1755068 - "PrimaryPassword": true in policies.json does nothing in Thunderbird - explore to make this work for account passwords

Status: RESOLVED FIXED

(Thunderbird :: Upstream Synchronization, defect, P3)

Description

[Thomas D. (:thomas8)]

Reported by Luca O.
[tb-enterprise] PrimaryPassword in policies.json does nothing (10.02.2022, 15:50 CET) [1]

STR

Enterprise user employs policies.json with

• "OfferToSaveLogins": true,
• "PrimaryPassword": true,

and reports:

Actual Result

In the about:policies tab I can see that Thunderbird (91.6.0) has picked those policies, however the "PrimaryPassword" doesn't seem to work: Thunderbird just stores and retrieves the (account) passwords with no master password required.

Expected Result

In Firefox, that same policy requires to set a master password the first time you save a login, and asks for the master password when needed.

Additional info:

User has previously been using StartupMaster add-on
https://addons.thunderbird.net/ca/thunderbird/addon/startupmaster/?src=search
but sadly it doesn't work with current versions of thunderbird.

[1] https://thunderbird.topicbox.com/groups/enterprise/T86fda84036f258f5-M170e71a13d9b53e732bf1849

Comment 1

[Thomas D. (:thomas8)]

Maybe the passwords which Firefox handles from web pages are somewhat different in type from Thunderbird account passwords?

Comment 2

[Luca Olivetti]

I've no idea, I just need a way to enforce the creation and use of a master password.
I saw this policy and I thought it worked the same both with firefox and thunderbird.

Comment 3

[[e-mail]]

My impression is that the password manager in Firefox has been reworked considerably and none of this has arrived in Thunderbird.

Comment 4

[Luca Olivetti]

Since I see no progress on this issue, I worked around it by using modutil (taken from the msys2 repositories) to create a master password when I create the user's profile.

Comment 5

[s.osdoba]

same problem with Windows GPO

https://github.com/thundernest/policy-templates/tree/master/templates/central

enabled primary password but this does nothing

please fix this, we need to enable a mandatory password otherwise all saved logins are easy to copy if malware is on the system

Comment 6

[s.osdoba]

forgot to mention that we are using Thunderbird 115.2.3

Comment 7

[Mike Kaply [:mkaply]]

I'm putting this here for a Thunderbird developer. If they can give me some direction, I might be able to take a look.

When you set a master password and start Thunderbird, it immediately asks for your master password.

I need to know why/where that happens, so that I can insert a "set your master password" dialog if the policy is set.

Comment 8

[Magnus Melin [:mkmelin]]

We set a security.prompt_for_master_password_on_startup so it's not 100% Thunderbird.
See https://searchfox.org/mozilla-central/rev/d265ec4f5fdcb5ad0c06636c5ac010ef4ff7eb89/toolkit/xre/nsXREDirProvider.cpp#790-797

Comment 9

[Mike Kaply [:mkaply]]

We set a security.prompt_for_master_password_on_startup so it's not 100% Thunderbird.

Bummer. I don't know of an easy way to force creation of a password at that point since it's in CPP code (everything else loads changemp.xhtml directly)

Comment 10

[s.osdoba]

Is there anything to expect here?

If Thunderbird wants to be an Outlook alternative then GPOs should work and there should be a great interest in resolving issues with it.
At least anyone from TB team should reply here that this topic is in progress.

If there will be no progress at this topic, i have 3 options in my corporate environment:

-close my eyes and do nothing
-remove Thunderbird from our devices (~370 installations)
-remove the possibility to save password within Thunderbird

Great options :(

Comment 11

[Mike Kaply [:mkaply]]

I'm working on this, but it's more complicated than I thought.

Comment 12

[s.osdoba]

(In reply to Mike Kaply [:mkaply] from comment #11)

I'm working on this, but it's more complicated than I thought.

OK Mike, if its in your hands I can sleep much better. So I will keep calm and wait. Thanks for all your work and efforts. Like always :)

Comment 13

[s.osdoba]

P3 and S4 really? In my opinion it should be at least P2 & S2. Whats the plan with this topic? Thats a major issue.
Thunderbird wants to go business or at least be an Outlook alternative? Then get your GPOs working or remove the non working parts.

