How to set up app password in OIDC Directory

[maxdanno]

Good Evening,
could someone share how he configured app password in an oidc directory? I'm using Authentik below you will find my log set to trace:

2025-07-23T17:10:53Z DEBUG HTTP connection started (http.connection-start) listenerId = "http", localPort = 8080, remoteIp = 192.168.0.36, remotePort = 63261
2025-07-23T17:10:53Z DEBUG HTTP request URL (http.request-url) listenerId = "http", localPort = 8080, remoteIp = 192.168.0.36, remotePort = 63261, url = "/api/oauth"
2025-07-23T17:10:53Z TRACE Expression evaluation result (eval.result) listenerId = "http", localPort = 8080, remoteIp = 192.168.0.36, remotePort = 63261, id = "http.allowed-endpoint", result = "Integer(200)"
2025-07-23T17:10:53Z TRACE Write batch operation (store.data-write) elapsed = 0ms, total = 2
2025-07-23T17:10:53Z TRACE HTTP request body (http.request-body) listenerId = "http", localPort = 8080, remoteIp = 192.168.0.36, remotePort = 63261, details = [["host", "mail.ad..cloud:8080"], ["connection", "keep-alive"], ["content-length", "92"], ["user-agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36"], ["content-type", "application/json"], ["authorization", "Basic bG9yZW56bzphZ3J1bWF0bzE="], ["accept", "/"], ["origin", "http://mail.ad..cloud:8080"], ["referer", "http://mail.ad..cloud:8080/login"], ["accept-encoding", "gzip, deflate"], ["accept-language", "it-IT,it;q=0.9,en-US;q=0.8,en;q=0.7"]], contents = "{"type":"code","client_id":"webadmin","redirect_uri":"stalwart://auth","nonce":"TrzPggwDu9"}", size = 92
2025-07-23T17:10:53Z TRACE Write batch operation (store.data-write) elapsed = 0ms, total = 1
2025-07-23T17:10:53Z TRACE HTTP response body (http.response-body) listenerId = "http", localPort = 8080, remoteIp = 192.168.0.36, remotePort = 63261, contents = "{"data":{"code":"CbVu9DRXhvrpsW6uOwYO14VWBvjxTkWiYL5kflKy","permissions":["webadmin-update","spam-filter-update","dkim-signature-get","dkim-signature-create","undelete","fts-reindex","purge-account","purge-in-memory-store","purge-data-store","purge-blob-store","blob-fetch","principal-delete","principal-update","principal-create","principal-get","principal-list","role-delete","role-update","role-create","role-get","role-list","mailing-list-delete","mailing-list-update","mailing-list-create","mailing-list-get","mailing-list-list","tenant-delete","tenant-update","tenant-create","tenant-get","tenant-list","domain-delete","domain-update","domain-create","domain-get","domain-list","group-create","group-delete","group-update","group-get","group-list","individual-create","individual-delete","individual-update","individual-get","individual-list","settings-reload","settings-delete","settings-update","settings-list","incoming-report-delete","incoming-report-get","incoming-report-list","outgoing-report-delete","outgoing-report-get","outgoing-report-list","message-queue-delete","message-queue-update","message-queue-get","message-queue-list","delete-system-folders","unlimited-uploads","unlimited-requests","impersonate","imap-list-rights","imap-my-rights","imap-acl-set","imap-acl-get","imap-authenticate","jmap-echo","jmap-blob-upload","jmap-blob-lookup","jmap-sieve-script-validate","jmap-search-snippet","jmap-quota-query","jmap-principal-query","jmap-sieve-script-query","jmap-email-submission-query","jmap-mailbox-query","jmap-email-query","jmap-quota-query-changes","jmap-principal-query-changes","jmap-sieve-script-query-changes","jmap-email-submission-query-changes","jmap-mailbox-query-changes","jmap-email-query-changes","jmap-email-parse","jmap-email-import","jmap-blob-copy","jmap-email-copy","jmap-quota-changes","jmap-email-submission-changes","jmap-identity-changes","jmap-thread-changes","jmap-mailbox-changes","jmap-email-changes","jmap-vacation-response-set","jmap-sieve-script-set","jmap-push-subscription-set","jmap-email-submission-set","jmap-identity-set","jmap-mailbox-set","jmap-email-set