Mail: accept ns8-idp tokens for IMAP and SMTP #8264

Webmail applications (Roundcube, WebTop) that sign in users with single sign-on do not know the user's password, so they cannot open the mailbox with it. The mail server must accept the user's sign-in token instead.

Proposed solution

• When the Mail application is bound to a user domain served by an OIDC provider, it registers its own client with register-client, without redirect URIs: the client is used only to verify tokens (token introspection).
• Dovecot accepts the XOAUTH2 and OAUTHBEARER authentication methods, and checks that tokens are valid, issued by the realm of the user domain, and list the Mail client in their audience.
• Postfix SMTP authentication (through Dovecot SASL) accepts the same tokens, so webmail clients can send messages.
• Password authentication keeps working for every other mail client (desktop and mobile apps, Imapsync).
• The configuration follows the provider changes (service-oidc-changed event) and is removed when no provider is available.

Alternative solutions

• Master user access for webmail applications: rejected, it grants access to every mailbox.

Additional context

Implement it after the Dovecot 2.4 upgrade, because the OAuth2 settings of Dovecot 2.4 are different from 2.3.

Not to be confused with the draft "Transition to OAuth for Imapsync and Mail relay rules", which is about Mail signing in to external mail providers with OAuth.

See also

• Parent: Single sign-on for applications with ns8-idp #8258
• Mail: upgrade to Dovecot 2.4: Mail: upgrade to Dovecot 2.4 #8267
• Dovecot OAuth2 authentication: https://doc.dovecot.org/latest/core/config/auth/databases/oauth2.html
• https://github.com/NethServer/ns8-mail