Account Manager reports Authentication failure

[Lars_O]

My FP6 with /e/OS will not sync with my Murena account. That goes for everything except emails - so calendar, notes, tasks etc. do not sync.

Whenever a sync session is started it ends up with the error:

Account Manager

Your account xxx@murena.io

Authentication failed (check login credentials)

Going into the Account Manager and retyping my user name and password doesn’t help - the problem persists. And I know the username and pw are correct as they work when I access my Murena account on my laptop.

I have also tried to delete the account and setting it up again, but the result is the same.

I have had the problem for some time, and it might be related to the update to the official /e/OS version 3.2, but I’m not sure about that.

Any good ideas?

Regain your privacy! Adopt /e/OS the deGoogled mobile OS and online services

[Manoj]

Hi @Lars_O , Pl can you check your account now and verify if you are still facing the issue. Do not share email ID details on this post as this is a public forum.

[Lars_O]

Thanks @Manoj for looking into this.
I have just tried again, and it’s the same isssue. However, I have a davx5-debug.zip file. Would that be of help?

[Lars_O]

Btw @Manoj - I have enabled 2FA with the Aegis app. I don’t know whether that could cause some troubles.

[Manoj]

That could be an issue. Can you try to disable 2FA and then try accessing the services.

[Lars_O]

Thanks @Manoj - that solved the problem.

However, I would still like to use 2FA, and I now wonder whether the recipe is hidden in the note below the 2FA option on my Murena account:

Note: You’ll need to create a new application password to set your account within /e/OS. Additionally, you need to provide your main account password to /e/OS Mail.

If I understand that correctly, I need to configure an application password for every account I want to synchronize. Is that correctly understood?

[Tentos]

@Lars_O

If I understand that correctly, I need to configure an application password for every account I want to synchronize. Is that correctly understood?

Every app or device (including your phone) that wants to access your Murena account needs an application password. Alternatively, you may have the possibility to use Single-Sign On.

As sated in the documentation you have quoted, the mail app is an exception and needs your main account password. Please note that you may have to disable the mail synchronization in Accounts > Murena account > Account Synchronization > Mail. The mail synchronization there seems to overwrite your password in the mail app with the app password (see the bug at Murena Mail password overwritten by Account manager password does not work with MFA (#8638) · Issues · e / Backlog · GitLab).

[Lars_O]

Thanks for the info @Tentos - I will look into that

[Lars_O]

@Tentos - if I understand this correctly, I have 2 options:

• either I disable 2FA until there is a solution to the problem with overwrite of the mail app pw when sync is enabled,
• or I disable mail sync, but then I can’t access my emails on my FP6 (or is there a way to manually refresh when I open the mail app?)

[Tentos]

@Lars_O

or I disable mail sync, but then I can’t access my emails on my FP6 (or is there a way to manually refresh when I open the mail app?)

I think that the name of the mail sync setting may be a bit misleading: If you deactivate it, but the /e/OS mail app has already been configured, mails can be fetched as usual.

My suggestion would be as follows:

• Enable 2FA, configure the Murena account on the phone with an app password etc.
• Disable the mail sync setting (if it is not already disabled)
• Then there are two possibilities
  • If your mail account is already configured, change the IMAP and SMTP passwords as described in the K9 Mail documentation: See K-9 Mail - Account Settings Account settings - K-9 Mail - Incoming Server and Account settings - K-9 Mail - Outgoing Server
  • If your mail account is not configured yet, simply directly add it in the mail app as described at Two Factor Authentication - Manually set up mail application

You may want to check the synchronization settings:

• The mail app offers push, see Push settings
• You can enable or disable automatic polling, see Account settings - Poll Frequency

Additionally, you may set the automatic display of images as you see fit: Account settings - Always show images. Spam mails may use the image download, i.e., image display, in a mail app to verify that a message has arrived.

P.s.: I have linked the (old) K-9 documentation because /e/OS is (more or less) a rebranded K-9 mail app. The /e/OS mail app still works, but K-9 Mail has become Thunderbird on Android and received several updates. (An app identical to Thunderbird on Android with the K-9 branding is still available.)

[naillig59]

Occasionally i have the authentication error message but i have also had a problem in settings with “Tasks mgr” and other settings. I turned ACCOUNT MGR logging on a couple of days ago and then started reading.
Here’s what I determined and maybe it will catch the eye of some tech who knows what to do. .Below Is the note i made while reading.

https://murena.io/apps/notes/note/623411465#h-account-mgr-logs-1326

One thing i forgot. When the system used the Nailig59 username, it referred to “foundation.”. If i go to the forum from workspace will it log me in under my email or my username?

[Lars_O]

Hi @Manoj and @Tentos

I have just noticed that the bug Murena Mail password overwritten by Account manager password does not work with MFA has been closed, as Nicolas Gif-Fino writes:

I close this issue since the initial problem is solved by deactivating the mail synchronization in the Murena account settings?

But is that really a solution? In my book it seems like a temporary workaround that has now been made permanent.

From a user perspective it’s not at all evident that you have to disable mail sync if you, in the name of privacy, enables 2FA. And if Murena wants e/OS to be a viable option for non-nerdy types of users, I strongly recommend a solution that makes sense for a user.

If I understand this correctly, the real problem is that the Mail app requires the Murena account pw, which is a problem if a user changes the Murena account pw, as in that case the Mail app will no longer be able to sync.

To remedy this problem a “hack” has been introduced that regularly transfers the pw for the Murena account to the Mail app. That solves the sync issue, but only as long as 2FA is not enabled.

Because when 2FA is enabled, an app pw is needed to add the account to the Account Manager. And as this is transferred to the Mail app periodically, it overwrites the Murena account pw, and the Mail app will no longer be able to access the mail.

