Skip to content

feat(provisioning): add support for Dovecot master user auth#12306

Open
tnxfi wants to merge 2 commits intonextcloud:mainfrom
tnxfi:add/masteruser
Open

feat(provisioning): add support for Dovecot master user auth#12306
tnxfi wants to merge 2 commits intonextcloud:mainfrom
tnxfi:add/masteruser

Conversation

@tnxfi
Copy link

@tnxfi tnxfi commented Jan 24, 2026

Nextcloud mail app has an option called "Master password". This name is not to be mixed with Dovecot Master password system.
The functionalitys is slightly misnamed. The correct name should be "Static password for all users".

Dovecot server for pop3, imap and sieve allows various ways of authenticating users. In this case "Static password" means that Dovecot is configured so that every account has the same static password and every account can log in with the same password. That means users like user_ann@example.com and user_dean@example.com will have the same password for their accounts.
Dovecot does allow to limit the usage of static password to specific CIDR. This can be useful in some cases (webmail system and SSO).
But this system is extremely problematic if the users need to be able to use passwords to log in from other system like Thunderbird client software.

Dovecot has a more advanced system called Master passwords, which allows us to configure one or more master users that have their own passwords. For example we could have user masteruser that has password MASTERPASS. When logging into imap, pop3 or sieve, master users can use username in format "user_ann@example.com*masteruser" to log in as any specific user they are allowed to represent. Default separator in the format is * (star sign), but it is configurable in Dovecot. In all other ways the login process is exactly the same as in standard imap, pop3 or sieve login. Only the username has both useraccount and masteraccount specified with the separator.
This configuration is a lot more flexible than static user passwords. Master passwords can also be limited to being accepted from specific CIDRs.
When using this system, the users still can have their own default passwords and the master password system doesn't affect their normal usage in any way. The system also allows granular permissions for master users.

This patch adds the ability to set master user and optionally master user separator character in Nextcloud Mail app. Patch still uses master password field for the password.
If Master user is not set, old style static password is used and only defined user is used as login. If Master user is set, login will use Dovecot style user in logins.

This patch assumes that user can use Dovecot master authentication for all services. Note that Dovecot includes SMTP Submission ability to help with master password login using SMTP.

@welcome
Copy link

welcome bot commented Jan 24, 2026

Thanks for opening your first pull request in this repository! ✌️

Timo Nieminen added 2 commits January 24, 2026 13:48
…n with new columns and UI updates

Signed-off-by: Timo Nieminen <timo.nieminen@tnnet.fi>
…client factories and tests

Signed-off-by: Timo Nieminen <timo.nieminen@tnnet.fi>
Copy link
Member

@ChristophWurst ChristophWurst left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good so far. Thank you very much! We will check it out very soon

@github-actions
Copy link

github-actions bot commented Feb 8, 2026

Hello there,
Thank you so much for taking the time and effort to create a pull request to our Nextcloud project.

We hope that the review process is going smooth and is helpful for you. We want to ensure your pull request is reviewed to your satisfaction. If you have a moment, our community management team would very much appreciate your feedback on your experience with this PR review process.

Your feedback is valuable to us as we continuously strive to improve our community developer experience. Please take a moment to complete our short survey by clicking on the following link: https://cloud.nextcloud.com/apps/forms/s/i9Ago4EQRZ7TWxjfmeEpPkf6

Thank you for contributing to Nextcloud and we hope to hear from you soon!

(If you believe you should not receive this message, you can add yourself to the blocklist.)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants