🪲: Cannot add app password when using Kanidm as ldap provider (which is read-only)

[OrvilleQ]

What happened?

I cannot add app password though either by myself or by the admin account.

The request got a 200 in return, but no app password showed in self portal or account edit page.

I'm using kanidm as ldap provider which is read-only, stalwart is 0.13.3.

How can we reproduce the problem?

I can reproduce the problem by doing the following steps:

Set up a stalwart with kanidm as ldap provider (read-only), then login in and try to add a app password.

Version

v0.13.x

What database are you using?

PostgreSQL

What blob storage are you using?

S3-compatible

Where is your directory located?

LDAP

What operating system are you using?

FreeBSD

Relevant log output

2025-09-24T18:09:25Z DEBUG HTTP connection started (http.connection-start) listenerId = "http", localPort = 80, remoteIp = 2607:8700:5500:aa0f::2, remotePort = 40150
2025-09-24T18:09:25Z DEBUG HTTP request URL (http.request-url) listenerId = "http", localPort = 80, remoteIp = 2607:8700:5500:aa0f::2, remotePort = 40150, url = "/api/account/auth"
2025-09-24T18:09:25Z TRACE Expression evaluation result (eval.result) listenerId = "http", localPort = 80, remoteIp = 2607:8700:5500:aa0f::2, remotePort = 40150, id = "http.allowed-endpoint", result = "Integer(200)"
2025-09-24T18:09:25Z TRACE HTTP request body (http.request-body) listenerId = "http", localPort = 80, remoteIp = 2607:8700:5500:aa0f::2, remotePort = 40150, details = [["host", "mail.[MASKED]"], ["user-agent", "Mozilla/5.0 (X11; Linux x86_64; rv:143.0) Gecko/20100101 Firefox/143.0"], ["accept", "*/*"], ["accept-language", "en-US,en;q=0.5"], ["accept-encoding", "gzip, deflate, br, zstd"], ["referer", "https://mail.[MASKED]/account/app-passwords/edit"], ["authorization", "Bearer 7dKe3X9oHP5g91UZaqjNCYTGwaj3jHRZhH2rvLx8E2sHLt0zrplmks3kOQ06JuN/AQC04JuDA8T8m4MDd2ViYWRtaW4="], ["content-type", "application/json"], ["content-length", "205"], ["origin", "https://mail.[MASKED]"], ["sec-fetch-dest", "empty"], ["sec-fetch-mode", "cors"], ["sec-fetch-site", "same-origin"], ["priority", "u=0"], ["te", "trailers"], ["x-forwarded-for", "2607:8700:5500:aa0f::2"], ["connection", "close"]], contents = "[{"type":"addAppPassword","name":"dGVzdCQyMDI1LTA5LTI0VDE4OjA5OjIzLjM3OCswMDowMA==","password":"$6$4WN2E4Aovag5UnJa$mZDoSuNE6yWekE5bMqCqWsaL2vqIaRHy9.EFrlxYV74WjVJFBT0pwoHf7g6CEJoEacs96y/SIafzi3uoWJKBe/"}]", size = 205
2025-09-24T18:09:25Z TRACE Data store iteration operation (store.data-iterate) elapsed = 0ms
2025-09-24T18:09:25Z TRACE Data store iteration operation (store.data-iterate) elapsed = 0ms
2025-09-24T18:09:25Z TRACE Write batch operation (store.data-write) elapsed = 1ms, total = 2
2025-09-24T18:09:25Z TRACE HTTP response body (http.response-body) listenerId = "http", localPort = 80, remoteIp = 2607:8700:5500:aa0f::2, remotePort = 40150, contents = "{"data":null}", code = 200, size = 13
2025-09-24T18:09:25Z DEBUG HTTP connection ended (http.connection-end) listenerId = "http", localPort = 80, remoteIp = 2607:8700:5500:aa0f::2, remotePort = 40150, elapsed = 5ms
2025-09-24T18:09:25Z DEBUG HTTP connection started (http.connection-start) listenerId = "http", localPort = 80, remoteIp = 2607:8700:5500:aa0f::2, remotePort = 40150
2025-09-24T18:09:25Z DEBUG HTTP request URL (http.request-url) listenerId = "http", localPort = 80, remoteIp = 2607:8700:5500:aa0f::2, remotePort = 40150, url = "/api/account/auth"
2025-09-24T18:09:25Z TRACE Expression evaluation result (eval.result) listenerId = "http", localPort = 80, remoteIp = 2607:8700:5500:aa0f::2, remotePort = 40150, id = "http.allowed-endpoint", result = "Integer(200)"
2025-09-24T18:09:25Z TRACE Data store iteration operation (store.data-iterate) elapsed = 0ms
