diff --git a/dovecot/defaults/main.yml b/dovecot/defaults/main.yml
index 9d03d8adeb5ae7ace7d07f418995317cd4186046..dcf1bde29e567cc6df8312daaab7ef4652af74f5 100644
--- a/dovecot/defaults/main.yml
+++ b/dovecot/defaults/main.yml
@@ -32,4 +32,12 @@ dovecot_content_filter: false
 dovecot_spam_folder: Spam
 dovecot_spam_user: "${1}"  # debian-spamd
 dovecot_sieve: 'file:~/sieve;active=~/.dovecot.sieve'
+
+# These variables were introduced for compatibility to a certain setup.
+# They may disappear without prior notice and/or may not work as expected.
+dovecot_auth_realms: []
+dovecot_auth_default_realm: ''
+dovecot_auth_krb5_keytab: ''
+dovecot_auth_mechanisms:
+  - plain
 dovecot_special_mailbox_auto_subscribe: false
diff --git a/dovecot/templates/conf.d/10-auth.conf.j2 b/dovecot/templates/conf.d/10-auth.conf.j2
index 5daa65effa3ee600088fce4e76e49809ff707655..7c8a79ad7f073bb107230f7b33aa4900268e45b0 100644
--- a/dovecot/templates/conf.d/10-auth.conf.j2
+++ b/dovecot/templates/conf.d/10-auth.conf.j2
@@ -26,11 +26,11 @@ disable_plaintext_auth = yes
 # them. You can leave it empty if you don't want to support multiple realms.
 # Many clients simply use the first one listed here, so keep the default realm
 # first.
-#auth_realms =
+auth_realms = {{ dovecot_auth_realms|join(" ") }}
 
 # Default realm/domain to use if none was specified. This is used for both
 # SASL realms and appending @domain to username in plaintext logins.
-#auth_default_realm = 
+auth_default_realm = {{ dovecot_auth_default_realm }}
 
 # List of allowed characters in username. If the user-given username contains
 # a character not listed in here, the login automatically fails. This is just
@@ -77,7 +77,7 @@ auth_username_format = %Ln
 # Kerberos keytab to use for the GSSAPI mechanism. Will use the system
 # default (usually /etc/krb5.keytab) if not specified. You may need to change
 # the auth service to run as root to be able to read this file.
-#auth_krb5_keytab = 
+auth_krb5_keytab = {{ dovecot_auth_krb5_keytab }}
 
 # Do NTLM and GSS-SPNEGO authentication using Samba's winbind daemon and
 # ntlm_auth helper. <doc/wiki/Authentication/Mechanisms/Winbind.txt>
@@ -101,7 +101,7 @@ auth_username_format = %Ln
 #   plain login digest-md5 cram-md5 ntlm rpa apop anonymous gssapi otp
 #   gss-spnego
 # NOTE: See also disable_plaintext_auth setting.
-auth_mechanisms = plain
+auth_mechanisms = {{ dovecot_auth_mechanisms|join(" ") }}
 
 ##
 ## Password and user databases