OAuth2/OIDC + MFA support for Cloudron Mail clients

[Finn]

Hi,

would it be possible to add modern authentication support for Cloudron Mail?

Cloudron already supports 2FA for the user account, but external mail clients using IMAP/SMTP still authenticate with either the platform password or an app password. App passwords are useful, but they are still just single-factor secrets.

It would be great if Cloudron Mail could support OAuth2/OIDC for IMAP/SMTP, so mail clients can use an MFA-capable login flow similar to Microsoft 365 or Google Workspace.

Useful options could be:

OAuth2/OIDC login for IMAP/SMTP
app passwords as fallback for legacy clients
admin option to disable platform-password login for mail
per-client/device revocation

This would make Cloudron Mail much more attractive for business use cases where password-only mail access is a security concern.

Thanks!

[james]

Hello @finn and welcome to the Cloudron forum

Since the future release of Cloudron 10 already does touch the Mail system of Cloudron, this might be something we could add.

[Finn]

Hello @james, this is great to hear!

If it turns out that this cannot be added in time for the Cloudron 10 release, it would already be very helpful to at least have an option to disable the platform password for mail login, so users are required to use app passwords instead.