OAuth2/OIDC + MFA support for Cloudron Mail clients

[Finn]

Hi,

would it be possible to add modern authentication support for Cloudron Mail?

Cloudron already supports 2FA for the user account, but external mail clients using IMAP/SMTP still authenticate with either the platform password or an app password. App passwords are useful, but they are still just single-factor secrets.

It would be great if Cloudron Mail could support OAuth2/OIDC for IMAP/SMTP, so mail clients can use an MFA-capable login flow similar to Microsoft 365 or Google Workspace.

Useful options could be:

OAuth2/OIDC login for IMAP/SMTP
app passwords as fallback for legacy clients
admin option to disable platform-password login for mail
per-client/device revocation

This would make Cloudron Mail much more attractive for business use cases where password-only mail access is a security concern.

Thanks!

[james]

Hello @finn and welcome to the Cloudron forum

Since the future release of Cloudron 10 already does touch the Mail system of Cloudron, this might be something we could add.

[Finn]

Hello @james, this is great to hear!

If it turns out that this cannot be added in time for the Cloudron 10 release, it would already be very helpful to at least have an option to disable the platform password for mail login, so users are required to use app passwords instead.

[charlesnw]

I second this request . My board of directors is concerned about the lack of 2fa on mail. I am glad that all of the other parts and apps of cloudron are fully protected (alas we can’t set password policies , but the 2fa requirement gets us an exception).

What are the blockers here ? Does roundcube support OIdC ? Would work need to be done in the cloudron core authentication / groups / permission layer ?

[fbartels]

I think the main holdup is that there are hardly any mail clients out there that can make use of oauth 2.0 with providers other than google/microsoft/... I think the best way for now is to only allow app password logins for imap/smtp connections.

[robi]

@fbartels so basically let your agents handle mail via API?

[fbartels]

@robi how did you land at "api"?

If you want an ai agent to handle your inbox then there are probably better apis than the imap protocol, yes. but that is a different topic to oidc and mfa.