Comment 14

[Mike Kaply [:mkaply]]

Unfortunately this turned into a very complicated problem because of the way Thunderbird does master passwords.

Comment 15

[s.osdoba]

Hi Mike,

i am a sysadmin so i have a lot of understanding for problems but problems wont disappear if you put them to P3 and S4. this looks (for me) like dont bother us with this.

Comment 16

[Mike Kaply [:mkaply]]

It's not a don't bother, it's a prioritization. It's still on our radar.

Comment 17

[s.osdoba]

ok then i still have to wait

Comment 18

[s.osdoba]

have it been fixed in 128?

Comment 19

[Wayne Mery (:wsmwk)]

(In reply to Magnus Melin [:mkmelin] from comment #8)

We set a security.prompt_for_master_password_on_startup so it's not 100% Thunderbird.
See https://searchfox.org/mozilla-central/rev/d265ec4f5fdcb5ad0c06636c5ac010ef4ff7eb89/toolkit/xre/nsXREDirProvider.cpp#790-797

Did we back that out, since the Mac issue that caused us to set it has been fixed? (iirc)

have it been fixed in 128?

Expand the tracking and attachment sections of the bug report and you can see the current status and the fact that this bug has no patches.

Comment 20

[s.osdoba]

have it been fixed in 128?
Expand the tracking and attachment sections of the bug report and you can see the current status and the fact that this bug has no patches.

I saw that there was no update on this topic but we tried this feature in 128 and it seems to work as intended thats why i was asking

Comment 21

[Wayne Mery (:wsmwk)]

Thanks for that added information. Hopefully Magnus can confirm my thinking.

Comment 22

[Wayne Mery (:wsmwk)]

paulj, ratzka, is this also working for you?

Comment 23

[Magnus Melin [:mkmelin]]

It wasn't backed out - still there - https://searchfox.org/mozilla-central/rev/d265ec4f5fdcb5ad0c06636c5ac010ef4ff7eb89/toolkit/xre/nsXREDirProvider.cpp#790-797. The other issue was fix in bug 1882214. (No idea if that could affect this one, and if so for which OS's)

Comment 24

[[e-mail]]

The bug is not fixed for me.

Just to clarify what this feature is about and how the same policy works in Firefox:
This is about enforcing the use of a Primary Password when storing passwords.
So if this policy is set in Firefox, then on the first attempt to save a password in Firefox there is a popup "Primary Password: Your organization requires that you have Primary Password..." that asks to set a primary password. If no primary password is set, no passwords are saved.

Comment 25

[s.osdoba]

(In reply to [e-mail] from comment #24)

The bug is not fixed for me.

have you tried Thunderbird 128.x? Its not working on 115.x but we did some test with 128.x and there it seems to work. Same GPOs in place. No changes just different version.

Comment 26

[[e-mail]]

I did try on Thunderbird 128.1.0 and it did not work for me. (NB: our environment is Windows, and we are using GPOs/registry keys, not policies.json)

Comment 27

[s.osdoba]

(In reply to [e-mail] from comment #26)

I did try on Thunderbird 128.1.0 and it did not work for me. (NB: our environment is Windows, and we are using GPOs/registry keys, not policies.json)

i havent done the tests myself but i will check it myself in next days and reply

Comment 28

[s.osdoba]

(In reply to s.osdoba from comment #27)

(In reply to [e-mail] from comment #26)

I did try on Thunderbird 128.1.0 and it did not work for me. (NB: our environment is Windows, and we are using GPOs/registry keys, not policies.json)

i havent done the tests myself but i will check it myself in next days and reply

absolutely right nothing changed, you will be asked for user authentication but this is crap and can be easily bypassed

there is still no force to set a primary password

Comment 29

[YASHIRO Taketsugu]

For those who may be concerned;
My team at work found it out that by putting the following two files a Primary Password works as expected, which can be enforced once it has been set.
As far as I have been using for a week or two, I had no problem with it.
This way could be a workaround.

