Using OpenID with Sogo + dovecot / Adding a secondary aud claim to OpenID access tokens

[Max Nuding]

Hi Henri,

thanks.

1. But I don't think I *can* configure SOGO to indicate the 
IMAP-resource. Its configuration options regarding OpenID are extremely 
limited.

2. Even then, how would I add the audience? We're using dynamic client 
registration, and "audience" is not one of the allowed parameters of the 
client registration. Is there another JSON I'm missing?

Best
Max

 > Hi,
 >
 > You can configure SoGo to obtain an access token to be targeted to the
 > IMAP server in addition to the OP itself. The default target in OIDC
 > sequence is the OP, as access token is used in the userinfo endpoint.
 >
 > Three following things are needed:
 >
 > 1. Configure SoGo to indicate the IMAP-resource as defined in RFC 8707.
 > In short, the resource-parameter should have a value equal to the IMAP's
 > client_id.
 >
 > 2. Configure IMAP as SoGo's trusted audience
 > - In JSON metadata, add audience=<IMAP_client_id> attribute, or check
 > [1] how to do it in SAML metadata if you use that
 >
 > 3. In conf/relying-party.xml, enable OAUTH2.TokenAudience profile either
 > globally (for shibboleth.DefaultRelyingParty) or at least for the IMAP
 > client:
 >
 >      <util:list id="shibboleth.RelyingPartyOverrides">
 >          <bean id="IMAPAudience" parent="RelyingPartyByName"
 > c:relyingPartyIds="<IMAP_CLIENTID>">
 >              <property name="profileConfigurations">
 >                  <list>
 >                      <bean parent="OAUTH2.TokenAudience"
 > p:encryptionOptional="true" p:accessTokenType="JWT"/>
 >                  </list>
 >              </property>
 >          </bean>
 >      </util:list>
 >
 > BR,
 > Henri.


On 12.06.25 08:21, Max Nuding wrote:
> Hi!
> 
> We're currently testing out adding OIDC support to our Shibboleth IdP at 
> version 5.1.4, and the first client we want to test is SoGo, our webmail 
> interface.
> 
> SoGo requests an access token and forwards that to out IMAP server 
> (dovecot 2.3.21), which then uses that token to make a call to /idp/ 
> profile/oauth2/introspection. This is causing a problem: Shibboleth IdP 
> is complaining about invalid audiences, because the client that's using 
> the access token for the introspection endpoint is different from the 
> client the token was issued to.
> 
> Is it possible to configure out IdP, so that it addds an additional 
> client Id to the audience claim?
> 
> Another option would be, to configure dovecot and SoGo with the same 
> client id/secret, so that it apears to be the same client. This won't 
> work, because SoGo insists on using client_secret_post and dovecot 
> insits on using client_secret_basic, and the IdP verifies that the used 
> method is the same as the registered one.
> 
> Is it possible to make an exception for this specific client?
> 
> Are there any opther options I'm missing?
> 
> Thanks!
> Max
> 
> 

-- 
Herr Max Nuding
Softwareentwickler / Abt. IT-Dienste für Forschung und Lehre
Kommunikations-, Informations-, Medienzentrum (KIM)
Universität Konstanz
78457 Konstanz
Tel.: +49.7531.88-4658
Raum: B 707

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5056 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://shibboleth.net/pipermail/users/attachments/20250612/a183df1b/attachment.p7s>