[EiZ]

The reverse-proxy hackery will only work to limit the http access and I don't see how to avoid double sign on.

PAM would be the saver here if zimbra auth component allowed a PAM stack traversal.

But I believe zimbra does not use PAM. Am I wrong ?