User still able to get new mails after password change

ouik

Hello,
As in the title - recently I’ve changed password for some random user via admin UI. The user uses Thunderbird and also Mail app on his iPhone.
After changing his password manually, Thunderbird was restarted and starts asking for new password for IMAP.
But Mail app on his iPhone still can fetch new mails, even after the password was changed 15 minutes before.
Is this an issue with something like sessions? The user doesn’t use App Passwords
Is there a way to view/list/close user sessions for specific mailbox?

Thanks!

ouik

Oh, I’ve found out that I can issue a command “doveadm who -1” to get a list of active sessions and “doveadm kick <name>” to close particular session.
Is this session handling stuff implemented somewhere in mailcow UI?

flololan

Hi,
Have you confirmed that it is a session issue? I would’ve thought that sessions linked to that password get killed automatically on password change.

Keep in mind that a password change won’t affect the App-passwords. If the user connected his iPhone via the Connection-profile with App-password, which you can download on the mailcow-profile page, mailcow will have created an App-password just for that connection. So it would make sense that the connection is still possible from his iPhone.

ouik

flololan Hello flololan, current users only use pure IMAP configuration (login, password, server config etc) and no App-Passwords (as stated in 1st post, they don’t use App-Passwords).
After doing doveadm kick <name> everything started to work as it should - user got the password form to provide new password.
I just wanted to confirm if this is desired action or some kind of bug (not killing sessions on password change).

flololan

ouik Sorry I must’ve jumped that part with the app-passwords. In this case I would also have thought that a session end / kick would happen automatically. This might be a legitimate issue for GitHub.