rasos
commented
5 years ago We are facing a similar challenge: we plan to move from LDAP to SAML authentication for nextcloud to offer a true Single-Sign-On user experience.
When looking at the oc_mail_accounts table, I see inbound_passwordand outbound_password and I learned, that this table stores only any additionally account configured by the user in the settings of the Mail app. The default mail account uses the parameters from the config file and the same password given at login, which we don't have anymore available with SAML authentication. The Auto Mail Accounts App would create also a default account in the oc_mail_accountstable, but we still would not get the password.
A master user setup at the mail server is not an option to us, as our users can define their mail account name themselves, which would allow anybody to impersonate.
It seems that this is our only choice: Remove the default mail config option and write the mail parameters directly into the oc_mail_accountstable. Any password change in LDAP would need to be synced to inbound_passwordand outbound_password, though. This way we would be able to write the encrypted and salted password from LDAP, and not use a symmetric one, so we also gain security. Or even more secure: tweak Dovecot's account query so that it takes the mail account user_id from theoc_mail_accounts table and the password from LDAP.
Any concerns so far?
tjareson
oliv3r
ChristophWurst
kesselb
My users login using SAML, so nextcloud doesn't have access to their password from LDAP. It would be sweet if I there could also be a "imapPass" and "smtpPass" in the config file, I have a master user setup on my mail server which can impersonate users so the user's actual password isn't needed, just the master one.
Cheers!