The idea would be to wrap a server-side IMAP client in a wrapper that transforms IMAP authentication into a web API for authentication (maybe OAuth?). When the back-end application receives credentials, it then passes them onto IMAP without storing them, waits to see if authentication was successful and if it was, it then returns the user's session key and identity information.
This could provide a simple form of SSO for authenticating users in an organization that lacks robust, formal identity management like Active Directory.
Does this already exist? Any serious security concerns with this setup given SSL/TLS are used for transporting credentials?
Edit: I want to clarify that I do have one implementation of this method, and it presents itself to the web application as OAuth, so at to avoid being proprietary/not-replaceable. I guess what I'm asking is: "Is wrapping IMAP so that it can present itself as OAuth to an application a valid, novel and secure approach to authentication for people with no other OAuth provider or for whom their email credential is their most important credential?" I'm playing with the idea of turning my wrapper into an open-source project so that small businesses can use this wrapper as an authentication provider for low-traffic web-apps instead of paying for huge identity solutions.