Fix impersonation when using external directories

CHANGELOG.md

@@ -12,10 +12,13 @@ If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If
 - Replaced `STALWART_HTTPS_PORT` with `STALWART_PUBLIC_URL`.
 
 ## Fixed
-- Directory: Invalidate caches when group memberships change on an external directory.
+- Directory: 
+  - Invalidate caches when group memberships change on an external directory.
+  - User impersonation.
 - Log viewer: All events show as `INFO`.
 - Registry: Allow changing object variants.
 - Node id renewal.
+- DNS Updater: Fix Route53 serialization format.
 
 ## [0.16.2] - 2026-04-28
 

crates/common/src/auth/authentication.rs

@@ -142,6 +142,13 @@ impl Server {
 
                 // Authenticate app passwords
                 if let Some(app_pass) = AppPassword::parse(secret) {
+                    if username.is_master() {
+                        return Err(trc::AuthEvent::Failed
+                            .into_err()
+                            .ctx(trc::Key::AccountName, auth_as_address.to_string())
+                            .ctx(trc::Key::SpanId, req.session_id)
+                            .reason("App passwords cannot be used for impersonation"));
+                    }
                     return if let Some(account_id) =
                         self.account_id_from_parts(auth_as_local, domain.id).await?
                     {
@@ -164,7 +171,17 @@ impl Server {
                 // Obtain external directory, if any
                 let mut is_alias_login = false;
                 let token = if let Some(directory) = self.get_directory_for_cached_domain(&domain) {
-                    let directory_account = directory.authenticate(&req.credentials).await?;
+                    let directory_account = if username.is_master() {
+                        directory
+                            .authenticate(&Credentials::Basic {
+                                username: auth_as_address.to_string(),
+                                secret: secret.clone(),
+                                mfa_token: mfa_token.clone(),
+                            })
+                            .await?
+                    } else {
+                        directory.authenticate(&req.credentials).await?
+                    };
 
                     is_alias_login = directory_account.email != auth_as_address;
                     self.build_directory_token(directory_account, req.remote_ip)

install.sh

@@ -207,8 +207,9 @@ write_env_file() {
 # Override the hostname used in HTTP responses
 #STALWART_HOSTNAME=mail.example.com
 
-# Override the HTTPS port used in HTTPS responses
-#STALWART_HTTPS_PORT=8080
+# Override the public base URL published in OAuth, OIDC, and JMAP discovery
+# documents. Accepts scheme, host, optional port, and optional path prefix.
+#STALWART_PUBLIC_URL=https://mail.example.com
 
 # Enable bootstrap / recovery mode on startup. Accepted: 1, true. Default: false.
 #STALWART_RECOVERY_MODE=true