Does DMS support auth via "App Password" for Microsoft Outlook?

[toadee]

Apologies if this has been asked before but I couldn't find a relevant post.

I'm trying to add my mail address to the new outlook but it seems to fail always. Looking further, apparently microsoft has abandoned basic auth and now requires modern auth using an "App Password". Does DMS provide such a thing?

The error i get in DMS is:

mail dovecot: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=*********

The rip is associated with Microsoft. Is outlook basically a no go and if so what usable mail client is there?

[glime-ai[bot]]

Please note that this response was created using generative AI, leveraging previously available information from the repository. This information may be helpful. However, it is our strong recommendation that you carefully consider the information before blindly applying it.

---

Based on the information provided in the context, Docker Mail Server (DMS) does not inherently provide "App Passwords" as part of its core functionality. The concept of "App Passwords" is typically associated with services like Google or Microsoft, where they allow users to generate unique passwords for third-party apps to access their main account in a secure manner, especially when those third-party apps do not support modern authentication methods.

However, DMS does support integrating with external authentication systems, as indicated by its ability to authenticate against Nextcloud using Lua scripts for password verification. This is a custom solution that bridges the gap between DMS and Nextcloud for authentication purposes. While this specific setup does not directly address the use of "App Passwords" in the context of Microsoft's modern authentication requirements, it demonstrates the flexibility of DMS in terms of authentication.

For your situation with Outlook requiring modern authentication and DMS's apparent lack of direct support for "App Passwords," you might consider a few approaches:

1. Investigate if Outlook allows for exceptions or alternative configurations that might be compatible with DMS's authentication mechanisms. Sometimes, email clients offer ways to configure accounts that do not support modern authentication directly.

2. Explore third-party solutions or plugins that could act as a bridge between Outlook's modern authentication requirements and DMS. This might involve additional infrastructure or software that can handle modern authentication on behalf of DMS.

3. Consider using a different email client that is known to work well with DMS. The context provided mentions the use of Mozilla Thunderbird with DMS, which suggests that Thunderbird could be a viable alternative for your needs. Thunderbird is a widely used email client that supports various authentication methods and might offer a more straightforward setup process with DMS.

It's also worth noting that the error message you're seeing (Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=*********) suggests that the authentication attempt is failing before it even starts, which could be due to Outlook's modern authentication mechanism not being compatible with DMS's expected authentication flow.

In summary, while DMS does not provide "App Passwords" directly, its flexible authentication system might allow for workarounds or alternative configurations. Exploring other email clients like Mozilla Thunderbird could also provide a more straightforward solution to your issue.

This comment was generated by Glime.

[polarathene]

Hey there, so the AI support bot is mostly right there.

I've not looked into Outlook with App Passwords myself, but I think these are more akin to OAuth2 which DMS does have some support for. You may be able to use that?

The mail client (Outlook / Thunderbird) would login with the SASL mechanisms XOAUTH2 or OAUTHBEARER which provides your account address and an auth token (this would be different each time). The auth token is from a login session with an identity broker that either you host or an external service has provided, the mail client needs to know how to authenticate as you and retrieve that token to send to DMS.

Within DMS the Dovecot service handles the authentication process and will be configured with the App Password that you had created for DMS to use. That allows Dovecot to ask the auth service (eg: Microsoft) about the auth token it received, and if it was valid that auth service sends back a response with the associated email address and Dovecot will check that matches the one from the mail client, if it does login is successful 😎

I think our current OAuth2 authentication docs are a bit limited, and while this should be possible to support I'm not 100% sure if we've made that easy yet. The feature was contributed by someone who wanted it for their own internal auth service, but there are a few other settings that may be important for other auth services.

TL;DR: DMS should be capable of this AFAIK, but it may not be as convenient yet.