Using OpenID with Sogo + dovecot / Adding a secondary aud claim to OpenID access tokens

[Henri Mikkonen]

Hi,

You can configure SoGo to obtain an access token to be targeted to the 
IMAP server in addition to the OP itself. The default target in OIDC 
sequence is the OP, as access token is used in the userinfo endpoint.

Three following things are needed:

1. Configure SoGo to indicate the IMAP-resource as defined in RFC 8707. 
In short, the resource-parameter should have a value equal to the IMAP's 
client_id.

2. Configure IMAP as SoGo's trusted audience
- In JSON metadata, add audience=<IMAP_client_id> attribute, or check 
[1] how to do it in SAML metadata if you use that

3. In conf/relying-party.xml, enable OAUTH2.TokenAudience profile either 
globally (for shibboleth.DefaultRelyingParty) or at least for the IMAP 
client:

     <util:list id="shibboleth.RelyingPartyOverrides">
         <bean id="IMAPAudience" parent="RelyingPartyByName" 
c:relyingPartyIds="<IMAP_CLIENTID>">
             <property name="profileConfigurations">
                 <list>
                     <bean parent="OAUTH2.TokenAudience" 
p:encryptionOptional="true" p:accessTokenType="JWT"/>
                 </list>
             </property>
         </bean>
     </util:list>

BR,
Henri.

[1] 
https://shibboleth.atlassian.net/wiki/spaces/SC/pages/1912406916/OAuthRPMetadataProfile

On 12.6.2025 9.21, Max Nuding via users wrote:
> Hi!
> 
> We're currently testing out adding OIDC support to our Shibboleth IdP at 
> version 5.1.4, and the first client we want to test is SoGo, our webmail 
> interface.
> 
> SoGo requests an access token and forwards that to out IMAP server 
> (dovecot 2.3.21), which then uses that token to make a call to /idp/ 
> profile/oauth2/introspection. This is causing a problem: Shibboleth IdP 
> is complaining about invalid audiences, because the client that's using 
> the access token for the introspection endpoint is different from the 
> client the token was issued to.
> 
> Is it possible to configure out IdP, so that it addds an additional 
> client Id to the audience claim?
> 
> Another option would be, to configure dovecot and SoGo with the same 
> client id/secret, so that it apears to be the same client. This won't 
> work, because SoGo insists on using client_secret_post and dovecot 
> insits on using client_secret_basic, and the IdP verifies that the used 
> method is the same as the registered one.
> 
> Is it possible to make an exception for this specific client?
> 
> Are there any opther options I'm missing?
> 
> Thanks!
> Max
> 
> 
>