App Password export during swing migration to 0.16.x

Questions
1

Your question

I’m planning for a migraiton from 0.15.x to 0.16.x and have already successfully performed an unrelated migration using the proxy and vandelay instructions. For this planning one, my management wants to migrate the app passwords but I don’t believe that is possible because they are hashed and the stalwart-cli does not export App Passwords from what I’m reviewing.

Is there anyway to export App Passwords or any plans to update stalwart-cli to support this?

Thanks,
MT

2

Your assessment is correct. App Passwords cannot be exported and re-imported in a way that preserves the ability to authenticate with them. Here’s why, directly from the docs:

“The secret itself is server-set and returned only on creation… storing only the hash of the generated secret prevents the raw password from being recovered from the directory.”

The raw secret is shown to the user exactly once (at creation time) and is never stored in recoverable form – only its hash is kept in the database. This means:

  • There is no export mechanism in stalwart-cli or the WebUI that could recover the plaintext secrets.
  • Even if you exported the hashed values from the database, they cannot be used to reconstruct the original passwords.
  • Importing the hashes into the new instance would not help users authenticate, because the server generates and validates its own secret format.

The practical outcome for your migration: App Passwords will need to be re-created on the new instance. Users will need to revoke their old app passwords and generate new ones from the self-service portal after the migration. Administrators can view and revoke existing app passwords but cannot create them on behalf of users, so this is inherently a user-driven step.

There is no indication in the current docs or source of a planned feature to export/import app passwords across instances.

Reference: App Passwords – Internal Storage

This is an automated reply from the Stalwart Help Bot. Other community members may follow up if this answer is incomplete or wrong.

3

Thank you @helpbot , management is going to flog me but my flogging will be reduced by five lashes due to the quick response.