One Time Password

[helmutkaufmann]

Hi,

Is there an option to use One Time Passwords with Roundcube without having to install an own authentication server (as it seems to be necessary with the OpenOTP plugin for Roundcube)? Should I have missed a posting, I'd appreciate being pointed to that posting.

Thanks a lot,
Helmut

[SKaero]

RoundCube needs the imap account password to login into the mail server so a one time password system should be setup as part of the mail server authentication not RoundCube. Alternatively if you have no access to the mail server you could make a RoundCube plugin do it but it would be less secure.

[helmutkaufmann]

Hi,

That I understand... The solution to that would be - as I think you suggested - would be a login plugin that handles the authentication with OTP and then reads the IMAP credentials from, e.g. a database. I cannot pass these on along with the OTP credential as anyone could just use it straight with the IMAPping server.

So, noone having done something like this for RC?

Thanks a lot,
Helmutz

[SKaero]

To my knowledge there isn't currently a plugin that does that, but I don't think it would be to hard to code.

[helmutkaufmann]

Thanks, folks!

If anyone is reading this some time in the future and implements it, please, do post the plugin. I think it would be of real value add - especially for people on the road, who read email on somehow untrusted devices...

Best,
Helmut

[corbosman]

How do you read credentials from a database? Any serious authentication systems does not have access to plaintext credentials. Only one way hashed passwords.

I have implemented an OTP system on roundcube for our company. It's far from trivial.  I had the system that does the OTP verification create a Single Signon token for the webmail session, then return the SSO token to roundcube, and in a plugin I replace the password with the SSO. Our authentication backend behind imap can verify both passwords and SSOs. 

An easier (but to me less safe) way to do it is to use dovecot's master password option. Wouldnt be allowed in our company, but YMMV.

Cor