Using OpenID with Sogo + dovecot / Adding a secondary aud claim to OpenID access tokens

[Henri Mikkonen]

Hi Max,

As you seem to have very limited capabilities to modify the client/RP 
behaviour, one alternative is to customize the request message parsing 
on the OP-side. See OPMessageHandling page [1].

For additional claims within dynamic client registration, check 
profile-specific metadataPolicy option in [2]. You may also exploit the 
property
"idp.oidc.dynreg.defaultMetadataPolicyFile" for defining the file 
containing the policy. Some examples are described here [3].

BR,
Henri.

[1] 
https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3785326593/OPMessageHandling

[2] 
https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376879077/OPDynamicClientRegistration

[3] 
https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/2948497410/OPMetadataPolicies#Policy-Examples

On 12.6.2025 11.16, Max Nuding via users wrote:
> Hi Henri,
> 
> thanks.
> 
> 1. But I don't think I *can* configure SOGO to indicate the IMAP- 
> resource. Its configuration options regarding OpenID are extremely limited.
> 
> 2. Even then, how would I add the audience? We're using dynamic client 
> registration, and "audience" is not one of the allowed parameters of the 
> client registration. Is there another JSON I'm missing?
> 
> Best
> Max
> 
>  > Hi,
>  >
>  > You can configure SoGo to obtain an access token to be targeted to the
>  > IMAP server in addition to the OP itself. The default target in OIDC
>  > sequence is the OP, as access token is used in the userinfo endpoint.
>  >
>  > Three following things are needed:
>  >
>  > 1. Configure SoGo to indicate the IMAP-resource as defined in RFC 8707.
>  > In short, the resource-parameter should have a value equal to the IMAP's
>  > client_id.
>  >
>  > 2. Configure IMAP as SoGo's trusted audience
>  > - In JSON metadata, add audience=<IMAP_client_id> attribute, or check
>  > [1] how to do it in SAML metadata if you use that
>  >
>  > 3. In conf/relying-party.xml, enable OAUTH2.TokenAudience profile either
>  > globally (for shibboleth.DefaultRelyingParty) or at least for the IMAP
>  > client:
>  >
>  >      <util:list id="shibboleth.RelyingPartyOverrides">
>  >          <bean id="IMAPAudience" parent="RelyingPartyByName"
>  > c:relyingPartyIds="<IMAP_CLIENTID>">
>  >              <property name="profileConfigurations">
>  >                  <list>
>  >                      <bean parent="OAUTH2.TokenAudience"
>  > p:encryptionOptional="true" p:accessTokenType="JWT"/>
>  >                  </list>
>  >              </property>
>  >          </bean>
>  >      </util:list>
>  >
>  > BR,
>  > Henri.
> 
> 
> On 12.06.25 08:21, Max Nuding wrote:
>> Hi!
>>
>> We're currently testing out adding OIDC support to our Shibboleth IdP 
>> at version 5.1.4, and the first client we want to test is SoGo, our 
>> webmail interface.
>>
>> SoGo requests an access token and forwards that to out IMAP server 
>> (dovecot 2.3.21), which then uses that token to make a call to /idp/ 
>> profile/oauth2/introspection. This is causing a problem: Shibboleth 
>> IdP is complaining about invalid audiences, because the client that's 
>> using the access token for the introspection endpoint is different 
>> from the client the token was issued to.
>>
>> Is it possible to configure out IdP, so that it addds an additional 
>> client Id to the audience claim?
>>
>> Another option would be, to configure dovecot and SoGo with the same 
>> client id/secret, so that it apears to be the same client. This won't 
>> work, because SoGo insists on using client_secret_post and dovecot 
>> insits on using client_secret_basic, and the IdP verifies that the 
>> used method is the same as the registered one.
>>
>> Is it possible to make an exception for this specific client?
>>
>> Are there any opther options I'm missing?
>>
>> Thanks!
>> Max
>>
>>
> 
>