I have configured an LDAP and a OIDC directory. My idea was to pull in users via LDAP and just let them authenticate via OIDC.
The idea is, that users are managed centrally outside of StalWart (e.g. FreeIPA, an LDAP Server, etc.) and the Mail setup needs to know them before their first login to receive Mail for them.
So ideally LDAP is continually synced for the user information (also changed mailaliases, etc.) but only login via OIDC is allowed for a more secure login method.
Multiple directory support would be great, though it shouldn’t be too hard to achieve. Get an oauthbearer token? use OIDC. Otherwise use LDAP or local store.
I was not thinking like that, I think for authentication one main directory per domain should be used, however multiple directories covering the same (!) users is helpful for user syncing.
For my team would be useful to use internal directory + allow OIDC login for fast SSO login into their account, instead of entering email address + password.
With Bulwark auto-redirect to OIDC could be configured, so users automatically are logged in via SSO, no need to enter anything.
And internal directory for accounts that are not in OIDC, or in case there is a problem with OIDC currently