dovecot - Jun 2021 - oauth2

Hi!
> I would like to try the oauth2 mechanism to autenticate my users.
>
> [...]
> 
> My Thunderbird client [...]
Not a Thunderbird/Dovecot expert here, so only talking about my
experience. We have a setup here with Dovecot supporting OAUTHBEARER &
XOAUTH2 to allow our web-based interface (Open-Xchange) to use our SSO
(also provided by Keycloak) and that works fine. However, we also got
questions from users about Thunderbird so I had a quick look into it.

From what I understand, from digging into https://bugzilla.mozilla.org/
and Thunderbird source code, Thunderbird is using a static list of
Oauth2 providers, for which it stores the
clientId/clientSecret/authorizationEndpoint/tokenEndpoint statically in
its source code.

As a result, I think Thunderbird can't support Oauth2 for a standard
Dovecot installation without patches... (But I would love to be proven
wrong and be able to provide Oauth support to our users!)

Cheers,
Vincent

PS: Thunderbird hardcoded list:
https://github.com/mozilla/releases-comm-central/blob/master/mailnews/base/src/OAuth2Providers.jsm

-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL:
<https://dovecot.org/pipermail/dovecot/attachments/20210624/6f801fda/attachment.sig>

Hello Vincent,

this explains many things... :-(

Do you know if the same applies also to other clients like Apple Mail 
and Outlook 20xx?

Thanks,
Andrea

PS: Can you share? your /etc/dovecot/dovecot-oauth2.conf.ext




Il 24/06/21 11:24, Vincent Brillault ha scritto:
> Hi!
>
>> I would like to try the oauth2 mechanism to autenticate my users.
>>
>> [...]
>>
>> My Thunderbird client [...]
> Not a Thunderbird/Dovecot expert here, so only talking about my
> experience. We have a setup here with Dovecot supporting OAUTHBEARER &
> XOAUTH2 to allow our web-based interface (Open-Xchange) to use our SSO
> (also provided by Keycloak) and that works fine. However, we also got
> questions from users about Thunderbird so I had a quick look into it.
>
>  From what I understand, from digging into https://bugzilla.mozilla.org/
> and Thunderbird source code, Thunderbird is using a static list of
> Oauth2 providers, for which it stores the
> clientId/clientSecret/authorizationEndpoint/tokenEndpoint statically in
> its source code.
>
> As a result, I think Thunderbird can't support Oauth2 for a standard
> Dovecot installation without patches... (But I would love to be proven
> wrong and be able to provide Oauth support to our users!)
>
> Cheers,
> Vincent
>
> PS: Thunderbird hardcoded list:
>
https://github.com/mozilla/releases-comm-central/blob/master/mailnews/base/src/OAuth2Providers.jsm
>
-- 
__________________________
How can you respect a machine controlled by a mouse?
__________________________

TIM San Marino S.p.A.
Andrea Gabellini
Engineering R&D
TIM San Marino S.p.A. - https://www.telecomitalia.sm
Via Ventotto Luglio, 212 - Piano -2
47893 - Borgo Maggiore - Republic of San Marino
Tel: (+378) 0549 886237
Fax: (+378) 0549 886188



--
Informativa Privacy

Questa email ha per destinatari dei contatti presenti negli archivi di TIM San
Marino S.p.A.. Tutte le informazioni vengono trattate e tutelate nel rispetto
della normativa vigente sulla protezione dei dati personali (Reg. EU 2016/679).
Per richiedere informazioni e/o variazioni e/o la cancellazione dei vostri dati
presenti nei nostri archivi potete inviare una email a privacy at
telecomitalia.sm.

Avviso di Riservatezza

Il contenuto di questa e-mail e degli eventuali allegati e' strettamente
confidenziale e destinato alla/e persona/e a cui e' indirizzato. Se avete
ricevuto per errore questa e-mail, vi preghiamo di segnalarcelo immediatamente e
di cancellarla dal vostro computer. E' fatto divieto di copiare e divulgare
il contenuto di questa e-mail. Ogni utilizzo abusivo delle informazioni qui
contenute da parte di persone terze o comunque non indicate nella presente
e-mail potra' essere perseguito ai sensi di legge.