One, two, three or four? The number of OIDC client registrations an MCP server for OAuth-enabled IMAP/SMTP needs depends on the architecture. Five scenarios compared: token passthrough, single-client broker, split broker, IdP as authorization server with token exchange, and hosted providers.
Category: Dovecot
Building an OAuth2-secured MCP mail server against a real Dovecot/Postfix mailbox surfaced four separate Keycloak client registrations, a Default-vs-Optional scope trap, and a genuinely counter-intuitive Audience-mapper gotcha behind a mysterious active: false.
While trying to get OAUTH2 working with thunderbird, I tried and documented some things that may still be of interest (even if they didn’t give me the solution for my problem). If you’re only interested in the solution, you’d better look here. Otherwise keep reading 😉 Enforce auth type (thunderbird) So I tried to enforce […]
Currently I’m using Nextcloud with snappymail as mail client. While this works nicely, I do have a “comfort problem” since I switched my Nextcloud authentication to SAML/SSO: I can no longer use the Nextcloud credentials to log into my mail account (as Nextcloud does not know about my password when using SSO). There’s two things […]