Configuring OAuth2 ->No Loginbutton for OAuth2 showing up in Roundcube Loginpage

[TomcatMJ]

Hi Community,
i´m struggling a bit with my OAuth2 configuration in Roundcube.
The used System is an upgraded Roundcube (formerly Version 1.4.3, upgraded a few days before and now its 1.6.9) running in a Multidomainsetup with MySQL/Galera for the user/password DB (servers in Backend: dovecot/postfix with several virtualdomains including opendmarc/opendkim etc.) where on one Domain actually should be enhanced with additional OpenID-Connect / OAuth2 Access via a Keycloak Client-Instance.

My Keycloak is working for other services already and i configured Roundcube according to the infos from defaults.inc.php positioned inside the configfile for the targetted virtual domain.
Some of the other domains should use other OAuth2-Clientsettings later on, but not all of the used virtual domains from the mailservers should use OAuth2 additionally, thats the reason for positioning in the spearate roundcube domainspecific configfile.
But up to now there is no Login-Button showing up on the Login Page to use the Keycloak-Login.

What might be a reason to circumvent the appearence of the Button or block this functionality?

Thnx in advance for any help on solving this problem,
 Tom

[SKaero]

Just to be clear your not setting the config inside the defaults.inc.php file correct? Any config changes should be made in the config.inc.php.

[TomcatMJ]

For sure i putted the settings not in defaults.inc.php but in config.inc.php and domain1-config.inc.php (which is my configfile for the domain which should additionally use Oauth2/OpenID-Connect ;-) )..

[SKaero]

Can you post your config? I don't anyone can help without seeing your configuration.

[TomcatMJ]

My config.inc.php (some values anonymised/replaced for security reasons):

Code Select Expand

cat config.inc.php
<?php

/* Local configuration for Roundcube Webmail */

$config['include_host_config'] = array(
    'mail.node1.myfirstmaildomain.tld' => 'myfirstmaildomain_tld_node1_conf.inc.php',
    'mail.node1.mysecondmaildomain.tld' => 'mysecondmaildomain_tld_node1_conf.inc.php',
);


// ----------------------------------
// IMAP
// ----------------------------------
// The IMAP host (and optionally port number) chosen to perform the log-in.
// Leave blank to show a textbox at login, give a list of hosts
// to display a pulldown menu or set one host as string.
// Enter hostname with prefix ssl:// to use Implicit TLS, or use
// prefix tls:// to use STARTTLS.
// If port number is omitted it will be set to 993 (for ssl://) or 143 otherwise.
// Supported replacement variables:
// %n - hostname ($_SERVER['SERVER_NAME'])
// %t - hostname without the first part
// %d - domain (http hostname $_SERVER['HTTP_HOST'] without the first part)
// %s - domain name after the '@' from e-mail address provided at login screen
// For example %n = mail.domain.tld, %t = domain.tld
// WARNING: After hostname change update of mail_host column in users table is
//          required to match old user data records with the new host.
 $config['imap_host'] = 'tls://%t';

// ----------------------------------
// SMTP
// ----------------------------------
// SMTP server host (and optional port number) for sending mails.
// Enter hostname with prefix ssl:// to use Implicit TLS, or use
// prefix tls:// to use STARTTLS.
// If port number is omitted it will be set to 465 (for ssl://) or 587 otherwise.
// Supported replacement variables:
// %h - user's IMAP hostname
// %n - hostname ($_SERVER['SERVER_NAME'])
// %t - hostname without the first part
// %d - domain (http hostname $_SERVER['HTTP_HOST'] without the first part)
// %z - IMAP domain (IMAP hostname without the first part)
// For example %n = mail.domain.tld, %t = domain.tld
// To specify different SMTP servers for different IMAP hosts provide an array
// of IMAP host (no prefix or port) and SMTP server e.g. ['imap.example.com' => 'smtp.example.net']
$config['smtp_host'] = 'tls://%t:587';