(1) C:\Program Files\Mozilla Thunderbird\defaults\pref\autoconfig.js

pref("general.config.filename", "autoconfig.cfg");
pref("general.config.vendor", "autoconfig");
pref("general.config.obscure_value", 0);

// You also need below if you use scripts for reading globalChrome.css
pref("general.config.sandbox_enabled", false);

(2) C:\Program Files\Mozilla Thunderbird\autoconfig.cfg

// You must leave this first line as comment.

{ // Disallow to remove the Primary Password, previously called master password
  const { classes: Cc, interfaces: Ci } = Components;
  const observer = {
    observe(aSubject, aTopic, aData) {
      switch (aTopic) {
        case 'mail-startup-done':
          Services.obs.removeObserver(observer, 'mail-startup-done');
          Cc['@mozilla.org/enterprisepolicies;1']
            .getService(Ci.nsIEnterprisePolicies)
            .wrappedJSObject
            .disallowFeature('removeMasterPassword');
          return;
      }
    },
    QueryInterface(aIID) {
      if (!aIID.equals(Ci.nsIObserver) &&
          !aIID.equals(Ci.nsISupports)) {
        throw Components.results.NS_ERROR_NO_INTERFACE;
      }
      return this;
    }
  };
  Services.obs.addObserver(observer, 'mail-startup-done');
} 

Comment 30

[s.osdoba]

(In reply to YASHIRO Taketsugu from comment #29)

For those who may be concerned;
My team at work found it out that by putting the following two files a Primary Password works as expected, which can be enforced once it has been set.
As far as I have been using for a week or two, I had no problem with it.
This way could be a workaround.

great, i will give it a try and report

Comment 31

[Magnus Melin [:mkmelin]]

(In reply to YASHIRO Taketsugu from comment #29)
Great investigation! It looks like we're missing out on the "sessionstore-windows-restored" logic.

Comment 32

[s.osdoba]

(In reply to Magnus Melin [:mkmelin] from comment #31)

(In reply to YASHIRO Taketsugu from comment #29)
Great investigation! It looks like we're missing out on the "sessionstore-windows-restored" logic.

so is there any chance that you implement it in one of the next thunderbird version and we dont need to do the fix manually?

Comment 33

[Magnus Melin [:mkmelin]]

I'm planning on that yes.

Comment 34

[Magnus Melin [:mkmelin]]

Attachment: Bug 1755068 - Hook up "sessionstore-windows-restored" logic (make EnterpricePolicies apply properly). r=darktrojan

For testing, add e.g. a obj-x86_64-pc-linux-gnu/dist/bin/distribution/policies.json containing

{
 "policies": {
   "DisableAppUpdate": true,
   "PrimaryPassword": true
 }
}

Comment 35

[s.osdoba]

Hi Magnus,

whats the status of this bug?

Comment 36

[Magnus Melin [:mkmelin]]

The patch is now working.

Comment 37

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/bb171955b44a
Hook up "sessionstore-windows-restored" logic (make EnterpricePolicies apply properly). r=darktrojan

Comment 38

[Magnus Melin [:mkmelin]]

Comment on attachment 9487254 [details]
Bug 1755068 - Hook up "sessionstore-windows-restored" logic (make EnterpricePolicies apply properly). r=darktrojan

Uplift Approval Request

• Please state case for uplift consideration and ensure bug severity is set: Enterprise policy fix
• User impact if declined: Enterprise policy in question doesn't work
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Daily?: Yes
• Has the fix been verified in Beta?: Yes
• Needs manual test from QA?: Yes
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Fairly small change overall
• Does the fix cause any migrations to be skipped?: No
• String changes made/needed: none

Comment 39

[Corey Bryant]

Comment on attachment 9487254 [details]
Bug 1755068 - Hook up "sessionstore-windows-restored" logic (make EnterpricePolicies apply properly). r=darktrojan

[Triage Comment]
Approved for beta

Comment 40

[Evandro Baginski [:ebaginski]]

Thunderbird 153.0b4:
https://hg.mozilla.org/releases/comm-beta/rev/917873b4db6d