dovecot - Jul 2021 - Sv: 2FA/MFA with IMAP & postfix/submission

Hi,
> > Unfortunately the best way to do multifactor authentication today is
> > to use OAUTH2, which isn't currently supported for own
installations.
> > Or you can use client certs.
> >
> > If you want to use some kind of MFA with tokens, you end up having to
> > feed your token all the time. So the best option, for now, is device
> > passwords.
>
> speculating :=)
>
> weekforce policy server with 2fa, that just update allow_nets in dovecot
> user dict table, so all dovecot do is to check allow nets pr user from
> dict, i dont know if that is possible so imap / pop3 / lmtp and other
> service in dovecot dont need to mess with oauth2 or other complicated
> login system not supported everywhere
Yeah, I'm not sure we can use something that appears to be so experimental.

What about client certs? Wouldn't that solve the problem?

Does Outlook for Windows include any type of MFA? It appears
inextricably linked to Office 365.

What about something like what we used to do with pop-b4-smtp to at
least restrict by IP address?

On 2021-07-15 16:49, Alex wrote:
> What about something like what we used to do with pop-b4-smtp to at
> least restrict by IP address?
no, pop was not handle million of users share one single nat ip, 
weekforce cant handle that either, so allow_net cant do any better there

all i think is possible is to make 2fa updated with users login to 
weekforce, and thats it, then weekforce can do the allow_net with that 
login, there mail/mua still is just enforeced with allow_nets only

all should be pretty simple for all kind of mail programs not knowing 
how to use oauth2 or 2fa then

who will make the weekforce policy server for exact that ?, i am willing 
to test it, but not code it