As @tcecyk writes

the current updatePassword() function didn’t anticipate MFA users with one or multiple app-passwords

So it seems like you’re trying to squeeze two different pws into the same pw-box. And instead of fixing this problem you advice users to deactivate mail sync???

[Tentos]

I have suggested to the ticket author to re-open the ticket again.

@Lars_O

And instead of fixing this problem you advice users to deactivate mail sync???

I am not sure whether the ticket author is a developer at Murena, so his closing of the ticket may be a misunderstanding.

[EBZPotshausen]

FP5, 3.6, Mail 6.711-5. the solution doesn’t work!

I try to use murena with Yubikey an Yubi authenticator.

In murena.io there’s only “Client-Synchronisierung” to switch on/off. It doesn’t help with Mail app.

There is settings/user/security “Authentifizierung ohne Passwort” but it doesn’t work neither.

Any help?

thanks a lot

Sören

[Tentos]

Hello @EBZPotshausen, generally speaking, the problem has been fixed with the switch to OAuth2 for the Murena.io login. The Mail app also uses the OAuth2 token if the mail sync setting is enabled (yes, it must no longer be disabled!).

My question: Do you refer to the login to the Murena account on your smartphone as described in the documentation?
Or do you refer to the login in the Murena.io Workspace app foundation.e.webapk_murenaio that is preinstalled on /e/OS?

[EBZPotshausen]

Hi Tentos,

thanks for your reply

I first setup the Murena.io and tried both sync enabled/disabeld.

Then I faced the Problem, that the password for Murena gets always overwritten by the password created bei Murena.io for the mail app.

In mail app I tried OAuth2 an mail app says “OAuth 2.0 is not supported”!!! Can’t find a counterpart in Murena.i to set to OAuth 2.0

I think the hole process should by more straight forward MFA/FIDO2 isn’t that new….

Sören

[Tentos]

Hi @EBZPotshausen ,

Apart from your FIDO2 key: It is strange that it was not OAuth2 to log in into Murena.io in the /e/OS account settings.
Can you do the following (in German)
Open Android Settings, then “Konten” > Tap on your Murena.io account > Tap on “Mein Konto” > Tap on “Einstellungen - Zusätzliche Einstellungen für das Konto”.
Then, “Kontenverwalter” should open. > Tap on the tile of your Murena.io account. > Tap on the “Settings” icon in the upper right corner (the gear wheel = Zahnrad).

The settings of your Murena.io account are listed. In the section “Authentifizierung”, does it show “Erneut anmelden - Erneut mit OAuth anmelden”?

[EBZPotshausen]

Hallo Tentos,

da wie es scheint niemand englisch mitliest, antworte ich deutsch.

Danke für die Anleitung. Unter Android Settings/Konten/murena account wird nicht “Erneut anmelden - Erneut mit OAuth anmelden” angezeigt. Ich kann auch nichts umschalten. Da steht nur Passwort erneuern zur Verfügung. Dann bin ich aber ohne 2FA unterwegs.

Im browser in der Murena cloud muss ich mich allerdings mit 2FA anmelden!?

Heute kam das update auf eOs 3.7. das hat aber auch keine Änderung gebracht.

Ich habe die Mail app gerade nochmal genau nach Anleitung unter How to enable Two Factor Authentication (2FA) 🔑

eingerichtet. Ergebnis 2FA funktioniert nicht. Die App geht nur mit dem Hauptkontopasswort und dann ohne 2FA

[Tentos]

Danke fürs Nachsehen. Wäre es eine Option, den Murena-Account auf Deinem /e/OS-Telefon zu löschen und wieder hinzuzufügen (am besten, wenn 2FA auf dem Murena-Konto aktiviert ist)? Beim Löschen auch sicherstellen, dass das Konto in der Mailapp entfernt wurde.
Beim neuen Hinzufügen des Murena-Accounts sollte dann eigentlich OAuth2 verwendet werden.

Nach dem Hinzufügen muss man die Synchronisierungseinstellungen gleich anpassen, weil standardmäßig alle Optionen angeschaltet sind. (Ich selbst beschränke mich auf die E-Mails, Aufgaben, Kalendereinträge und die App-Einstellungen.)
Durch die Mailsynchronisierung sollte das Murena-Mailkonto in der Mailapp wieder eingerichtet werden, jetzt mit OAuth2. Man sollte in der Mailapp die automatische Synchronisierung so einstellen, wie man es möchte.

Damals hatte ich auf meinem Gerät übrigens auch ein App-Password und in der Mailapp das Hauptpasswort. Nach einem /e/OS-Update (weiß die Version nicht mehr) gab es eine Benachrichtigung, auf OAuth2 umzustellen: Durch Aufrufen der Benachrichtigung konnte ich das problemlos machen. Es wurde dann durch Aktivieren der Mailsynchronisierung sogar automatisch auf OAuth2 beim Mailkonto umgestellt.

[tcecyk]

(@EBZPotshausen to reply to your yubikey question, not the op)

german reply

imo kommen sich da Generationen von “2FA” in die quere. Das alte 2fa ist eine das app-passwords für clients ausgibt. Kein oauth2 beteiligt.

Beim SSO wie es murena denke ich macht wandert das in den provider (keycloak hatte ich paarmal gelesen) dafür weg von nextcloud. Murena bindet den ein via nextcloud-oidc-login.

Bis ein enduser interface zugänglich gemacht wird um im provider 2fa methoden zu hinterlegen würde ich den happypath nehmen und oauth2 pw login machen.

the gist of the collapsed german lang post: I’d abandon the “old 2fa” in murenas nextcloud and use the new oauth2 login and wait to have a SSO portal there available to register 2fa methods.

@Manoj the 2fa docs would need to account for the SSO migration