I’m playing with stalwart to see if it can replace my current aging email stack (Zimbra).
As I’d like to be able to use my internal IDP, I’ve configured an OIDC directory.
It works for standard accounts (well, I still have tons of tests to do, but basic functionnality seems OK).
Now, I need a few services mailbox, which won’t be fetched by users, but applications (eg : my ticketing system). For those, I do not have a corresponding account on my IDP. I understand I need to use AppPassword, but I can’t find how to create it. I can’t login to the /account WebUI as the service account, because it has no account on the IDP, and an admin can’t create AppPassword for other users on their behalf.
What’s the best way to handle this ?
I understand that topics in this category are triaged by a bot first but a human reply will follow up. If I’d prefer a human-only reply, I’ll add the no-ai tag to my topic.
App passwords are what you want. They are checked before the external directory, so a service mailbox with an app password authenticates against the local account and never touches your IdP. A plain local password will not work: once a directory is configured for the domain, all Basic authentication is routed to it.
The awkward part is creating one, because an administrator cannot create app passwords on a user’s behalf; only the account itself can, from the self-service portal. The usual route is to sign in to /account as the service account using recovery-admin impersonation, service@yourdomain%<recovery-admin> with the recovery password, and create it there. Fair warning that this exact form is currently broken in the webui login (see your other topic), so for now you would need a client that sends Basic credentials directly.
If you are on Enterprise there is a cleaner option: assign the directory per domain and keep service mailboxes in a domain with no external directory, where ordinary passwords work normally. And if your IdP will let you create a service identity, that is simplest of all, since it keeps everything on one authentication path.