","jmap-blob-get","jmap-quota-get","jmap-principal-get","jmap-vacation-response-get","jmap-sieve-script-get","jmap-push-subscription-get","jmap-email-submission-get","jmap-identity-get","jmap-thread-get","jmap-mailbox-get","jmap-email-get","manage-passwords","manage-encryption","email-receive","email-send","authenticate-oauth","authenticate","metrics-live","metrics-list","tracing-live","tracing-get","tracing-list","restart","spam-filter-train","logs-view","dav-file-mk-col","dav-file-get","dav-file-prop-patch","dav-file-prop-find","dav-principal-search-prop-set","dav-principal-search","dav-principal-match","dav-principal-list","dav-principal-acl","dav-expand-property","dav-sync-collection","spam-filter-classify","troubleshoot","ai-model-interact","oauth-client-override","oauth-client-registration","oauth-client-delete","oauth-client-update","oauth-client-create","oauth-client-get","oauth-client-list","api-key-delete","api-key-update","api-key-create","api-key-get","api-key-list","sieve-have-space","sieve-check-script","sieve-rename-script","sieve-delete-script","sieve-put-script","sieve-get-script","sieve-set-active","sieve-list-scripts","sieve-authenticate","pop3-dele","pop3-retr","pop3-stat","pop3-uidl","pop3-list","pop3-authenticate","imap-thread","imap-subscribe","imap-store","imap-status","imap-examine","imap-select","imap-sort","imap-search","imap-rename","imap-namespace","imap-lsub","imap-list","imap-idle","imap-fetch","imap-expunge","imap-enable","imap-delete","imap-create","imap-move","imap-copy","imap-id","imap-capability","imap-append","calendar-scheduling-receive","calendar-scheduling-send","calendar-alarms","dav-cal-free-busy-query","dav-cal-multi-get","dav-cal-query","dav-cal-acl","dav-cal-lock","dav-cal-move","dav-cal-copy","dav-cal-put","dav-cal-delete","dav-cal-mk-col","dav-cal-get","dav-cal-prop-patch","dav-cal-prop-find","dav-card-multi-get","dav-card-query","dav-card-acl","dav-card-lock","dav-card-move","dav-card-copy","dav-card-put","dav-card-delete","dav-card-mk-col","dav-card-get","dav-card-prop-patch","dav-card-prop-find","dav-file-acl","dav-file-lock","dav-file-move","dav-file-copy","dav-file-put","dav-file-delete"],"version":"0.13.0","isEnterprise":false}}", code = 200, size = 4336
2025-07-23T17:10:53Z DEBUG HTTP request URL (http.request-url) listenerId = "http", localPort = 8080, remoteIp = 192.168.0.36, remotePort = 63261, url = "/auth/token"
2025-07-23T17:10:53Z TRACE Expression evaluation result (eval.result) listenerId = "http", localPort = 8080, remoteIp = 192.168.0.36, remotePort = 63261, id = "http.allowed-endpoint", result = "Integer(200)"
2025-07-23T17:10:53Z TRACE Write batch operation (store.data-write) elapsed = 0ms, total = 2
2025-07-23T17:10:53Z TRACE HTTP request body (http.request-body) listenerId = "http", localPort = 8080, remoteIp = 192.168.0.36, remotePort = 63261, details = [["host", "mail.ad..cloud:8080"], ["connection", "keep-alive"], ["content-length", "129"], ["user-agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36"], ["content-type", "text/plain;charset=UTF-8"], ["accept", "/"], ["origin", "http://mail.ad..cloud:8080"], ["referer", "http://mail.ad..cloud:8080/login"], ["accept-encoding", "gzip, deflate"], ["accept-language", "it-IT,it;q=0.9,en-US;q=0.8,en;q=0.7"]], contents = "grant_type=authorization_code&client_id=webadmin&code=CbVu9DRXhvrpsW6uOwYO14VWBvjxTkWiYL5kflKy&redirect_uri=stalwart%3A%2F%2Fauth", size = 129
2025-07-23T17:10:53Z TRACE Expression evaluation result (eval.result) listenerId = "http", localPort = 8080, remoteIp = 192.168.0.36, remotePort = 63261, id = "http.url", result = "String(Owned("http://mail.ad.**.cloud:8080"))"
2025-07-23T17:10:53Z TRACE Write batch operation (store.data-write) elapsed = 0ms, total = 1
