mailrust Docs
/
Open mailrust

Administration

Google and Microsoft sign-in

Gmail and Microsoft 365 let a mail client in by consent: the person signs in on Google's or Microsoft's own page and allows reading and sending mail. mailrust never sees the password. Only an app registered with the service may ask for that consent, so an administrator registers one once for the whole installation.

Open Settings → Passwordless sign-in. At the top is the redirect address of your installation:

https://mail.example.com/oauth/callback

You will paste it into the app at the service, character for character.

Google

  1. In the Google Cloud console, create a project or pick one.
  2. Set up the OAuth consent screen. Choose Internal if only people of your Google Workspace will connect; otherwise External.
  3. Add the scopes mailrust asks for: https://mail.google.com/, openid and email.
  4. Under Credentials, create an OAuth client ID of type Web application.
  5. Add the redirect address of your installation to Authorized redirect URIs.
  6. Copy the client ID and the client secret into the Google section in mailrust and save.

An External app with the full Gmail scope works for test users you list in the console. To open it to anyone, Google reviews the app first.

Microsoft 365

  1. In the Microsoft Entra admin center, open App registrations and choose New registration.
  2. Choose who may sign in: your organisation only, or any Microsoft account.
  3. Under Redirect URI, choose Web and paste the redirect address of your installation.
  4. Under Certificates & secrets, create a client secret and copy its value.
  5. Under API permissions, add the delegated permissions IMAP.AccessAsUser.All and SMTP.Send from Office 365 Exchange Online, and offline_access, openid and email.
  6. In mailrust, fill in Application (client) ID, Client secret and Directory (tenant), and save.

Leave Directory (tenant) empty, or write common, to let any Microsoft account in. A directory name or ID limits it to the people of that organisation.

Then

The Sign in with Google and Sign in with Microsoft buttons appear when people connect a mailbox. Tokens refresh by themselves. If a person withdraws the consent, mailrust notices, stops trying, and the mailbox asks to sign in again.

The client secret is stored encrypted and never shown on the page again. Remove the app stops new connections through it, and mailboxes already connected through it stop receiving mail within an hour.