Accessing email mailbox owned by a group

[bmann]

I've read the instructions on being able to login to a group-owned mailbox by using personal credentials of anyone in a group, but I can't get it to work.

On Mail App on MacOS, I made groupmailbox@domain.com where my user was a member of group.

My user boris@otherdomain.com was not able to login (Mail app just kept saying wrong password).

I also can't figure out how or if this works with Roundcube, or if I should use Snappy. With Roundcube, I don't think this is possible, because user/pass would be boris@otherdomain.com, but no way to indicate that I want access to groupmailbox.

I guess I'll give this a try with Snappy as well and see where I get to.

[bmann]

OK, so this seems to "just work" with Snappymail.

This was non obvious to me, but it seems to "just work":

I entered in my boris@domain password, and it gave me access. It's unclear how to make this work with other email clients, I'll need to experiment further. For now, I'm unblocked.

Actually, I'll experiment with Freescout as well, which was the one which I couldn't get working before.

[bmann]

OK, so this does work for Freescout as well.

I think, the issue when I tried this before, was that I hadn't setup a mailbox for my Cloudron user at all. So I only had my "external" email address to use. Somewhere in the documentation this needs to say, that "your" user also has to have a mailbox for this to work.

[girish]

@bmann A mailbox for cloudron user is not required. Just to double check - you have to use groupname@domain.com as the authentication username and the boris user's password as the authentication password. You don't have to add an account in Snappymail either. You can just put it straight into SnappyMail's login screen and it should work.

[bmann]

@girish for third party clients like Mail for MacOS, there are two fields:

Email: groupname@email
User: should this ALSO be groupname@email with Boris password, or should it be boris@otherdomain?

[girish]

@bmann said in Accessing email mailbox owned by a group:

User: should this ALSO be groupname@email with Boris password

that's correct. User should also be groupname@email with Boris' password

[andy_0]

Thanks for asking and solving this question. I was just wondering the same using SOGo.

[girish]

It's the same with SOGo. Use the mailbox name as username and any of the group's credentials as the password.

[avatar1024]

Unrelated to the original post, but today I have noticed that for mailboxes owned by groups, only typing the group name as username to login was working (instead of groupname@domain). Is that an intended behaviour?? I like it personally, but I wonder how it'd work for instance with multiple domains and the case where there are two mailboxes: mygroup@domain1 and mygroup@domain2?

I'm on Cloudron 8.1

[girish]

@avatar1024 Email apps always require the full email id. It's not possible to figure out the mailbox unambiguously just based on the groupname (or username). We used to use just username/groupname for login a very very long time ago when Cloudron just had support for a single domain. If you have a username called 'foobar', the user can be allocated any number of mailboxes. So, it's not possible to map username to a mailbox.

[avatar1024]

@girish Hi Girish, I know what you're explaining is the expected behaviour, I've been a long time Cloudron user. What I'm pointing out to you is that it DOES WORK to just enter the group name as the username for group owned mailboxes on my Cloudron (8.1)....which I thought was weird which is why I'm letting you know (and was asking, is this the expected behaviour for group mailboxes, and if so, how would it work in the case of multi domains).

[girish]

@avatar1024 do you happen to use SOGo ? It might even be the ancient SOGo ! Can check the Info section for the package version and name ?

[avatar1024]

It's with Roundcube, and it's up-to-date

[jdaviescoates]

@girish I can confirm this behaviour under the following conditions:

Mailbox e.g. anything@domain.coop
Email app install at e.g. whatever.domain.coop

It seems to only work if the domain matches.

It doesn't make any difference if the mailbox is group owned or not. I just tested an account only owned my me and the exact same thing happens.

Basically if the mailbox domain and the email app domain match then only the username of the mailbox is needed.

And as you'd probably expect, it doesn't make any difference if this is Roundcube or SnappyMail (presumably SoGo too).

[avatar1024]

What @jdaviescoates describes is that it seems email apps accept the prefix of an email address (the part before the @) instead of the full email address as the username

It is to not that using just this approach would make a lot of sense if a given of an email app was restricted to emails on a single domain (as @girish mentioned, what NEVER makes sense is to use the Cloudron username as a single user can have several email addresses, even within one domain).