2025-07-23T17:10:53Z TRACE HTTP response body (http.response-body) listenerId = "http", localPort = 8080, remoteIp = 192.168.0.36, remotePort = 63261, contents = "{"access_token":"OTR6GecCgk+LyBX6g2n6yUyVpZrgprTd+myOqew2wUfKfbvk9xau6mPbzGM4/P//CACdqM+AA63Ez4ADd2ViYWRtaW4=","token_type":"bearer","expires_in":3600,"refresh_token":"J6U+QlfFGJM3ymiVJbBU8WDQTD+ftV3sGPyjSQGoIarSU2oaOIGahXV/9hzzXGDpCAGdqM+AA53C7YEDd2ViYWRtaW4=","id_token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImRlZmF1bHQifQ.eyJpc3MiOiJodHRwOi8vbWFpbC5hZC5pZm9yLmNsb3VkOjgwODAiLCJzdWIiOiI4IiwiYXVkIjoid2ViYWRtaW4iLCJleHAiOjE3NTMyOTE1NTMsIm5iZiI6MTc1MzI5MDY1MywiaWF0IjoxNzUzMjkwNjUzLCJub25jZSI6IlRyelBnZ3dEdTkiLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJsb3JlbnpvIiwiZW1haWwiOiJsb3JlbnpvQGlmb3IuY2xvdWQifQ.BXacC4slXRUpqvAuq-kpMpDfbV3sdiaT6iqSdXD8iZY"}", code = 200, size = 645
2025-07-23T17:10:53Z DEBUG HTTP request URL (http.request-url) listenerId = "http", localPort = 8080, remoteIp = 192.168.0.36, remotePort = 63261, url = "/api/principal?page=1&limit=10&types=individual&"
2025-07-23T17:10:53Z TRACE Expression evaluation result (eval.result) listenerId = "http", localPort = 8080, remoteIp = 192.168.0.36, remotePort = 63261, id = "http.allowed-endpoint", result = "Integer(200)"
2025-07-23T17:10:53Z TRACE Write batch operation (store.data-write) elapsed = 0ms, total = 2
2025-07-23T17:10:53Z DEBUG HTTP connection started (http.connection-start) listenerId = "http", localPort = 8080, remoteIp = 192.168.0.36, remotePort = 63262
2025-07-23T17:10:53Z DEBUG HTTP request URL (http.request-url) listenerId = "http", localPort = 8080, remoteIp = 192.168.0.36, remotePort = 63262, url = "/android-chrome-512x512-ffbecec3ff69a6ca.png"
2025-07-23T17:10:53Z TRACE Expression evaluation result (eval.result) listenerId = "http", localPort = 8080, remoteIp = 192.168.0.36, remotePort = 63262, id = "http.allowed-endpoint", result = "Integer(200)"
2025-07-23T17:10:53Z TRACE HTTP response body (http.response-body) listenerId = "http", localPort = 8080, remoteIp = 192.168.0.36, remotePort = 63262, contents = "[binary data]", code = 200, size = 104372
2025-07-23T17:10:53Z DEBUG HTTP request URL (http.request-url) listenerId = "http", localPort = 8080, remoteIp = 192.168.0.36, remotePort = 63262, url = "/android-chrome-192x192-6aba841e8fc78b83.png"
2025-07-23T17:10:53Z TRACE Expression evaluation result (eval.result) listenerId = "http", localPort = 8080, remoteIp = 192.168.0.36, remotePort = 63262, id = "http.allowed-endpoint", result = "Integer(200)"
2025-07-23T17:10:53Z TRACE HTTP response body (http.response-body) listenerId = "http", localPort = 8080, remoteIp = 192.168.0.36, remotePort = 63262, contents = "[binary data]", code = 200, size = 21505
2025-07-23T17:10:53Z DEBUG HTTP request URL (http.request-url) listenerId = "http", localPort = 8080, remoteIp = 192.168.0.36, remotePort = 63262, url = "/favicon-16x16-9b86a4caa1876c9e.png"
2025-07-23T17:10:53Z TRACE Expression evaluation result (eval.result) listenerId = "http", localPort = 8080, remoteIp = 192.168.0.36, remotePort = 63262, id = "http.allowed-endpoint", result = "Integer(200)"
2025-07-23T17:10:53Z TRACE HTTP response body (http.response-body) listenerId = "http", localPort = 8080, remoteIp = 192.168.0.36, remotePort = 63262, contents = "[binary data]", code = 200, size = 812
2025-07-23T17:10:53Z DEBUG HTTP request URL (http.request-url) listenerId = "http", localPort = 8080, remoteIp = 192.168.0.36, remotePort = 63262, url = "/favicon-32x32-33abe4bf0e53934c.png"
2025-07-23T17:10:53Z TRACE Expression evaluation result (eval.result) listenerId = "http", localPort = 8080, remoteIp = 192.168.0.36, remotePort = 63262, id = "http.allowed-endpoint", result = "Integer(200)"
2025-07-23T17:10:53Z TRACE HTTP response body (http.response-body) listenerId = "http", localPort = 8080, remoteIp = 192.168.0.36, remotePort = 63262, contents = "[binary data]", code = 200, size = 1784
2025-07-23T17:10:53Z TRACE HTTP response body (http.response-body) listenerId = "http", localPort = 8080, remoteIp = 192.168.0.36, remotePort = 63261, contents = "{"type":"about:blank","status":401,"title":"Unauthorized","detail":"You have to authenticate first."}", code = 401, size = 101