// ----------------------------------
// SQL DATABASE
// ----------------------------------
// Database connection string (DSN) for read+write operations
// Format (compatible with PEAR MDB2): db_provider://user:password@host/database
// Currently supported db_providers: mysql, pgsql, sqlite, mssql, sqlsrv, oracle
// For examples see http://pear.php.net/manual/en/package.database.mdb2.intro-dsn.php
// Note: for SQLite use absolute path (Linux): 'sqlite:////full/path/to/sqlite.db?mode=0646'
//       or (Windows): 'sqlite:///C:/full/path/to/sqlite.db'
// Note: Various drivers support various additional arguments for connection,
//       for Mysql: key, cipher, cert, capath, ca, verify_server_cert,
//       for Postgres: application_name, sslmode, sslcert, sslkey, sslrootcert, sslcrl, sslcompression, service.
//       e.g. 'mysql://roundcube:@localhost/roundcubemail?verify_server_cert=false'
$config['db_dsnw'] = 'mysql://roundcube:MySecretPWD@localhost/roundcubemail';

//$config['smtp_pass'] = '';
// provide an URL where a user can get support for this Roundcube installation
// PLEASE DO NOT LINK TO THE ROUNDCUBE.NET WEBSITE HERE!
$config['support_url'] = '';

// this key is used to encrypt the users imap password which is stored
// in the session record (and the client cookie if remember password is enabled).
// please provide a string of exactly 24 chars.
// YOUR KEY MUST BE DIFFERENT THAN THE SAMPLE VALUE FOR SECURITY REASONS
$config['des_key'] = 'MyVerySecretKeyHas24Chars';

// Add this user-agent to message headers when sending. Default: not set.
$config['useragent'] = 'MyFirstMaildomain Webmailer';

// List of active plugins (in plugins/ directory)
// Debian: install roundcube-plugins first to have any
$config['plugins'] = ['virtuser_query', 'password', 'dkimstatus', 'managesieve', 'vacation', 'emoticons', 'compose_addressbook', 'sieverules', 'zipdownload', 'userinfo', 'identicon', 'subscriptions_option'];

// skin name: folder from skins/
$config['skin'] = 'MyLarrybasedSKin';

$config['virtuser_query'] = 'SELECT username FROM EmailServer_db.mailbox WHERE username = \'%u\'';

$config['use_subscriptions'] = true;

$config['auto_create_user'] = true;


My myfirstmaildomain_tld_node1_conf.inc.php :

Code Select Expand

cat myfirstmaildomain_tld_node1_conf.inc.php
<?php

// ----------------------------------
// IMAP
// ----------------------------------
// The IMAP host (and optionally port number) chosen to perform the log-in.
// Leave blank to show a textbox at login, give a list of hosts
// to display a pulldown menu or set one host as string.
// Enter hostname with prefix ssl:// to use Implicit TLS, or use
// prefix tls:// to use STARTTLS.
// If port number is omitted it will be set to 993 (for ssl://) or 143 otherwise.
// Supported replacement variables:
// %n - hostname ($_SERVER['SERVER_NAME'])
// %t - hostname without the first part
// %d - domain (http hostname $_SERVER['HTTP_HOST'] without the first part)
// %s - domain name after the '@' from e-mail address provided at login screen
// For example %n = mail.domain.tld, %t = domain.tld
// WARNING: After hostname change update of mail_host column in users table is
//          required to match old user data records with the new host.
$config['imap_host'] = 'tls://%t';



// ----------------------------------
// SMTP
// ----------------------------------
// SMTP server host (and optional port number) for sending mails.
// Enter hostname with prefix ssl:// to use Implicit TLS, or use
// prefix tls:// to use STARTTLS.
// If port number is omitted it will be set to 465 (for ssl://) or 587 otherwise.
// Supported replacement variables:
// %h - user's IMAP hostname
// %n - hostname ($_SERVER['SERVER_NAME'])
// %t - hostname without the first part
// %d - domain (http hostname $_SERVER['HTTP_HOST'] without the first part)
// %z - IMAP domain (IMAP hostname without the first part)
// For example %n = mail.domain.tld, %t = domain.tld
// To specify different SMTP servers for different IMAP hosts provide an array
// of IMAP host (no prefix or port) and SMTP server e.g. ['imap.example.com' => 'smtp.example.net']
$config['smtp_host'] = 'tls://%t:587';
$config['smtp_auth_type'] = null;
//$config['smtp_auth_type'] = ['LOGIN','OAUTH2','XOAUTH'];


