with IMAPS with Exchange 2003. First, just a bit of history. The OWA certificate for our Exchange server was from Equifax and it is not in most distributed root trusts. So, when in the email settings section of SugarCRM and you choose to test IMAPS the only error that I got was "login or password is incorrect." Not very helpful when you know that the login/password information is correct. After turning on DEBUG logging, I saw that SugarCRM was unable to validate the SSL certificate on our OWA server. I added the Equifax root CA (for our certificate) to the OpenSSL CA trust. That resolved the certificate validation issue, but I was still getting the same login errors when testing IMAPS. Fixed one problem, but no change is user/GUI error message.

Now for the newbie light bulb moment. This is a clip from the error "Unable to negotiate TLS with this server." Now, originally this through me off because I could connect via Evolution using IMAPS. However, Evolution was authenticating via NTLM not TLS. Back to my Exchange configuration! Under the IMAP protocol section, go to IMAP properties. From that window choose the Access tab then the Authentication button. There you will see a wonderful set of checkboxes:
- Basic authentication (password is sent in clear text)
- Requires SSL/TLS encryption
Now, if you check both of those boxes, IMAPS will authenticate via SSL/TLS so your password is NOT sent in clear text.

I guess if the error message was any more to the point it would have bit me! Hope this helps the Exchange 2003 people.