2025-07-23T17:10:53Z DEBUG HTTP request URL (http.request-url) listenerId = "http", localPort = 8080, remoteIp = 192.168.0.36, remotePort = 63261, url = "/android-chrome-512x512-ffbecec3ff69a6ca.png"
2025-07-23T17:10:53Z TRACE Expression evaluation result (eval.result) listenerId = "http", localPort = 8080, remoteIp = 192.168.0.36, remotePort = 63261, id = "http.allowed-endpoint", result = "Integer(200)"
2025-07-23T17:10:53Z TRACE HTTP response body (http.response-body) listenerId = "http", localPort = 8080, remoteIp = 192.168.0.36, remotePort = 63261, contents = "[binary data]", code = 200, size = 104372
2025-07-23T17:10:53Z DEBUG HTTP request URL (http.request-url) listenerId = "http", localPort = 8080, remoteIp = 192.168.0.36, remotePort = 63261, url = "/android-chrome-192x192-6aba841e8fc78b83.png"
2025-07-23T17:10:53Z TRACE Expression evaluation result (eval.result) listenerId = "http", localPort = 8080, remoteIp = 192.168.0.36, remotePort = 63261, id = "http.allowed-endpoint", result = "Integer(200)"
2025-07-23T17:10:53Z TRACE HTTP response body (http.response-body) listenerId = "http", localPort = 8080, remoteIp = 192.168.0.36, remotePort = 63261, contents = "[binary data]", code = 200, size = 21505
2025-07-23T17:10:53Z DEBUG HTTP request URL (http.request-url) listenerId = "http", localPort = 8080, remoteIp = 192.168.0.36, remotePort = 63261, url = "/favicon-16x16-9b86a4caa1876c9e.png"
2025-07-23T17:10:53Z TRACE Expression evaluation result (eval.result) listenerId = "http", localPort = 8080, remoteIp = 192.168.0.36, remotePort = 63261, id = "http.allowed-endpoint", result = "Integer(200)"
2025-07-23T17:10:53Z TRACE HTTP response body (http.response-body) listenerId = "http", localPort = 8080, remoteIp = 192.168.0.36, remotePort = 63261, contents = "[binary data]", code = 200, size = 812
2025-07-23T17:10:53Z DEBUG HTTP request URL (http.request-url) listenerId = "http", localPort = 8080, remoteIp = 192.168.0.36, remotePort = 63261, url = "/favicon-32x32-33abe4bf0e53934c.png"
2025-07-23T17:10:53Z TRACE Expression evaluation result (eval.result) listenerId = "http", localPort = 8080, remoteIp = 192.168.0.36, remotePort = 63261, id = "http.allowed-endpoint", result = "Integer(200)"
2025-07-23T17:10:53Z TRACE HTTP response body (http.response-body) listenerId = "http", localPort = 8080, remoteIp = 192.168.0.36, remotePort = 63261, contents = "[binary data]", code = 200, size = 1784
2025-07-23T17:10:54Z DEBUG HTTP connection ended (http.connection-end) listenerId = "http", localPort = 8080, remoteIp = 192.168.0.36, remotePort = 63262, elapsed = 813ms
2025-07-23T17:10:54Z DEBUG HTTP connection ended (http.connection-end) listenerId = "http", localPort = 8080, remoteIp = 192.168.0.36, remotePort = 63261, elapsed = 854ms

Somewhere I readed that at the moment the web ui doesnt (or didnt) support sso but in another discussion was stated that "version 0.12.5 is going to include a pre-deployment endpoint you can use."
Could someone share his confing and be of assistance?
Thank you in advance

[mdecimus]

This has been implemented and will be included in version 0.13.2.

[maxdanno]

I can confirm that now i can login in the web ui.
But I don't understand how to add app password in the external directory. The documentation says "If the server is set up to use an external directory, such as LDAP or SQL, administrators need to manually add the App Password secret as one of the account secrets", does "Accont secret" mean the password?
Can someone share a configuration example for oidc or other external directory?
I tried creating a new Attribute "app_pass"" in Authentink and adding : "directory.authentik.fields.secret = "app_pass""

[mdecimus]

When using OIDC you need to create the App Passwords in Stalwart. This can be done using the webadmin.