Motivation

Starting with v8.45, the Open-Xchange Server supports to snooze mails to be returned to original folder at a user-chosen time.

Prerequisites

In order to support snooze of mails to be returned at a desired date, the package open-xchange-mail-snoozed needs to be installed.

Moreover, the middleware needs a credential of its own to return a mail at its due time; see Credentials for returning mails.

In addition, the feature also needs to be enabled for App Suite UI through the following UI setting:

io.ox/core//features/snooze = true

Configuring snooze mail feature

• "com.openexchange.mail.snoozed.enabled" controls whether the feature is available or not. This property is reloadable and config-cascade aware.
• "com.openexchange.mail.snoozed.checkFrequencyMinutes" specifies the frequency in minutes when to check for due snoozed mails. This property is reloadable, but not config-cascade aware.
• "com.openexchange.mail.snoozed.lookAheadMinutes" specifies the look-ahead in minutes that is the extra time added to now when a snoozed mail is considered as due. This property is reloadable, but not config-cascade aware.
• "com.openexchange.mail.snoozed.lockExpiryMinutes" specifies the time in minutes when the lock marking a snoozed mail as "in processing" is considered as expired and thus may be newly acquired by another process. This property is reloadable, but not config-cascade aware.
• "com.openexchange.mail.snoozed.lockRefreshMinutes" specifies the time in minutes when the lock marking a snoozed mail as "in processing" is refreshed by lock-holding process. This property is reloadable, but not config-cascade aware.
• "com.openexchange.mail.snoozed.requireMasterAuth" controls whether the feature is offered only where the middleware has a credential of its own for returning mails: master authentication, a token exchange or the offline grant (see below). Defaults to true. With false, it is offered anyway and uses the credential of the user's session, which ends with it. This property is reloadable and config-cascade aware.

Credentials for returning mails

The middleware returns a snoozed mail at its due time while the user may not be logged in, so it needs a credential for the mail server of its own. It keeps one per mail in the mail credential vault, in one of three ways:

• Master authentication: the mail server accepts a master password for every user.

  com.openexchange.mail.passwordSource=global
  com.openexchange.mail.masterPassword=secret

• Token exchange (OAuth): the middleware exchanges the user's access token at the identity provider for tokens that outlive the session (Tokens from an exchange).
• Offline grant (OAuth): for identity providers without a suitable token exchange. The user allows background access once, in a popup at the identity provider, and the vault keeps those tokens for the user's scheduled and snoozed mails (Tokens from an offline grant):

  # For the OpenID Connect back-end the users log in with
  com.openexchange.oidc.offlineGrantEnabled=true

App Suite UI asks for the authorization when the middleware answers with MCRED-0014, and offers it in the security settings. For a step-by-step setup of the middleware, the identity provider and the mail server, see Background Mail Access.

Without one of the three, the feature is not offered (the capability stays off) unless "com.openexchange.mail.snoozed.requireMasterAuth" is set to false; then the middleware uses the credential of the user's session, which ends with it.

Narrowing the background credential at the mail server

With OAuth, the tokens of the token exchange or the offline grant log in to IMAP like the user's own. Dovecot can narrow them by ACL to what the job needs, if they carry a claim of their own; see Narrowing the grant's tokens at the mail server for the identity provider's and Dovecot's configuration. Returning snoozed mails needs:

A snoozed mail may come from any folder, but returning it through the offline grant opens none: the middleware appends it with its flags, keywords and color label in a single APPEND. Every other credential returns it the usual way, opening the folder to set the flags. The mail server checks the rights to insert (i) and to set the flags (s, w) itself, so the background credential reads no mailbox but Snoozed; elsewhere it can only add mails. Checked with Dovecot CE 2.4.5: such an APPEND keeps the flags, keywords and received date, while SELECT on the folder is refused.