// ----------------------------------

// Enable OAuth2 by defining a provider. Use 'generic' here
$config['oauth_provider'] = 'generic';

// Provider name to be displayed on the login button
$config['oauth_provider_name'] = 'MyKeycloakSSO';

// Mandatory: OAuth client ID for your Roundcube installation
$config['oauth_client_id'] = 'MyKeycloak-MailclientID';

// Mandatory: OAuth client secret
$config['oauth_client_secret'] = 'oetZzGsxSiddaaE1QIRM18BHE3b0VQJa';

// Mandatory: URI for OAuth user authentication (redirect)
$config['oauth_auth_uri'] = 'https://sso.node1.mykeycloakdomain.tld:8443/realms/MySSORealm/protocol/openid-connect/auth';
//$config['oauth_auth_uri'] = 'https://mail.node1.myfirstmaildomain.tld/index.php/login/oauth';

// Mandatory: Endpoint for OAuth authentication requests (server-to-server)
$config['oauth_token_uri'] = 'https://sso.node1.mykeycloakdomain.tld:8443/realms/MySSORealm/protocol/openid-connect/token';

// Optional: Endpoint to query user identity if not provided in auth response
$config['oauth_identity_uri'] = 'https://sso.node1.mykeycloakdomain.tld:8443/realms/MySSORealm/protocol/openid-connect/userinfo';

// Optional: disable SSL certificate check on HTTP requests to OAuth server
// See http://docs.guzzlephp.org/en/stable/request-options.html#verify for possible values
$config['oauth_verify_peer'] = true;

// Mandatory: OAuth scopes to request (space-separated string)
$config['oauth_scope'] = 'email openid profile roles';

// Optional: additional query parameters to send with login request (hash array)
$config['oauth_auth_parameters'] = [];

// Optional: array of field names used to resolve the username within the identity information
$config['oauth_identity_fields'] = ['userPrincipalName'];

// Boolean: automatically redirect to OAuth login when opening Roundcube without a valid session
$config['oauth_login_redirect'] = false;
//$config['oauth_login_redirect'] = 'https://sso.node1.mykeycloakdomain.tld:8443/realms/MySSORealm/account/';


I also tried to switch the skins from my own modified Larrybased Skin between Elastic, Larry and Classic but no luck, they give me no OAuth2 Button either.
So what am i missing to get the Login-Button?

[SKaero]

It sounds like your host configs are being pulled in. If you create a php file with the following what does it print out:

Code Select Expand

<?php
echo 'HTTP_HOST: '. $_SERVER['HTTP_HOST'] .'<br />';
echo 'SERVER_NAME: '. $_SERVER['SERVER_NAME'] .'<br />';
echo 'SERVER_ADDR: '. $_SERVER['SERVER_ADDR'] .'<br />';


[TomcatMJ]

Code Select Expand

HTTP_HOST : mail.node1.myfirstmaildomain.tld
SERVER_NAME : mail.node1.myfirstmaildomain.tld
SERVER_ADDR : <$the_correct_external_ip_adress_of_the_server>
Values changed consistently according to anomymized Values in my configpostings above ;-)

[SKaero]

Nothing wrong there, is there anything in the Roundcube error log?

[TomcatMJ]

Nothing inside the error.log at all...its an empty file :-)

[SKaero]

I think the next best step would be to add a debug check like:

Code Select Expand

rcube::raise_error(print_r($this->options, true), true);
after "$this->options" is set in the "__construct" function in <RC root>/program/include/rcmail_oauth.php

That should log the values of $this->options to the Roundcube error log.

[TomcatMJ]

Now i´ve got some conten in the error.log:

Code Select Expand


[05-Feb-2025 11:18:49 +0100]: <r9k5b86v> PHP Error: Array
(
    [provider] =>
    [auth_uri] =>
    [token_uri] =>
    [client_id] =>
    [client_secret] =>
    [identity_uri] =>
    [identity_fields] => Array
        (
            [0] => email
        )

    [scope] =>
    [verify_peer] => 1
    [auth_parameters] => Array
        (
        )

    [login_redirect] =>
)
 (GET /)
Hm,seems there are no values in the variables for oauth nevertheless its configured in the config file?? Strange results...

