Chapter 09 Clients, Groupware & CLI Admin: #pUsers

Smartphone & iPhone Onboarding via QR, WhatsApp & 1-Click Admin Invite

Users should be able to provision Mail, Calendar, Contacts, and Notes on iOS and macOS in under 30 seconds without typing ports or exposing their master password. SharpMailserver generates PKCS#7/CMS-signed .mobileconfig profiles paired with an isolated per-device App Password.

Operational Tip & Architecture Note

Why Messenger-safe Setup Links (/onboarding/setup/{token}) matter: WhatsApp, Teams, Slack, and Signal pre-fetch links to build preview cards, which destroys naive single-use download tokens before the human taps! SharpMailserver ignores HEAD/crawler previews, masks credentials from bots, and guides in-app WebViews smoothly into Safari.

30-Second Onboarding Flow on iPhone & iPad

Zero manual port typing and zero exposure of the user's primary password.

Reference / Configuration

1. Admin klickt in #pUsers beim Konto auf "📱 Smartphone einrichten"
2. Link per WhatsApp, Teams, E-Mail senden oder QR-Code scannen lassen
3. Mitarbeiter öffnet Link in Safari -> tippt auf "iPhone / iPad Push-Profil laden"
4. iOS Einstellungen -> "Profil geladen" -> Installieren -> Fertig!

Settings, Default Values & Best Practices

Setting / Location	Description	Default Value	Production Best Practice
`Admin: Smartphone einrichten (#pUsers)`	Generates a 24-hour mobile setup page link directly from the Accounts table, Account Editor, or right after creating a new mailbox.	`24 Stunden gültig / 24h TTL`	Fastest way to onboard new hires: click 'Device Setup' on any user row to share via WhatsApp, copy the setup URL, or send an automated welcome email.
`Profil-Modus: Exchange Push vs. IMAP + DAV`	Lets the recipient install either the unified Push profile (EAS-compatible Mail/Calendar/Contacts/Notes/Tasks) or standard IMAPS + CalDAV/CardDAV.	`Push-Kombi-Profil empfohlen`	Recommend the unified Push profile on iPhone/iPad (provisions Mail, Calendar, Contacts, Notes & Reminders in one native iOS toggle); use Standard for macOS.
`Isoliertes Geräte-App-Passwort`	Every provisioned profile embeds a unique random per-device App Password rather than the user's primary Webmail/2FA password.	`Automatisch pro Gerät`	If a phone is lost or retired, revoke just that single App Password in the Account Editor without resetting the user's password or breaking other devices.
`Download-Toleranz & Safari-Handoff`	Permits up to 6 profile downloads within the 24h window so switching from WhatsApp's embedded WebView into Safari never invalidates the link.	`Max. 6 Abrufe / 24h TTL`	On iOS, open the link in Safari and confirm installation under Settings -> General -> VPN & Device Management -> Profile Downloaded.