Repository navigation
Provisioned accounts never auto-refresh the INBOX for passwordless (OIDC/SAML) sessions, even with a master password configured #13807
Description
Activity
I did not reproduce, but looks like a valid finding. When you manually refresh the page new messages appear?
- Yes, or when I switch folder and come back…On 06/10/2026 23:05, Daniel wrote: *kesselb* left a comment (nextcloud/mail#13807) <#13807 (comment)> I did not reproduce, but looks like a valid finding. When you manually refresh the page new messages appear? — Reply to this email directly, view it on GitHub <#13807?email_source=notifications&email_token=ATUWP3UVBVUM7N3QYHIMJ2D5SVNCDA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTMMBSGU2DGMZSGE4KM4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KYZTPN52GK4S7MNWGSY3L#issuecomment-6025433218>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ATUWP3USLMQCCJ67GF4KHYL5SVNCDAVCNFSNUABEKJSXA33TNF2G64TZHM3DMNZWGIZDEMB3JFZXG5LFHM2TOMJSGM3DGNZRG6QXMAQ>. Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS <https://github.com/notifications/mobile/ios/ATUWP3VFKHJMPLUQX2IB3FL5SVNCDA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTMMBSGU2DGMZSGE4KM4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KUZTPN52GK4S7NFXXG> and Android <https://github.com/notifications/mobile/android/ATUWP3SXC7SBMPGRAHXHA5L5SVNCDA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTMMBSGU2DGMZSGE4KM4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2K4ZTPN52GK4S7MFXGI4TPNFSA>. Download it today! You are receiving this because you authored the thread.Message ID: ***@***.***>
Looks correct:
mail/src/components/Navigation.vue
Lines 242 to 244 in 777f000
Looks wrong:
mail/src/store/mainStore/actions.js
Lines 904 to 907 in 777f000
Reacted by mrtxmrtxgood first issue
I'm unsure if it's really a good first issue. It seems weird to have
masterPasswordEnabledin our main store, while that flag actually belongs to the provisioning for a given account. For one account it can be true, while for another it's false.However the setter
setMasterPasswordEnabledMutationis nowhere called. Probably the code in navigation only looks correct, but also does not work as expected.Looks like #13812 could work for our specific setup, a per account setting as recommended by kesselb would be cleaner.
The underlying security problem remains the same, that there has to be either one master password for all accounts in nextcloud mail or a password for each mail account.
A cleaner solution could be a XOAUTH2 Token login for provisioned accounts for IMAP and SMTP, that changes before every (background) connection. Similar to #13311 or #13317That would also require a Token login for Sieve to apply filters and out-of-office rules, which is mentioned nowhere.
Ideally Mail would get it's own refresh token instead of recycling nextcloud's session token, which is messy and against authentik's guidelines. Authentik introduced token exchange recently that allows swapping tokens cleanly on demand.
But this looks like more effort than just applying something like #13812
Steps to reproduce
Expected behavior
The new message appears in the open INBOX within the regular polling interval, as it does for a user who logged in with a password.
Actual behavior
The message does not appear, even after ten minutes and with
app.mail.background-sync-intervalset to 300. It appears immediately when switching to another folder and back, or on a page reload. The unread counter may update earlier than the list.
Cause, as far as we can read it (v5.12.3)
PageController::index()sets the initial statepassword-is-unavailableto true when the login credentials hold no password, which is always the case for user_oidc sessionssrc/store/mainStore/actions.js(syncInboxes(), and the unified and priority inbox branches ofsyncEnvelopes()) then excludes every account with aprovisioningId("Skip superfluous requests if using passwordless authentication. They will fail anyway."). This dates from#7616(2022), before the master password existed (#9008, 2023)Mailbox.vue's 60-secondloadMailbox()skips the INBOX by design, sincesyncInboxes()is meant to cover it (see#13205, withdrawn after review)Navigation.vuechecksmainStore.masterPasswordEnabledfor a related case, but nothing sets that value, so the frontend has no way to tell#9653(provisioning with a master password for accounts without one); the frontend skip was not revisitedPossible fix: pass to the page whether the user's provisioning config uses a master password, and skip only when it does not.
Related:
(the QA checklist expects such accounts to show as disabled).
Mail app version
5.12.3
Nextcloud version
34.0.3
Mailserver or service
Dovecot 2.3.21 (master user login), Postfix
Operating system
Linux server; Firefox on Linux
PHP engine version
Other
Nextcloud memory caching
No response
Web server
Apache (supported)
Database
PostgreSQL
Additional info
Login through user_oidc 8.11.0. The account is provisioned and works: sending, Sieve and folder views all pass; only the automatic INBOX refresh is missing.