[SKaero]

Well that confirms that that the oauth code is running, it isn't getting the config, error logging is working, and that this is a config problem. Have you tired setting the oauth config in the main config file and see if it works then?

[TomcatMJ]

On first view it seems to work when placed in the main config file,but at redirection after login to keycloak it inserts a bunch of "index.php/login/" to the redirecting url so that its landing on the loginscreen again and again without using the css information and so on and without really login in in roundcube ..seems to be another issue...
And in general: if placed in the main config file instead of the config file of the first maildomain, how can i setup another realm/client with different settings or even another openid provider for the second maildomain?

[SKaero]

Having the config in the host config files shouldn't be a problem but clear is in this case. In <RC root>/program/lib/Roundcube/rcube_config.php in the "load_from_file" function in the line before the return can you add:

Code Select Expand

rcube::raise_error($file .' - '. (($success) ? 'true' : 'false'), true);
And post the output in the error log? I want to see what config files its trying to pull in and if its loading them correctly.

[TomcatMJ]

Ok,done and found a typo in the first maildomains host configfile, corrected it and moved the oauth related config to the host configfile again. Then testet first with the second maildomain wiithout oauth configpart and then the first maildomain with oauth configpart.
The resulting error.log:

Code Select Expand


[06-Feb-2025 12:05:54 +0100]: PHP Error: defaults.inc.php - true (GET /)
[06-Feb-2025 12:05:54 +0100]: PHP Error: config.inc.php - true (GET /)
[06-Feb-2025 12:05:54 +0100]: PHP Error: mysecondmaildomain_tld_node1_conf.inc.php - true (GET /)
[06-Feb-2025 12:05:54 +0100]: <nqcrbnlo> PHP Error: Array
(
    [provider] =>
    [auth_uri] =>
    [token_uri] =>
    [client_id] =>
    [client_secret] =>
    [identity_uri] =>
    [identity_fields] => Array
        (
            [0] => email
        )

    [scope] =>
    [verify_peer] => 1
    [auth_parameters] => Array
        (
        )

    [login_redirect] =>
)
 (GET /)
[06-Feb-2025 12:05:54 +0100]: <nqcrbnlo> PHP Error: /var/lib/roundcube/plugins/password/config.inc.php - true (GET /)
[06-Feb-2025 12:05:54 +0100]: <nqcrbnlo> PHP Error: /var/lib/roundcube/plugins/jqueryui/config.inc.php - true (GET /)
[06-Feb-2025 12:06:30 +0100]: PHP Error: defaults.inc.php - true (POST /?_task=login&_action=login)
[06-Feb-2025 12:06:30 +0100]: PHP Error: config.inc.php - true (POST /?_task=login&_action=login)
[06-Feb-2025 12:06:30 +0100]: PHP Error: mysecondmaildomain_tld_node1_conf.inc.php - true (POST /?_task=login&_action=login)
[06-Feb-2025 12:06:30 +0100]: <nqcrbnlo> PHP Error: Array
(
    [provider] =>
    [auth_uri] =>
    [token_uri] =>
    [client_id] =>
    [client_secret] =>
    [identity_uri] =>
    [identity_fields] => Array
        (
            [0] => email
        )

    [scope] =>
    [verify_peer] => 1
    [auth_parameters] => Array
        (
        )

    [login_redirect] =>
)
 (POST /?_task=login&_action=login)
[06-Feb-2025 12:06:30 +0100]: <nqcrbnlo> PHP Error: /var/lib/roundcube/plugins/password/config.inc.php - true (POST /?_task=login&_action=login)
[06-Feb-2025 12:06:30 +0100]: <nqcrbnlo> PHP Error: /var/lib/roundcube/plugins/jqueryui/config.inc.php - true (POST /?_task=login&_action=login)
[06-Feb-2025 12:06:31 +0100]: PHP Error: defaults.inc.php - true (GET /?_task=mail&_token=M8iMLUSoHd1k6MPHByGnOm403cEcwDyW)
[06-Feb-2025 12:06:31 +0100]: PHP Error: config.inc.php - true (GET /?_task=mail&_token=M8iMLUSoHd1k6MPHByGnOm403cEcwDyW)
[06-Feb-2025 12:06:31 +0100]: PHP Error: mysecondmaildomain_tld_node1_conf.inc.php - true (GET /?_task=mail&_token=M8iMLUSoHd1k6MPHByGnOm403cEcwDyW)
[06-Feb-2025 12:06:31 +0100]: <v22nklag> PHP Error: Array
(
    [provider] =>
    [auth_uri] =>
    [token_uri] =>
    [client_id] =>
    [client_secret] =>
    [identity_uri] =>
    [identity_fields] => Array
        (
            [0] => email
        )