2025-09-24T18:09:25Z TRACE LDAP query executed (store.ldap-query) details = "(&(|(class=account)(class=group))(|(uid=[MASKED])(spn=[MASKED])(name=[MASKED])))", result = [["entryuuid", "7e71a65c-8626-44fd-aed9-de65e47bf2d2"], ["memberof", "spn=idm_all_persons@idm.[MASKED],dc=idm,dc=[MASKED],dc=[MASKED], spn=idm_all_accounts@idm.[MASKED],dc=idm,dc=[MASKED],dc=[MASKED], spn=idm_people_self_name_write@idm.[MASKED],dc=idm,dc=[MASKED],dc=[MASKED]"], ["emailprimary", "[MASKED]@[MASKED]"], ["objectclass", "account, memberof, object, person, posixaccount"], ["displayname", "Orville Q. Song"], ["emailalternative", "[MASKED]@[MASKED]"], ["uid", "[MASKED]"], "spn=[MASKED]@idm.[MASKED],dc=idm,dc=[MASKED],dc=[MASKED]"]
2025-09-24T18:09:25Z TRACE Data store iteration operation (store.data-iterate) elapsed = 0ms
2025-09-24T18:09:25Z TRACE Data store iteration operation (store.data-iterate) elapsed = 0ms
2025-09-24T18:09:25Z TRACE Write batch operation (store.data-write) elapsed = 1ms, total = 2
2025-09-24T18:09:25Z TRACE Data store iteration operation (store.data-iterate) elapsed = 0ms
2025-09-24T18:09:25Z TRACE HTTP request body (http.request-body) listenerId = "http", localPort = 80, remoteIp = 2607:8700:5500:aa0f::2, remotePort = 40150, details = [["host", "mail.[MASKED]"], ["user-agent", "Mozilla/5.0 (X11; Linux x86_64; rv:143.0) Gecko/20100101 Firefox/143.0"], ["accept", "*/*"], ["accept-language", "en-US,en;q=0.5"], ["accept-encoding", "gzip, deflate, br, zstd"], ["referer", "https://mail.[MASKED]/account/app-passwords/edit"], ["authorization", "Bearer 7dKe3X9oHP5g91UZaqjNCYTGwaj3jHRZhH2rvLx8E2sHLt0zrplmks3kOQ06JuN/AQC04JuDA8T8m4MDd2ViYWRtaW4="], ["sec-fetch-dest", "empty"], ["sec-fetch-mode", "cors"], ["sec-fetch-site", "same-origin"], ["priority", "u=4"], ["te", "trailers"], ["x-forwarded-for", "2607:8700:5500:aa0f::2"], ["connection", "close"]], contents = "", size = 0
2025-09-24T18:09:25Z TRACE LDAP query executed (store.ldap-query) details = "(&(|(class=account)(class=group))(|(uid=[MASKED])(spn=[MASKED])(name=[MASKED])))", result = [["uid", "[MASKED]"], ["objectclass", "account, memberof, object, person, posixaccount"], ["entryuuid", "7e71a65c-8626-44fd-aed9-de65e47bf2d2"], ["emailprimary", "[MASKED]@[MASKED]"], ["emailalternative", "[MASKED]@[MASKED]"], ["displayname", "Orville Q. Song"], ["memberof", "spn=idm_all_persons@idm.[MASKED],dc=idm,dc=[MASKED],dc=[MASKED], spn=idm_all_accounts@idm.[MASKED],dc=idm,dc=[MASKED],dc=[MASKED], spn=idm_people_self_name_write@idm.[MASKED],dc=idm,dc=[MASKED],dc=[MASKED]"], "spn=[MASKED]@idm.[MASKED],dc=idm,dc=[MASKED],dc=[MASKED]"]
2025-09-24T18:09:25Z TRACE HTTP response body (http.response-body) listenerId = "http", localPort = 80, remoteIp = 2607:8700:5500:aa0f::2, remotePort = 40150, contents = "{"data":{"otpEnabled":false,"appPasswords":["6687327325014312696"]}}", code = 200, size = 68
2025-09-24T18:09:25Z DEBUG HTTP connection ended (http.connection-end) listenerId = "http", localPort = 80, remoteIp = 2607:8700:5500:aa0f::2, remotePort = 40150, elapsed = 142ms

Code of Conduct

• I agree to follow this project's Code of Conduct

[mdecimus]

Stalwart has read-only access to external directories. This means that all changes (including adding app passwords) need to be done in your LDAP server, not using the UI.

[OrvilleQ]

Thanks for your reply.

Is there or will there be any guide on how to implement this?

In addition, I seem to have noticed that OIDC can directly set app passwords. How is this achieved, and can a similar logic be applied to LDAP?

[mdecimus]

Is there or will there be any guide on how to implement this?

Your LDAP server needs to return the App passwords in the secrets attribute. The issue is that you need to define these manually.

How is this achieved, and can a similar logic be applied to LDAP?

Not currently but we might extend the LDAP driver to allow overriding the provided secrets.