Multiple Mailboxes

CodeShell · 2025-06-29T15:26:27+00:00

The day that mailcow officially released SSO Support I started using it with Authentik. But I immediately noticed that there is no apparent way to have one I...

esackbauer

CodeShell this can be really annoying as you have to login and logout each time you want to switch Mailboxes.

Why dont you simply delegate and share the folders of the additional mailboxes to the Authentik user?

CodeShell

esackbauer sorry could you further elaborate?

esackbauer Yes you would be correct this also works,
I assume you mean using multiple „identities“ (emails) in one mailbox.
But this isn’t the level of separation I was looking for.
I mean separating things like Daily User and Sysadmin (+ Postmaster).

esackbauer

CodeShell I assume you mean using multiple „identities“ (emails) in one mailbox.

No I mean delegating/sharing multipe mailboxes with one user. Thats why mailcow is not just a mail server, but a groupware.

michaelmandint

esackbauer sorry for necro, do you know how to delegate multiple mailbox to one authentik user within authentik?

CodeShell

Really? How does this work?

Ok this looks quite handy. Yes this definitely works too, but for those who use Roundcube this won‘t work (?),
I guess that‘ll teach me. But I still like to have multiple Mailboxes for one User (this is my preferred way to do it),
it just isolates everything a bit more.

Side note: how can I rename this Thread, the title is really not specific

esackbauer

CodeShell but for those who use Roundcube this won‘t work (?),

It will also work for Roundcube. You will see the additional folders from other mailboxes in the IMAP tree. So any client actually can see those folders.

CodeShell

esackbauer
Thank you this is a really useful tip, I will probably use delegation with my app.
I personally still like to visually seperate admin from personal. (Not everything in one mailbox)

- Admin
- Personal
  |__________ Social Media
  |__________ Programms
  [ ... ]

esackbauer

It is visually separated, it is not everything in one mailbox. All other mailboxes will be under “Shared”, and then separated by mailbox name.

esackbauer

What exactly do you want to achieve? What do you mean with “within Authentik”?

michaelmandint

esackbauer ideally, i want all user account creation, email delegation and aliases management to be delegated to authentik so i never have to use mailcow to do anything but setup domains

esackbauer

michaelmandint
That will not work, because Authentik (like any other SSO) just manages identities and access, it is not meant to configure application specific settings like delegation of a mailbox or alias address creation.

michaelmandint

esackbauer i assumed it would be possible through mailcow api calls using extra attributes from authentik.

esackbauer

michaelmandint
Theoretically yes, if you can run such scripts from within authentik. But that needs a lot of coding. What if the delegated mailbox does not exist? If the alias is already taken? Thats not just an API call, but also proper error handling.

michaelmandint

esackbauer good points, but that’s why i was hopping to find someone who already had done the job, i found some interesting doc about managing shared aliases (https://anduin.aiursoft.com/post/2025/8/13/bridging-identity-and-email-management-synchronizing-authentik-groups-with-mailcow-aliases) and been trying to find a simpler way to do it. as in authentik you can fill in field such as user, name etc which are imported into mailcow when the account is created, i was thinking “aliases” or shared mailbox could be one extra field there.

CodeShell

Hey there @michaelmandint, I think I might have a part of your request already covered in my use case…
I have one authentik account which is able to login to multiple different mailboxes

The mailbox creation works automatically since mailboxes are automatically created by mailcow when a “new” user registers, the trick with my project is basically that it edits the email claim (I think, long time ago) then mailcow sees “Aha this one doesn’t exist and it is a valid user” so it creates a new mailbox for that new email, then my program stores in a db who owns what email (first one to log in), the next time someone uses SSO it then first goes to my program which then prompts to select what mailbox you would like to log in to and thats it. Additional mailboxes are then handled via the mailauth program, so you basically have two sides: The mailauth and mailcow side, both are connected to authentik, when you go directly to mailauth you are able to manage mailboxes and when you login via the mailcow side you are only allowed to select owned mailboxes, I am also happy to extend it if you need some additional stuff!

Here a screenshot

michaelmandint

CodeShell Hey, Thanks, i first looked at it, i wasn’t so confident in adding something into the auth loop. especially most of my users will end up using thunderbird, but i’ll explore the solution, at least for the initial user enrollment.

CodeShell

michaelmandint
You are right to be suspicious, I have tested the project but I am not an expert.
That said maybe I‘ll look over the repository and maybe let AI scan to find some bugs I missed.
If you do decide to use it let me know!

Also, the initial user enrollment is handled automatically that isn‘t part of mailauth, mailcow does it by itself!

michaelmandint

CodeShell it’s more about my own capabilities to mess with the chain than your code 🙂

CodeShell

Setting it up isn‘t too hard, but the ‚Getting Started‘-Section could use some redo…

CodeShell

Hey there, quick update…
Your comment reminded me that I do have my mailauth instance exposed to the internet, and so I decided to check if I didn‘t leave any bugs in the wild.
So thankfully I found all of them, fixed them and also improved the general performance, ease-of-use, made it easier to set up, updated everything and improved the readme! (v1.1.0)