📋 SecuMails: Configuring shared mailboxes with Outlook Add-In (SAML limitation)

Introduction

The use of shared email accounts (also known as functional mailboxes or shared mailboxes) is a common requirement in many organizations. Setting up such shared mailboxes is generally possible with FTAPI SecuMails and the corresponding Outlook Add-In, but it is subject to certain technical and security-related limitations. This article explains the challenges and describes the recommended configuration.

Technical limitations for shared mailboxes

Necessity of sharing credentials

For multiple users to access a shared mailbox via the FTAPI Outlook Add-In, all accessing users must know the password for this account as it is stored on the FTAPI server. If end-to-end encryption is used for the mailbox, the SecuPass-Key of the shared account must also be known to all involved users.

This necessity arises because the FTAPI server does not know or manage passwords for SAML users, as authentication takes place directly via the customer's external Identity Provider (IdP).

Limitation to one SAML account in the Outlook Add-In

The FTAPI Outlook Add-In can only be authenticated with a single SAML account per instance at any given time. This leads to a crucial limitation:

• If a user's personal account is already connected via SAML, an additionally integrated shared mailbox cannot also be a SAML account.

Since FTAPI version 4.17.0, a database user is also permanently converted into a SAML account upon the first successful login via SAML, which further reinforces this separation.

Recommended configuration for shared mailboxes

To bypass the mentioned limitations, the following configuration is recommended:

1. Create the shared mailbox as a regular database user (non-SAML account) on your FTAPI server. Assign a secure, unique password for this purpose.
2. Share this password (and if necessary, the SecuPass-Key) securely with all users who are to access the mailbox.
3. Users can then add this non-SAML account to the FTAPI Outlook Add-In in addition to their personal (SAML or non-SAML) account.

Important security notice