Client Configuration - Method 1.3: IMAP and SMTP with App Password

smart

Hi,
today i needed to remove the profile from my iPhone and later i wanted to re-install it again.
But whatever i try, it always asks for IMAP Password.

i tried:
Open https://${MAILCOW_HOSTNAME}/mobileconfig.php?only_email&app_password to download a customized configuration profile - installed it –> ask for IMAP Password

removed the profile

Open https://${MAILCOW_HOSTNAME}/mobileconfig.php?only_email to download a customized configuration profile - installed it –> ask for IMAP Password

removed the profile again

Then i logged into SOGO and deleted OLD APP Password and created a new one

but…
Open https://${MAILCOW_HOSTNAME}/mobileconfig.php?only_email&app_password to download a customized configuration profile - installed it –> ask for IMAP Password

then i manually put in the APP Password into the IOS Account - and the the password was accepted.

Shouldn’t it be WITHOUT to enter the APP PW ?

ETNyx

Nonsense, you are creating huge security issue by this. How many user will not delete this file if landed in their Download folder? 99%!. Event than good application does not know your password, it saves one way hash to verify your password, so most-likely MC does not know your password to save it into this file,…

smart

ETNyx

from the docs:

Method 1.3: IMAP and SMTP with App Password¶

This method configures IMAP and SMTP to access an email account. A new app password is generated and added to the profile so that no password needs to be entered when setting up your device. Please do not share the file as it grants full access to your mailbox.

ETNyx

Also at the end you are specifically told that Enter the password for your email account when asked.

smart

Ok you are right,

BUT:
for me the manual is a little bit confusing.

1.st it say: A new app password is generated and added to the profile so that no password needs to be entered when setting up your device.

2nd it say: Since the profile is not digitally signed, you must confirm the respective notification during installation. Enter the password for your email account when asked.

What PW ? the generated APP PW
or the standard User IMAP PW
or either APP / STANDARD PW?

i am really trying to understand it…

ETNyx

Foo,… please do not share the file as it grants full access to your mailbox. this is not good,… Anyway yes you are right it’s poorly written. As many things, this seems not to do what we expect.

Sorry I can’t test it for you, I do not have any Apple device,.. In past I used first method, that expect mailbox password. From how it’s written I would expect standard mailbox password they are asking.