After upgrade to 2025-03 activesync not working

Ckruijntjens

Hi All,

I run mailcow behind a reverse proxy server. Now activesync is not working anymore. Should the nginx reverse proxy config file needs to be changed?

when i try to go to the activesync url it tells me access denied

https://192.168.2.8/Microsoft-Server-ActiveSync

[unknown] ps i am using this behind a nginx reverse proxy

ps i am using this behind a nginx reverse proxy

esackbauer

Are you using the default nginx config, which has separate config for activesync?
https://docs.mailcow.email/post_installation/reverse-proxy/r_p-nginx/

[unknown] when i try to go to the activesync url it tells me access denied

That is normal id you ask me, you need to be authenticated.

Ckruijntjens

esackbauer

Yes i am using that config indeed

D4niel

esackbauer That is normal id you ask me, you need to be authenticated.

I think it should be asking for credentials first. But yeah, only logs can show the real situation.

esackbauer

Well, without logs from SOGo or your reverse proxy its hard to tell where the problem comes from.

Ckruijntjens

I will redo the upgrade on the weekend. then i have some time to troubleshoot this.

I will keep you informed.

Ckruijntjens

I redid the upgrade.

Other accounts are working. the accounts that are not working have 2fa enabled. could it have to do with the 2fa?

Yup,

i found the problem. I do use app passwords to authenticate my mobile device. The only thing that is working is to disable the 2fa. The its working again. So when i disable 2fa in the below screen it works. If 2fa is enabled it fails to authenticate with the new mailcow update.

Yup,

sorry,

something duplicated my picture and post………

Ckruijntjens

Anyone having the same problems as me? Or am i the only one?

Baspar

Ckruijntjens I thought I faced the same problem, but after the OIDC migration of the account, you need to set “external app passowrd” using:

An App Password (Doc link) for Generic OIDC
The MailPassword flow if your using Keycloack (Doc link)

Can you check if that fixes your issue ?

Ckruijntjens

Baspar

Hi Thanks for your reply.I Wish it was the solution. I allredeay redid the app password. (So i deleted it and renewed it).

Also the provider is mailcow so it has to use the local passwords. I Dont use keycloak.

So for every user that i have with 2fa activesync is not working and for every user without it it is working…..

DocFraggle

What’s in the logs while logging in with 2fa activesync?

Ckruijntjens

strangest thing ever. when i recreate the ap password its working……

[unknown] but now i have to do this for all accounts

i see now. I have the app password the same as the account password. This is not accepted? before this was no problem.

If i understand it correctly……
I was using 2fa for sogo and for mailcow login. I can now remove the sogo 2fa, Because all 2fa is running true mailcow itself?

Am i correct?