I have a web application running on node.js, backed by a MongoDB database which stores user data etc... I'd like to offer my users an email account, so I've set up a mail server using Postfix, dovecot, etc... My problem is that I'd like to link the two user databases. Currently I have postfix and dovecot configured to use virtual users stored in a mysql (really MariaDB) database, and this is working fine (I can access and send emails over IMAP etc...). However, I want my users to be able to use the same password for IMAP as for logging in to the web application. I'm happy to write a PHP api to create users on the mail server etc..., but my issue is how to handle passwords. As I see it, there are two options;
- I can transmit the plain text passwords from my web application server to my mail server when a user signs up or changes password. This would then obviously be hashed on the mail server and stored in the mysql database, and hashed on the application server and stored in the MongoDB database. This feels somehow wrong to me - transmitting a plain text password in two hops like that.
- I can transmit the hashed passwords from the application server to the mail server, and store them there without hashing again. Again, this feels pretty dodgy, as from the perspective of the mail server, it's accepting passwords and storing them in clear text.
Are there any other options to allow my users to log into both servers with the same credentials? What security issues exist with the two options I've thought of above?