<div dir="ltr">Dear Arnost,<div><br></div><div> You are absolutely right pointing out the reliance on the email security for this feature.</div><div><br></div><div> Generally, security control on the following should be considered before adopting any email approval:</div><div><ol><li>Adopting MFA for mailbox authentication.</li><li>Enforcing SPF, DKIM, and DMARC to counter sending forging</li><li>Enable end-to-end email encryption and signing (S/MIME). (To be added as part of the feature to validate email signature)</li><li>Generate a nonce with configurable validity lifetime rather than relying on the workitem ID. (To be added as part of the feature)</li></ol><div><br></div></div><div>Best Regards,</div><div>Kyle</div></div><br><div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">On Thu, Feb 5, 2026 at 12:35 AM Arnošt Starosta via midPoint <<a href="mailto:midpoint@lists.evolveum.com">midpoint@lists.evolveum.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class="msg-4072561958736687870">
<div dir="ltr">
<div style="font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
Hi Kyle,</div>
<div style="font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
I like the convenience of the feature but I'm very concerned about its security implications.</div>
<div style="font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
The current email infrastructure is improving but still brittle as an authorization channel.</div>
<ol style="margin-top:0px;margin-bottom:0px;list-style-type:decimal" start="1">
<li style="font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<div role="presentation">It's not a secure channel offering easy let alone default end-to-end encryption.</div>
</li><li style="font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<div role="presentation">Forging the senders identity may still be easy depending on domain configuration and enforcement policies.</div>
</li><li style="font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<div role="presentation">Workitem ID is not a secret value.</div>
</li><li style="font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<div role="presentation">Time-limited token if used is not a secret value once transmitted in plaintext over email. Moreover the necessary validity window in the approval context is drastically different from password resets and similar
features.</div>
</li><li style="font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<div role="presentation">Mailboxes remain among the most attacked resources online.</div>
</li></ol>
<div style="font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
There are multiple industry bodies explicitly warning against relying on email alone for authorization decisions.</div>
<div style="font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
The service providers offering email-based approval should make these limitations clear.<br>
<br>
</div>
<div style="font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
I would not use this feature given the current state of email security and would discourage clients from doing so without a thorough risk assessment.</div>
<div style="font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
Best Regards,</div>
<div style="font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
Arnost</div>
<div style="font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div id="m_-4072561958736687870appendonsend"></div>
<hr style="display:inline-block;width:98%">
<div id="m_-4072561958736687870divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> midPoint <<a href="mailto:midpoint-bounces@lists.evolveum.com" target="_blank">midpoint-bounces@lists.evolveum.com</a>> on behalf of Kyle Chau via midPoint <<a href="mailto:midpoint@lists.evolveum.com" target="_blank">midpoint@lists.evolveum.com</a>><br>
<b>Sent:</b> Monday, February 2, 2026 3:35 PM<br>
<b>To:</b> <a href="mailto:midpoint@lists.evolveum.com" target="_blank">midpoint@lists.evolveum.com</a> <<a href="mailto:midpoint@lists.evolveum.com" target="_blank">midpoint@lists.evolveum.com</a>><br>
<b>Cc:</b> Kyle Chau <<a href="mailto:kylechaukccs@gmail.com" target="_blank">kylechaukccs@gmail.com</a>><br>
<b>Subject:</b> [midPoint] Feature Request - Email Approval</font>
<div> </div>
</div>
<div>
<div dir="ltr">
<div>Dear MidPoint team,</div>
<div><br>
</div>
<div> I am interested in implementing an email approval feature as my individual contribution to the project. Would you please provide some insight on whether this suggestion would be accepted as a core feature? The implementation, from my understanding, involves
the following:</div>
<div>
<ul>
<li>A sample message template that crafts the email approval content.</li><li>A new task type for enabling and scheduling the mailbox processing.</li></ul>
</div>
<div> I can contribute to the design and development of this feature for the next six months. </div>
<div><br>
</div>
<div> You may refer to the following for a high-level illustration on the proposal. Thank you.</div>
<div><br>
</div>
<div> Do let me know if you have any questions.</div>
<div><br>
</div>
<a href="https://github.com/KyleChaukccs/docs/blob/master/midpoint/features/planned/email-approval.adoc" target="_blank">https://github.com/KyleChaukccs/docs/blob/master/midpoint/features/planned/email-approval.adoc</a>
<div><br>
</div>
<div>Best Regards,</div>
<div>Kyle</div>
</div>
</div>
</div>
_______________________________________________<br>
midPoint mailing list<br>
<a href="mailto:midPoint@lists.evolveum.com" target="_blank">midPoint@lists.evolveum.com</a><br>
<a href="https://lists.evolveum.com/mailman/listinfo/midpoint" rel="noreferrer" target="_blank">https://lists.evolveum.com/mailman/listinfo/midpoint</a><br>
</div></blockquote></div>