    [scope] =>
    [verify_peer] => 1
    [auth_parameters] => Array
        (
        )

    [login_redirect] =>
)
 (GET /?_task=mail&_token=M8iMLUSoHd1k6MPHByGnOm403cEcwDyW)
[06-Feb-2025 12:06:31 +0100]: <v22nklag> PHP Error: /var/lib/roundcube/plugins/password/config.inc.php - true (GET /?_task=mail&_token=M8iMLUSoHd1k6MPHByGnOm403cEcwDyW)
[06-Feb-2025 12:06:31 +0100]: <v22nklag> PHP Error: /var/lib/roundcube/plugins/managesieve/config.inc.php - true (GET /?_task=mail&_token=M8iMLUSoHd1k6MPHByGnOm403cEcwDyW)
[06-Feb-2025 12:06:31 +0100]: <v22nklag> PHP Error: /var/lib/roundcube/plugins/sieverules/config.inc.php - true (GET /?_task=mail&_token=M8iMLUSoHd1k6MPHByGnOm403cEcwDyW)
[06-Feb-2025 12:06:31 +0100]: <v22nklag> PHP Error: /var/lib/roundcube/plugins/zipdownload/config.inc.php - true (GET /?_task=mail&_token=M8iMLUSoHd1k6MPHByGnOm403cEcwDyW)
[06-Feb-2025 12:06:31 +0100]: <v22nklag> PHP Error: /var/lib/roundcube/plugins/jqueryui/config.inc.php - true (GET /?_task=mail&_token=M8iMLUSoHd1k6MPHByGnOm403cEcwDyW)
[06-Feb-2025 12:06:31 +0100]: PHP Error: defaults.inc.php - true (GET /?_task=mail&_action=list&_refresh=1&_layout=widescreen&_mbox=INBOX&_page=&_remote=1&_unlock=loading1738839992072&_=1738839991987)
[06-Feb-2025 12:06:31 +0100]: PHP Error: config.inc.php - true (GET /?_task=mail&_action=list&_refresh=1&_layout=widescreen&_mbox=INBOX&_page=&_remote=1&_unlock=loading1738839992072&_=1738839991987)
[06-Feb-2025 12:06:31 +0100]: PHP Error: mysecondmaildomain_tld_node1_conf.inc.php - true (GET /?_task=mail&_action=list&_refresh=1&_layout=widescreen&_mbox=INBOX&_page=&_remote=1&_unlock=loading1738839992072&_=1738839991987)
[06-Feb-2025 12:06:31 +0100]: <v22nklag> PHP Error: Array
(
    [provider] =>
    [auth_uri] =>
    [token_uri] =>
    [client_id] =>
    [client_secret] =>
    [identity_uri] =>
    [identity_fields] => Array
        (
            [0] => email
        )

    [scope] =>
    [verify_peer] => 1
    [auth_parameters] => Array
        (
        )

