PHPackages                             imrasalghul/oidc-cube - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. imrasalghul/oidc-cube

ActiveRoundcube-plugin

imrasalghul/oidc-cube
=====================

Secure OpenID Connect login plugin for Roundcube 1.7

1.0.0(yesterday)001MITPHPPHP >=8.2CI passing

Since Aug 27Pushed yesterdayCompare

[ Source](https://github.com/imrasalghul/oidc-cube)[ Packagist](https://packagist.org/packages/imrasalghul/oidc-cube)[ Docs](https://alghul.com)[ RSS](/packages/imrasalghul-oidc-cube/feed)WikiDiscussions master Synced today

READMEChangelog (1)Dependencies (5)Versions (2)Used By (0)

OIDC-cube
=========

[](#oidc-cube)

*OpenID Connect and passkey login for Roundcube 1.7.3*

---

OIDC-cube provides OpenID Connect login, locally encrypted IMAP credential storage, and WebAuthn passkey login for Roundcube 1.7.3. It is designed for deployments where an external identity provider authenticates a mailbox user while IMAP continues to require a password.

Maintained by [Ra's al Ghul](https://alghul.com).

Features
--------

[](#features)

- OpenID Connect Authorization Code flow with PKCE, discovery, state, and nonce validation
- Strict issuer, audience, authorized-party, signature-algorithm, and time-claim validation
- First-login IMAP password capture on the Roundcube login page; no mailbox password is sent to the identity provider
- AES-256-GCM encryption for stored IMAP credentials
- Passwordless WebAuthn login using discoverable credentials and required user verification
- RP-initiated logout support
- MySQL/MariaDB, PostgreSQL, and SQLite schema files

Requirements
------------

[](#requirements)

- Roundcube 1.7.3
- PHP 8.2 or newer with cURL, JSON, OpenSSL, and mbstring
- An OpenID Connect provider supporting discovery, Authorization Code flow, and PKCE `S256`
- HTTPS for Roundcube, the issuer, registered redirect URIs, and optional logout URI
- MySQL/MariaDB, PostgreSQL, or SQLite

Installation
------------

[](#installation)

Install the plugin in the Roundcube plugin directory and install its Composer dependencies:

```
composer require imrasalghul/oidc-cube
```

Enable `roundcube_oidc` in Roundcube's `plugins` configuration. Create the credential and passkey tables using the database-specific schema:

```
mysql roundcube