1957591 - account hub: Exchange discovery needs password

Status: RESOLVED FIXED

(Thunderbird :: Account Manager, defect, P2)

Description

[Magnus Melin [:mkmelin] (away until Aug 10)]

Account hub doesn't ask for password up front.
While password is not needed for OAuth2 so would be nice to be able to leave out, this is not possible.

The configuration discovery process needs the password to be able to figure out the settings in the first place.
This holds true for both some cases of discovering the Thunderbird config.xml files, and notably for the exchange autodiscovery. See https://searchfox.org/comm-central/rev/0fdefe139b81b443c7d2276dedbf12a5b5d430a3/mail/components/accountcreation/modules/ExchangeAutoDiscover.sys.mjs#163
We also saw in the past there are non-microsoft services that implemented the same for autodiscovery.

Comment 1

[Alessandro Castellani [:aleca]]

Do we have a list of known services that require a password for autodiscovery?
If I remember correctly the primary reason for sending the password was for the need of checking if an Exchange server came with IMAP enabled.

Is there a way to update our AutoDiscover code in order to get a "password needed" request back?

We should only show the password field if actually needed since the majority of the most widely used providers all go through OAuth, so it's an extra step needed only for specific cases and it would be nice to be able to make our code smarter and adapt to those needs.

Comment 2

[Magnus Melin [:mkmelin] (away until Aug 10)]

(In reply to Alessandro Castellani [:aleca] from comment #1)

Do we have a list of known services that require a password for autodiscovery?

No list for that. It's every on-premise exchange server that don't happen to be discovered through other means (ispdb, dns, guessing).

If I remember correctly the primary reason for sending the password was for the need of checking if an Exchange server came with IMAP enabled.

Nope, this is to get discovery response at all.

Is there a way to update our AutoDiscover code in order to get a "password needed" request back?

Not really as the creds need to be sent upfront. The only thing we could do is to do a password-less pass first, and if no results, get back and ask for password, and re-try. It should probably work, though not 100% safe as some servers may block after you do the first probing.

I didn't look if account hub does that, but especially for exchange there are also middle-steps where you may need to add you AD username instead of password. Or hosting solutions where you need to confirm where to send creds etc... All in all, it's complicated to change the flow without breaking certain scenarios.

Comment 3

[Vineet Deo]

After deliberation, we found the best way to implement this is the following:

• Move the password step of the email setup after ONLY autodiscovery failure
• Show a notification in the password step on why we’re showing the password step
• After inputting the password and submitting the form, we should then run guess config

Comment 4

[Martin Giger [:freaktechnik]]

Attachment: Bug 1957591 - Show password prompt when exchange autodiscovery fails. r=vineet!,mkmelin,babolivier

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/b767855b4923
Show password prompt when exchange autodiscovery fails. r=vineet!,mkmelin,babolivier