# HP OpenView Service Desk

## version 4.5

## ESMTP authentication for outbound mail

September 2006

© Copyright 2006 Hewlett-Packard Development Company, L.P.

## Content:

Last-minute information
Introduction
Getting Started

## LAST-MINUTE INFORMATION

There is no last-minute information.

## INTRODUCTION

When a mail server does not require clients to authenticate themselves, it becomes vulnerable to misuse. For this reason, many mail servers require authentication nowadays. The SMTP authentication for outbound mail feature makes it possible for Service Desk to provide authentication information to an external mail server that Service Desk uses to send mail.

This enhancement is sometimes also referred to as ESMTP authentication. ESMTP defines a way to add extra commands to SMTP, the protocol used for sending mail. Authentication is a command extension. However, in this document, we will simply refer to this enhancement as SMTP authentication. This is also how it is called in Service Desk itself.

## GETTING STARTED

### Configuring authentication outbound mail

To configure authentication for outbound mail, a new tab page has been added to the e-mail configuration options. These can be found in the Administrator Console, under System Panel, E-mail. On this page, authentication for outbound mail can be turned on by checking the "Use SMTP Authentication" checkbox. An example of this new tab page is shown below:

When the checkbox "Use SMTP Authentication" is ticked, all attempts to send outbound mail from Service Desk will be done using the user and password specified on this page. When the checkbox "Use SMTP Authentication" is disabled, all the fields on this page will be grayed out. Any settings entered previously will be maintained but unused.

The checkboxes underneath the password field allow an administrator to turn off the use of specific SASL mechanisms. A SASL mechanism is an implementation of an authentication algorithm for a mail client. As can be deducted from the screenshot, Service Desk supports four authentication mechanisms for outbound mail: PLAIN, LOGIN, CRAM-MD5 and DIGEST-MD5.

Under normal circumstances, the administrator will not have to disable any SASL mechanism at all. In the same way as most mail clients do, Service Desk uses the first authentication mechanism that the mail server reports to support and that it also supports itself. This way, the mail client and mail server automatically negotiate which authentication mechanism will be used.

However, the administrator may choose to disable certain mechanisms to comply with company policies. For example, the authentication information sent through the PLAIN and LOGIN methods can be intercepted by network sniffing. For this reason, a company may decide to disallow use of those authentication methods. Another reason for the administrator to disable selected SASL mechanisms is to troubleshoot authentication problems.

It is not possible to disable all the SASL mechanisms by checking all of the four checkboxes for the mechanisms: at least one must be selected at any time. Using none of the SASL mechanisms is effectively the same as not using SMTP authentication. The "Use SMTP Authentication" checkbox should be cleared to configure Service Desk to stop using this enhancement.

NOTE: DIGEST-MD5 authentication requires not only a username and a password but also a realm. The realm can be entered as part of the username by placing a @-sign behind the username. The part behind the @-sign is used as the realm and everything before it as username.

### Testing the outbound mail authentication settings

To test the authentication settings, you can use the "Send test mail..." button, which is on the General tab page of the E-mail Properties dialog.

### Places where outbound mail is sent in Service Desk

Service Desk sends mail when any of the following applies:

- Service Desk executes a database rule that includes a "Send e-mail message" action.
- The current user in the Service Desk client is configured to "Send me e-mail when items are assigned to me" or "Send me e-mail when items are assigned to my group". You can turn on these settings in the client from the Tools menu, under Options, Advanced.
- The current user in the Service Desk client is configured to "Send me an e-mail if I need to approve an item." This setting is also enabled from the Tools menu, under Options, Advanced.
- The current user in the Service Desk client adds an e-mail to a Service Call.