Bug: Autoconfig: Multiple servers
Status: UNCONFIRMED
Priority: --
Created: 2024-07-06 22:56:09+00:00
Resolved: 2024-07-18 08:58:35+00:00

Steps to reproduce:

I setup the autoconfig xml file to my mail server to include multiple server entries. They point to the same server with different authentication mechanisms.

I have encountered the issue on both Rockylinux 9.4 Workstation -> Thunderbird ESR and Windows 10 -> Thunderbird 115.12.2

To reproduce, use the following example (a minimal version of my config):

```xml
<?xml version="1.0"?>
<clientConfig version="1.1">
     <emailProvider id="%EMAILDOMAIN%">
     <domain>%EMAILDOMAIN%</domain>

     <displayName>Home Mail</displayName>
     <displayShortName>HMail</displayShortName>

     <!-- IMAP (Dovecot) -->
     <incomingServer type="imap">
          <hostname>imap.%EMAILDOMAIN%</hostname>
          <port>993</port>
          <socketType>SSL</socketType>
          <username>%EMAILADDRESS%</username>
          <authentication>GSSAPI</authentication>
     </incomingServer>

     <incomingServer type="imap">
          <hostname>imap.%EMAILDOMAIN%</hostname>
          <port>993</port>
          <socketType>SSL</socketType>
          <username>%EMAILADDRESS%</username>
          <authentication>password-cleartext</authentication>
     </incomingServer>

     <!-- POP3 (Dovecot) -->
     <incomingServer type="pop3">
          <hostname>pop.%EMAILDOMAIN%</hostname>
          <port>995</port>
          <socketType>SSL</socketType>
          <username>%EMAILADDRESS%</username>
          <authentication>GSSAPI</authentication>
          <pop3>
               <leaveMessagesOnServer>true</leaveMessagesOnServer>
          </pop3>
     </incomingServer>

     <incomingServer type="pop3">
          <hostname>pop.%EMAILDOMAIN%</hostname>
          <port>995</port>
          <socketType>SSL</socketType>
          <username>%EMAILADDRESS%</username>
          <authentication>password-cleartext</authentication>
          <pop3>
               <leaveMessagesOnServer>true</leaveMessagesOnServer>
          </pop3>
     </incomingServer>

     <!-- SMTP (Postfix) -->
     <outgoingServer type="smtp">
          <hostname>smtp.%EMAILDOMAIN%</hostname>
          <port>465</port>
          <socketType>SSL</socketType>
          <username>%EMAILADDRESS%</username>
          <authentication>GSSAPI</authentication>
     </outgoingServer>

     <outgoingServer type="smtp">
          <hostname>smtp.%EMAILDOMAIN%</hostname>
          <port>465</port>
          <socketType>SSL</socketType>
          <username>%EMAILADDRESS%</username>
          <authentication>password-cleartext</authentication>
     </outgoingServer>

     </emailProvider>

     <clientConfigUpdate url="https://autoconfig.%EMAILDOMAIN%/" />

</clientConfig>
```

My xml contains entries for SSL/TLS and STARTTLS. I removed the entries that are not needed to replicate the issue.


Actual results:

Thunderbird is fetching the xml and chooses the first configuration in the list. When the authentication fails, it will display an error and the user has to open the manual config to switch to another authentication mechanism.


Expected results:

According to the thunderbird [documentation](https://wiki.mozilla.org/Thunderbird:Autoconfiguration:ConfigFileFormat#Multiple_servers), multiple servers can be listed and should be in the order of priority.

While the docs take the TLS settings as an example, they claim that thunderbird will try the next entry in the list if it fails to use the first entry. Unfortunately it doesn't.

In my case this will cause an issue since GSSAPI should be the preferred way to login but the mails still need to be accessible to machines that are not enrolled to the domain, thus requiring me to enable password-cleartext as well.

As long as this fallback mechanism doesn't work properly, users working from non-enrolled machines will need to manually edit the settings which is confusing to most normal people. Furthermore, the options given to the user are not limited to the ones available as per the autoconfig xml file or at least highlighted but instead all options thunderbird supports are available.

While this report is mainly focussing on authentication settings, I also noticed that there was no fallback with TLS issues. To test this I intentionally misconfigured the firewall to block implicit TLS (IMAP port 993). Instead of failing and falling back to the next entry, thunderbird just returned "Success" and saved a profile that was not in working condition.

## TL;DR:

Thunderbird should try other configuration options that were offered instead of failing and depending on the user as described in the docs.

## Optional related feature request

If user interaction is required, a list of the offered settings should be presented to the user from which the user can drop to the (current) lower level configuration if needed.