    [login_redirect] =>
)
 (GET /?_task=mail&_action=list&_refresh=1&_layout=widescreen&_mbox=INBOX&_page=&_remote=1&_unlock=loading1738839992072&_=1738839991987)
[06-Feb-2025 12:06:31 +0100]: <v22nklag> PHP Error: /var/lib/roundcube/plugins/managesieve/config.inc.php - true (GET /?_task=mail&_action=list&_refresh=1&_layout=widescreen&_mbox=INBOX&_page=&_remote=1&_unlock=loading1738839992072&_=1738839991987)
[06-Feb-2025 12:06:31 +0100]: PHP Error: defaults.inc.php - true (GET /?_task=mail&_action=getunread&_page=1&_remote=1&_unlock=0&_=1738839991988)
[06-Feb-2025 12:06:31 +0100]: PHP Error: config.inc.php - true (GET /?_task=mail&_action=getunread&_page=1&_remote=1&_unlock=0&_=1738839991988)
[06-Feb-2025 12:06:31 +0100]: <v22nklag> PHP Error: /var/lib/roundcube/plugins/sieverules/config.inc.php - true (GET /?_task=mail&_action=list&_refresh=1&_layout=widescreen&_mbox=INBOX&_page=&_remote=1&_unlock=loading1738839992072&_=1738839991987)
[06-Feb-2025 12:06:31 +0100]: PHP Error: mysecondmaildomain_tld_node1_conf.inc.php - true (GET /?_task=mail&_action=getunread&_page=1&_remote=1&_unlock=0&_=1738839991988)
[06-Feb-2025 12:06:31 +0100]: <v22nklag> PHP Error: /var/lib/roundcube/plugins/zipdownload/config.inc.php - true (GET /?_task=mail&_action=list&_refresh=1&_layout=widescreen&_mbox=INBOX&_page=&_remote=1&_unlock=loading1738839992072&_=1738839991987)
[06-Feb-2025 12:06:31 +0100]: <v22nklag> PHP Error: Array
(
    [provider] =>
    [auth_uri] =>
    [token_uri] =>
    [client_id] =>
    [client_secret] =>
    [identity_uri] =>
    [identity_fields] => Array
        (
            [0] => email
        )

    [scope] =>
    [verify_peer] => 1
    [auth_parameters] => Array
        (
        )

    [login_redirect] =>
)
 (GET /?_task=mail&_action=getunread&_page=1&_remote=1&_unlock=0&_=1738839991988)
[06-Feb-2025 12:06:31 +0100]: <v22nklag> PHP Error: /var/lib/roundcube/plugins/managesieve/config.inc.php - true (GET /?_task=mail&_action=getunread&_page=1&_remote=1&_unlock=0&_=1738839991988)
[06-Feb-2025 12:06:31 +0100]: <v22nklag> PHP Error: /var/lib/roundcube/plugins/sieverules/config.inc.php - true (GET /?_task=mail&_action=getunread&_page=1&_remote=1&_unlock=0&_=1738839991988)
[06-Feb-2025 12:06:31 +0100]: <v22nklag> PHP Error: /var/lib/roundcube/plugins/zipdownload/config.inc.php - true (GET /?_task=mail&_action=getunread&_page=1&_remote=1&_unlock=0&_=1738839991988)
[06-Feb-2025 12:06:33 +0100]: PHP Error: defaults.inc.php - true (GET /?_task=logout&_token=M8iMLUSoHd1k6MPHByGnOm403cEcwDyW)
[06-Feb-2025 12:06:33 +0100]: PHP Error: config.inc.php - true (GET /?_task=logout&_token=M8iMLUSoHd1k6MPHByGnOm403cEcwDyW)
[06-Feb-2025 12:06:33 +0100]: PHP Error: mysecondmaildomain_tld_node1_conf.inc.php - true (GET /?_task=logout&_token=M8iMLUSoHd1k6MPHByGnOm403cEcwDyW)
[06-Feb-2025 12:06:33 +0100]: <v22nklag> PHP Error: Array
(
    [provider] =>
    [auth_uri] =>
    [token_uri] =>
    [client_id] =>
    [client_secret] =>
    [identity_uri] =>
    [identity_fields] => Array
        (
            [0] => email
        )

    [scope] =>
    [verify_peer] => 1
    [auth_parameters] => Array
        (
        )

    [login_redirect] =>
)
 (GET /?_task=logout&_token=M8iMLUSoHd1k6MPHByGnOm403cEcwDyW)
[06-Feb-2025 12:06:33 +0100]: <v22nklag> PHP Error: /var/lib/roundcube/plugins/jqueryui/config.inc.php - true (GET /?_task=logout&_token=M8iMLUSoHd1k6MPHByGnOm403cEcwDyW)
[06-Feb-2025 12:06:33 +0100]: <v22nklag> PHP Error: /var/lib/roundcube/plugins/password/config.inc.php - true (GET /?_task=logout&_token=M8iMLUSoHd1k6MPHByGnOm403cEcwDyW)
(end of part 1 of the errorlog due to character restriction of the forum)