<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<br>
<br>
<div class="moz-cite-prefix">On 7/1/22 1:02 PM, Jochen Bern wrote:<br>
</div>
<blockquote type="cite"
cite="mid:7649be62-6290-7be4-7d2e-93de66701300@binect.de">On
27.06.22 00:52, Steve Dondley wrote:
<br>
<blockquote type="cite">I have a small client whose insurance
company insists they have MFA for their email to be covered
under some kind of data protection policy. <br>
</blockquote>
*Totally* theorizing here, but as far as I'm aware, the SMTP
(AUTH), POP, and IMAP protocol definitions do not provide elbow
room to make *two* rounds of authentication.<br>
</blockquote>
<br>
What Jochen said.<br>
<br>
The protocols were designed long before SAML and OIDC. SAML/OIDC
give you more control over authn/z<br>
and allow easily adding in MFA or other different types of auth. To
do this right, you'd need to extend<br>
the protocol to allow OIDC or SAML.<br>
<br>
As some have noted, you can shoehorn it in. But I would not
recommend doing that. Adding security<br>
as a bolt-on ad hoc usually has holes.<br>
<br>
But if you really wanted to do this, I'd suggest something like:<br>
<br>
<ul>
<li>Extend dovecot to use an OIDC access token instead of a
username/password.</li>
<li>Set up an IDP with your connection, defining credentials as
well as MFA info</li>
<li>Set up the IDP with an API - this is the API for generating
the access token used by dovecot</li>
<li>Extend Thunderbird or your mail app to use the IDP to get the
access token, then use that to connect to Dovecot.</li>
</ul>
<p>So this sounds kind of cool to me. If you want a little help
setting it up with Auth0, ping me off list.</p>
<p><br>
</p>
<p>John<br>
</p>
<br>
</body>
</html>