Account provisioning¶

Account provisioning lets an admin configure a template of IMAP/SMTP settings that the Mail app uses to automatically set up a mail account in Nextcloud for every user with a matching email address — without the user having to add the account manually. It configures access to an existing mailbox; it does not create a mailbox on the mail server (see Does provisioning create mailboxes?).

How it works¶

A provisioning configuration is matched against a user's email domain. When a user logs in, if their email domain matches a configured provisioning domain, the Mail app creates an account for them using that configuration.

• Using the wildcard (*) in the provisioning domain field creates a configuration that applies to all users, provided they don't match a more specific configuration.
• Specific domain configurations take priority over the wildcard configuration.
• If a new matching configuration appears after a user has already been provisioned under a different one, the new configuration takes precedence and the user is reprovisioned.
• There can only be one configuration per domain, and only one wildcard configuration.
• Multiple configurations can be used together (e.g. one wildcard plus one or more domain-specific configurations).

Password handling¶

Provisioning does not prompt the user for a separate mail password. It reuses the password the user just used to log in to Nextcloud, and sends that same password to the configured IMAP/SMTP server.

Because of this:

• It only works if Nextcloud and the mail server share the same credentials — typically because they're backed by the same user backend (e.g. LDAP).
• With regular (non-SSO) logins, Nextcloud does not hold the user's plaintext password in that case, so it has nothing to forward to IMAP/SMTP, unless a master password is configured (see below).
• If a user's Nextcloud password changes independently of their mail server password, the two fall out of sync and provisioning will fail to authenticate.

Master password¶

Added in Mail app 3.5.0.

Nextcloud only ever sees a user's plaintext password at the moment they log in with it. For accounts authenticated via Single Sign-On (SAML, OIDC, etc.), Nextcloud never sees the password at all, so there is nothing to forward to the mail server — regular provisioning cannot authenticate these users.

The master password option works around this by configuring one shared password for all provisioned accounts, sent to IMAP/SMTP/Sieve instead of the user's individual login password. This only works if the mail server supports a separate "master" credential that can authenticate as any user.

Notes and caveats:

• Enable the Use master password checkbox and fill in the Master password field; the IMAP/SMTP/Sieve User fields still determine which mailbox is accessed (typically via the email address template).
• The master password is stored on the Nextcloud server and used for every provisioned user, so it must be paired with a mail-server-side restriction (e.g. by source IP) to avoid it being usable as a generic backdoor password.

Configuration fields¶

Found under Administration settings → Groupware → Mail app → Account provisioning.

The admin settings page shows a live preview of the resulting account configuration as fields are filled in.

Does provisioning create mailboxes?¶

No. Account provisioning only configures the Mail app to connect to an already-existing mailbox on the IMAP/SMTP server — it does not create, allocate, or provision a mailbox on the mail server itself.

The mailbox (and its storage, quota, aliases, etc.) must already exist on the mail server before provisioning can use it. Actual mailbox creation is the responsibility of the mail server / mail hosting stack (e.g. Dovecot, Postfix, a hosting panel, or your own provisioning scripts), typically triggered by the same user backend (LDAP/AD) that Nextcloud and the mail server share. If no mailbox exists for a user at the configured IMAP host, the provisioned account will simply fail to connect.

Limitations¶

• No support for SSO-based logins (SAML, OIDC) without a master password — regular provisioning depends on Nextcloud holding the plaintext login password to forward to the mail server.
• Does not create mailboxes on the mail server — it only connects the Mail app to mailboxes that already exist.
• Only one configuration per domain and one wildcard configuration are allowed at a time.
• Best suited to deployments where Nextcloud and the mail server share the same authentication backend (e.g. LDAP/AD).