diff --git a/data/Dockerfiles/nginx/bootstrap.py b/data/Dockerfiles/nginx/bootstrap.py
index 0d24ae9b2..423ceaa44 100644
--- a/data/Dockerfiles/nginx/bootstrap.py
+++ b/data/Dockerfiles/nginx/bootstrap.py
@@ -30,7 +30,7 @@ def prepare_template_vars():
'ADDITIONAL_SERVER_NAMES': os.getenv("ADDITIONAL_SERVER_NAMES", "").replace(',', ' '),
'HTTP_PORT': os.getenv("HTTP_PORT", "80"),
'HTTPS_PORT': os.getenv("HTTPS_PORT", "443"),
- 'SOGOHOST': os.getenv("SOGOHOST", "sogo-mailcow"),
+ 'SOGOHOST': os.getenv("SOGOHOST", os.getenv("IPV4_NETWORK", "172.22.1") + ".248"),
'RSPAMDHOST': os.getenv("RSPAMDHOST", "rspamd-mailcow"),
'PHPFPMHOST': os.getenv("PHPFPMHOST", "php-fpm-mailcow"),
}
diff --git a/data/conf/nginx/sites-default.conf.j2 b/data/conf/nginx/sites-default.conf.j2
index 783723bfc..df78ecce7 100644
--- a/data/conf/nginx/sites-default.conf.j2
+++ b/data/conf/nginx/sites-default.conf.j2
@@ -152,6 +152,10 @@ location ^~ /principals {
return 301 /SOGo/dav;
}
+location @sogo_401redirect {
+ return 302 /user;
+}
+
location /sogo-auth-verify {
internal;
proxy_set_header X-Original-URI $request_uri;
@@ -192,6 +196,7 @@ location ^~ /SOGo {
auth_request_set $user $upstream_http_x_user;
auth_request_set $auth $upstream_http_x_auth;
auth_request_set $auth_type $upstream_http_x_auth_type;
+ error_page 401 = @sogo_401redirect;
proxy_set_header x-webobjects-remote-user "$user";
proxy_set_header Authorization "$auth";
proxy_set_header x-webobjects-auth-type "$auth_type";
@@ -214,6 +219,7 @@ location ^~ /SOGo {
auth_request_set $user $upstream_http_x_user;
auth_request_set $auth $upstream_http_x_auth;
auth_request_set $auth_type $upstream_http_x_auth_type;
+ error_page 401 = @sogo_401redirect;
proxy_set_header x-webobjects-remote-user "$user";
proxy_set_header Authorization "$auth";
proxy_set_header x-webobjects-auth-type "$auth_type";
diff --git a/data/conf/sogo/custom-sogo.js b/data/conf/sogo/custom-sogo.js
index 1070efa40..3b4d6b70f 100644
--- a/data/conf/sogo/custom-sogo.js
+++ b/data/conf/sogo/custom-sogo.js
@@ -1,10 +1,5 @@
// redirect to mailcow login form
document.addEventListener('DOMContentLoaded', function () {
- var loginForm = document.forms.namedItem("loginForm");
- if (loginForm) {
- window.location.href = '/user';
- }
-
angularReady = false;
function observe() {
angularReady = toolbarExists();
diff --git a/data/web/sogo-auth.php b/data/web/sogo-auth.php
index dbc54d7c2..0fd8ef37d 100644
--- a/data/web/sogo-auth.php
+++ b/data/web/sogo-auth.php
@@ -1,61 +1,88 @@
$is_dav, 'eas' => $is_eas));
- if ($login_check === 'user') {
- header("X-User: $username");
- header("X-Auth: Basic ".base64_encode("$username:$password"));
- header("X-Auth-Type: Basic");
- exit;
- } else {
- header('HTTP/1.0 401 Unauthorized');
- echo 'Invalid login';
- exit;
- }
+ $request = "basic-auth";
+} elseif (isset($_GET['login'])) {
+ $request = "admin-login";
+} elseif (isset($_SERVER['HTTP_X_ORIGINAL_URI']) &&
+ strcasecmp(substr($_SERVER['HTTP_X_ORIGINAL_URI'], 0, 6), "/SOGo/") === 0) {
+ $request = "auth-request";
}
-// check permissions and redirect for direct GET ?login=xy requests
-elseif (isset($_GET['login'])) {
- // load prerequisites only when required
- require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/prerequisites.inc.php';
- // check if dual_login is active
- $is_dual = (!empty($_SESSION["dual-login"]["username"])) ? true : false;
- // check permissions (if dual_login is active, deny sso when acl is not given)
- $login = html_entity_decode(rawurldecode($_GET["login"]));
- if (isset($_SESSION['mailcow_cc_role']) &&
- (($_SESSION['acl']['login_as'] == "1" && $ALLOW_ADMIN_EMAIL_LOGIN !== 0) || ($is_dual === false && $login == $_SESSION['mailcow_cc_username']))) {
- if (filter_var($login, FILTER_VALIDATE_EMAIL)) {
- if (user_get_alias_details($login) !== false) {
- // register username in session
+
+
+switch ($request) {
+ case "basic-auth":
+ require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/prerequisites.inc.php';
+
+ $username = $_SERVER['PHP_AUTH_USER'];
+ $password = $_SERVER['PHP_AUTH_PW'];
+ $is_eas = (preg_match('/^(\/SOGo|)\/Microsoft-Server-ActiveSync.*/', $original_uri) === 1);
+ $is_dav = (preg_match('/^(\/SOGo|)\/dav.*/', $original_uri) === 1);
+ $original_uri = isset($_SERVER['HTTP_X_ORIGINAL_URI']) ? $_SERVER['HTTP_X_ORIGINAL_URI'] : '';
+
+ $login_check = check_login($username, $password, array('dav' => $is_dav, 'eas' => $is_eas));
+ if ($login_check === 'user') {
