src-advisory/SRCmail
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add OAuth2/OIDC with PKCE for SSO login

Browse Source 
Add opt-in SSO authentication alongside Basic Auth. OAuth endpoints are
auto-discovered via .well-known, with support for external IdPs
(Keycloak, Authentik) via configurable OAUTH_ISSUER_URL. Sessions
persist through httpOnly refresh token cookies with automatic renewal.
This commit is contained in:
Matthieu MALVACHE
2026-02-25 23:41:37 +01:00
committed by Matthieu MALVACHE
parent 110dd98ad4
commit ec06b0c494
20 changed files with 857 additions and 92 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ROADMAP.md
+3 -1
View File
@@ -18,6 +18,8 @@ This document tracks the development status and planned features for JMAP Webmai
- [x] Authentication error handling
- [x] JMAP identities for sender address
- [x] TOTP two-factor authentication (Stalwart-compatible)
- [x] OAuth2/OIDC with PKCE (opt-in SSO, session persistence via httpOnly refresh tokens)
- [x] External IdP support via explicit issuer URL (Keycloak, Authentik, etc.)
### JMAP Server Connection
- [x] Session establishment and keep-alive
@@ -235,7 +237,7 @@ This document tracks the development status and planned features for JMAP Webmai
- [ ] Free/busy queries (Principal/getAvailability)
- [ ] Calendar sharing UI (JMAP Sharing RFC 9670)
- [ ] Email encryption (PGP/GPG)
- [ ] OAuth2/OIDC authentication (opt-in, Basic Auth remains default)
- [ ] OAuth2 token introspection and userinfo endpoint support
### Performance Optimizations
- [ ] Email content caching