So one question is: say if there are two domains on a Cloudron, domain1.coop and domain2.coop, with several mailboxes on both domains, then is it the expected / default behaviour that with an email app installed at: webmail.domain1.coop, one should be able to access any mailboxes on Cloudron (i.e. on both domain1.coop and domain2.coop), or should one be able to access mailboxes only on domain1.coop?

[jdaviescoates]

@avatar1024 said in Accessing email mailbox owned by a group:

is it the expected / default behaviour that with an email app installed at: webmail.domain1.coop, one should be able to access any mailboxes on Cloudron (i.e. on both domain1.coop and domain2.coop),

Yes, if you use the full email address to login.

At least that's how it's always worked.

[girish]

Ah, I see now. I misremembered that we removed the legacy behavior. But apparently, it is still there - https://git.cloudron.io/apps/roundcube-app/-/blob/master/config.inc.php?ref_type=heads#L8 . If you don't provide a domain and just use the username, it defaults to the email domain. I wouldn't rely on this behavior in the long run (though, we won't remove it at this point, unless it conflicts with some other feature)!

[avatar1024]

@girish I see, thanks.

Can I just ask a couple of clarifications:

1. When you say username, do you mean prefix of the email address (the part before the @ in the email address) or the Cloudron username?
2. when you say the email domain, do you mean the global email domain (MX domain), or the domain on which the email app installed?

I think the current behaviour actually makes sense and is quite convenient to login rather than having to enter the full email address every time. I think it would make most sense and be the least confusing if the username to login is the prefix of the email address, and that it default to the domain of the email app rather than the global email domain. I think that way would be a very neat approach, yet still giving the flexibility to login on any email app installed on the Cloudron using the full email address for niche use cases.

[girish]

@avatar1024 quite a long time ago, Cloudron used to create mailboxes named username@domain.com when you create a username. Later, the platform grew to support multiple domains (should we now create username@ in every domain?) and arbitrary mailboxes (who can have arbitrary users as owners).

With that in mind, yes, username means the prefix before @. The email domain is the app's installation domain.

Let's say a username has 3 mailboxes - admin@, support@ and username@ . Which mailbox is seen when logged in? You might say username@ but what if username@ is not in that list?

In the end, we are much limited by what the apps can do. Most apps cannot show multiple mailboxes with a single auth. They also do not support mappings from username to mailbox name. This is why we decided to keep it simple (for oureslves) and just make users login with mailbox name. Atleast, all email apps support this.

[avatar1024]

@girish said in Accessing email mailbox owned by a group:

Let's say a username has 3 mailboxes - admin@, support@ and username@ . Which mailbox is seen when logged in? You might say username@ but what if username@ is not in that list?

@girish I think we keep misunderstanding each other here. I know how it used to be back in the day and I also know that for ages now Cloudron has been using the full email address as username to log into emails exactly because of the confusion you've just pointed at with the above example. So I'm with you here.

What I'm pointing out is that if using the email prefix as username to login (and NOT the Cloudron username) then we get around the confusion in your example. So if a user is the owner of three mailboxes - admin@, support@ and username@, then to log in each other them the username would simply be "admin", "support" and "username" respectively, and the password is the user password. I'm not taking about showing multiple mailboxes at once or anything like that. With a single domain this works, there is no confusion and yet we don't need to write the full email address every time but only the prefix which is easy. And this is what seems to be happening in Roundcube right now.

Now this gets confusing with multiple domains becasue a single user can be the owner of say admin@domain1.coop and admin@domain2.coop. But for this "I humbly think" the default behaviour I described in my previous message intuitively solves this issue, that is:

• if a user enters only the prefix then the @domain defaults to the domain the webmail app is installed on. So say if Snappymail is installed at webmail.domain1.coop and I enter "admin" as a username to login, then it default to the mailbox admin@domain1.coop.
• if a user enters the full email address as the username to login then he/she/they can access that mailbox no matter what the domain of webmail app is.

Here is what I wrote in my previous message:

I think it would make most sense and be the least confusing if the username to login is the prefix of the email address, and that it default to the domain of the email app rather than the global email domain. I think that way would be a very neat approach, yet still giving the flexibility to login on any email app installed on the Cloudron using the full email address for niche use cases.