+ setAuthHeaders($username, $password);
+ ob_end_flush();
+ exit;
+ }
+
+ http_response_code(401);
+ ob_end_flush();
+ exit;
+ break;
+ case "admin-login":
+ require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/prerequisites.inc.php';
+
+ $is_dual = (!empty($_SESSION["dual-login"]["username"])) ? true : false;
+ $login = html_entity_decode(rawurldecode($_GET["login"]));
+
+ if (isset($_SESSION['mailcow_cc_role'])) {
+ // Check if login is allowed:
+ // - User has the "login as" ACL
+ // - Admin email login is enabled in mailcow.conf
+ // - Dual login is not active
+ // - The current role is not "user" or dual login role is admin / domainadmin
+ $is_login_allowed = (
+ $_SESSION['acl']['login_as'] == "1" &&
+ $ALLOW_ADMIN_EMAIL_LOGIN !== 0 &&
+ ($_SESSION['mailcow_cc_role'] != "user" || $_SESSION['dual-login']['role'] == "admin" || $_SESSION['dual-login']['role'] == "domainadmin")
+ );
+ if ($is_login_allowed) {
+ // set dual login session
$_SESSION[$session_var_user_allowed][] = $login;
- // set dual login
- if ($_SESSION['acl']['login_as'] == "1" && $ALLOW_ADMIN_EMAIL_LOGIN !== 0 && $is_dual === false && $_SESSION['mailcow_cc_role'] != "user"){
+ if (!$is_dual) {
$_SESSION["dual-login"]["username"] = $_SESSION['mailcow_cc_username'];
$_SESSION["dual-login"]["role"] = $_SESSION['mailcow_cc_role'];
- $_SESSION['mailcow_cc_username'] = $login;
- $_SESSION['mailcow_cc_role'] = "user";
}
+ $_SESSION['mailcow_cc_username'] = $login;
+ $_SESSION['mailcow_cc_role'] = "user";
+
// update sasl logs
$service = ($app_passwd_data['eas'] === true) ? 'EAS' : 'DAV';
$stmt = $pdo->prepare("REPLACE INTO sasl_log (`service`, `app_password`, `username`, `real_rip`) VALUES ('SSO', 0, :username, :remote_addr)");
@@ -63,45 +90,56 @@ elseif (isset($_GET['login'])) {
':username' => $login,
':remote_addr' => ($_SERVER['HTTP_X_REAL_IP'] ?? $_SERVER['REMOTE_ADDR'])
));
+
// redirect to sogo (sogo will get the correct credentials via nginx auth_request
+ http_response_code(200);
header("Location: /SOGo/so/{$login}");
+ ob_end_flush();
exit;
}
}
- }
- header("Location: /");
- exit;
-}
-// only check for admin-login on sogo GUI requests
-elseif (isset($_SERVER['HTTP_X_ORIGINAL_URI']) && strcasecmp(substr($_SERVER['HTTP_X_ORIGINAL_URI'], 0, 9), "/SOGo/so/") === 0) {
- // this is an nginx auth_request call, we check for existing sogo-sso session variables
- session_start();
- // extract email address from "/SOGo/so/user@domain/xy"
- $url_parts = explode("/", $_SERVER['HTTP_X_ORIGINAL_URI']);
- $email_list = array(
- $url_parts[3], // Requested mailbox
+
+ http_response_code(401);
+ header("Location: /");
+ ob_end_flush();
+ exit;
+ break;
+ case "auth-request":
+ session_start();
+
+ $email_list = array(
($_SESSION['mailcow_cc_username'] ?? ''), // Current user
($_SESSION["dual-login"]["username"] ?? ''), // Dual login user
- );
- foreach($email_list as $email) {
- // check if this email is in session allowed list
- if (
+ );
+
+ $url_parts = explode("/", $_SERVER['HTTP_X_ORIGINAL_URI']);
+ if (count($url_parts) >= 4) {
+ array_push($email_list, $url_parts[3]); // Requested user
+ }
+
+ foreach($email_list as $email) {
+ // check if this email is in session allowed list
+ if (
!empty($email) &&
filter_var($email, FILTER_VALIDATE_EMAIL) &&
is_array($_SESSION[$session_var_user_allowed]) &&
in_array($email, $_SESSION[$session_var_user_allowed])
- ) {
- $username = $email;
- $password = file_get_contents("/etc/sogo-sso/sogo-sso.pass");
- header("X-User: $username");
- header("X-Auth: Basic ".base64_encode("$username:$password"));
- header("X-Auth-Type: Basic");
- exit;
+ ) {
+ $password = file_get_contents("/etc/sogo-sso/sogo-sso.pass");
+ setAuthHeaders($email, $password);
+ ob_end_flush();
+ exit;
+ }
}
- }
+
+ http_response_code(401);
+ ob_end_flush();
+ exit;
+ break;
+ default:
+ setAuthHeaders("", "");
+ ob_end_flush();
+ exit;
+ break;
}
-// if username is empty, SOGo will use the normal login methods / login form
-header("X-User: ");
-header("X-Auth: ");
-header("X-Auth-Type: ");
diff --git a/data/web/templates/user/tab-user-auth.twig b/data/web/templates/user/tab-user-auth.twig
index 5c90bedf5..a7e025431 100644
--- a/data/web/templates/user/tab-user-auth.twig
+++ b/data/web/templates/user/tab-user-auth.twig
@@ -20,11 +20,11 @@
{{ lang.user.open_webmail_sso }}
{% elseif dual_login %}
-
+
{{ lang.user.open_webmail_sso }}
{% else %}
-
+
{{ lang.user.open_webmail_sso }}
{% endif %}