What is Roundcube
Roundcube is a browser-based multilingual IMAP client with an application-like user interface. It provides full functionality you expect from an email client, including MIME support, address book, folder manipulation, message searching and spell checking
This integration describes how to use Roundcube's oauth support with authentik to automatically sign into an email account. The mail server must support XOAUTH2 for both SMTPD and IMAP/POP. Postfix SMTP server can also use Dovecot for authentication which provides Postfix with xoauth2 capability without configuring it separately.
The following placeholders will be used:
authentik.companyis the FQDN of the authentik install.
Create a new oauth2 Scope Mapping which does not return the 'group' values and associate this mapping in the provider settings instead of the default oauth mapping.
Under Property Mappings, create a Scope Mapping. Give it a name like "oauth2-Scope-dovecot". Set the scope name to
dovecotprofile and the expression to the following
#DO NOT INCLUDE groups
Create an application in authentik. Create an OAuth2/OpenID Provider with the following parameters:
- Client Type:
- Scopes: OpenID, Email, and the scope you created above
- Signing Key: Select any available key
$config['oauth_provider'] = 'generic';
$config['oauth_provider_name'] = 'authentik';
$config['oauth_client_id'] = '<Client ID>';
$config['oauth_client_secret'] = '<Client Secret>';
$config['oauth_auth_uri'] = 'https://authentik.company/application/o/authorize/';
$config['oauth_token_uri'] = 'https://authentik.company/application/o/token/';
$config['oauth_identity_uri'] = 'https://authentik.company/application/o/userinfo/';
$config['oauth_scope'] = "email openid dovecotprofile";
$config['oauth_auth_parameters'] = ;
$config['oauth_identity_fields'] = ['email'];
Add xoauth2 as an authentication mechanism and configure the following parameters in your Dovecot configuration.
tokeninfo_url = https://authentik.company/application/o/userinfo/?access_token=
introspection_url = https://<Client ID>:<Client Secret>@authentik.company/application/o/introspect/
introspection_mode = post
force_introspection = yes
active_attribute = active
active_value = true
username_attribute = email
tls_ca_cert_file = /etc/ssl/certs/ca-certificates.crt
With this setup Dovecot can also be used with other email clients that support XOAUTH2 authentication, however most available software (including Fair Email for Android and Thunderbird) only come with support for Gmail, Outlook etc with no way to configure custom email servers.
Please refer to the following for further configuration information: