authentik native change of email-claim

[Jniklas2]

For the "authentik native mailbox selector" you need to add/change some things:

0. Add or edit the attributes of a user/group you want

Just add this block with the mailboxes, you want to be able to select:

mailaddresses:
- test@example.net
- mailbox@example.com

1. Create a new prompt

Name: Choose Mailaccount (Just choose a name you like)
Field key: attributes.mail.selected_email (You can change the part after attributes., but then you also need to change it later on)
Label: Choose Mailaccount (Just chose a label you like, the user will see it in the end)
Type: either Radio Button Group (fixed choice) or Dropdown (fixed choice) worked for me.
Required: true
Interpret placeholder as expression: true (Important)
Placeholder: (For generating the list with all options)

returnuser.group_attributes().get("mailaddresses")

Interpret initial value as expression: true
Initial value: (for automatically selecting the previously selected mailbox)

try:
returnuser.attributes.get("mail", {}).get("selected_email", "")
except:
returnuser.email

Order: 0

After entering all information, you should see a preview on the right with the mailboxes that you have entered in the user or group attributes.

2. Create two new stages:

2.2: New Prompt stage

Name: mailaddress-chooser (you can choose your own)
Fields: Select the previously created field Choose Mailaccount.

2.1: New User Write Stage

Name: mailcow-chosen-address (you can choose your own)
User creation mode: Never create users

3. New Authorization Flow:

I've just copied the default default-provider-authorization-implicit-consent flow (since it's my default flow for almost all applications). You can also choose the explicit one.

In the new flow I added both the mailaddress-chooser and the mailcow-chosen-address stages.
For mailaddress-chooser I set the order to 10.
For mailcow-chosen-address I set the order to 20 and set the Invalid response behavior to RESTART.

Now the Stage bindings should look like this:

And the Flow Diagram should be similar to this:

4. New Scope Mapping:
   Mapping Name: mailcow-custom-mail (You can choose your own name)
   Scope name: email (This is important)
   Expression:

request.user.refresh_from_db()
mail_attributes=request.user.attributes.get("mail", {})
selected_email=mail_attributes.get("selected_email")
final_email=selected_emailifselected_emailelserequest.user.emailreturn {
"email": final_email,
"email_verified": True
}

5. Last but not least: Edit your mailcow OIDC Provider:
   Change the Authorization flow to mailcow-authorization
   In Advanced protocol settings -> Scopes replace the default authentik default OAuth Mapping: OpenID 'email' with our new scope mailcow-custom-email

That should be it :)

[CodeShellDev]

Cool! So you basically used the same technique: Modifying the email claim, I am not familiar with custom properties etc, but how do you add new mailboxes? Do you just add them to the list?

[Jniklas2]

Yep, you can just add them to the list in step 0. And the lists from groups and from your user get merged, so you can combine both

[CodeShellDev]

You have to be Admin to add new ones right?

[Jniklas2]

If you edit a user or a group, you have that big textfield for custom attributes at the bottom. There you can just add them like this:

(This is from a group, but for users it looks the same)

Few more Information about attributes:
https://docs.goauthentik.io/users-sources/user/user_ref/

I also set the template via a custom scope mapping and a custom attribute, so the mailboxes always have specific options, which get checked and corrected on every login flow.
That's why my user also has this attribute:

But that isn't explained here, on how to set this up.

[Jniklas2]

You have to be Admin to add new ones right?

That's right. That's exactly what I wanted. I don't want every user to edit their own mailboxes. You could technically add groups with specific attributes and then allow the users to assign themselves or others to that group. It's also possible to allow users to edit their own attributes, but then they can change every attribute, which normally isn't a good idea.

Maybe it's even possible to allow users to edit the mailboxes via the user-settings-flow which is essentially their own user details (https://authentik.company/if/user/#/settings)

[CodeShellDev]

Interesting, but I guess I trust my Users with their mailboxes, I needed for my Users to be able to also add new mailboxes and tbh I never thought authentik would Support this builtin, was 100% Sure I would need to make another App for that, hence this Project. But this is a really simple and yet effective way to manage mailboxes!