jcoffey-dev
cdd8fabff9
The server's own page asks for the username, so with a single server the sign-in page keeps only the own-device choice. With several servers the address still comes first, since its domain picks the server. One new string, in all nine catalogues.
2.4 KiB
ihasmail-inbuxa
This is ihasmail for INBUXA's mail server. Public ihasmail stays
Stalwart-facing; everything specific to INBUXA lives here until one product
can serve both. The contract between the two is docs/spec/contract.md in
the inbuxa-server repository.
Public ihasmail is the remote ihasmail, fetch-only. Merge its main in to
keep up. Nothing here is pushed there.
What's different
- Sign-in happens on the mail server's own page (contract C-8, C-10).
ihasmail sends the browser there and gets OAuth tokens back, so it never
handles a password to sign someone in. Two-factor codes are asked for on
that page. Sessions hold sealed tokens and renew them before they expire. A
password change revokes the tokens, so it signs the person out everywhere,
this session included. With one mail server (no
STALWART_SERVERS_FILE, or one whose domains all map toSTALWART_URL), the sign-in page asks for no address: only whether this is the person's own device, then the server's page takes it from there. With several servers, the address comes first, since its domain picks the server. - Tenants are offered on every server, whatever edition it reports.
SHOW_ENTERPRISE_NOTICESstill adds the notice for an upstream Stalwart.
Configuration
Server sign-in is on when OAUTH_CLIENT_SECRET is set. Without it,
ihasmail-inbuxa keeps public ihasmail's password form.
| Variable | Meaning |
|---|---|
OAUTH_CLIENT_SECRET |
The secret of the confidential client the mail server registers for this webmail. On INBUXA, the same value as the server's INBUXA_WEBMAIL_CLIENT_SECRET. |
OAUTH_CLIENT_ID |
The client's id. Default ihasmail-inbuxa, which is what INBUXA registers. |
PUBLIC_URL |
Where browsers reach ihasmail, without BASE_PATH. Required with OAUTH_CLIENT_SECRET. The redirect URI is PUBLIC_URL + BASE_PATH + /api/auth/callback, and must match the server's INBUXA_WEBMAIL_URL + /api/auth/callback exactly. |
On the INBUXA server, set INBUXA_WEBMAIL_URL to ihasmail's address (with
BASE_PATH, if any) and INBUXA_WEBMAIL_CLIENT_SECRET to the shared secret.
The server registers the client on start and allows ihasmail's origin for
cross-origin requests.
For local development, npm run dev:mock works as before. The mock also
answers OAuth: start it and ihasmail with OAUTH_CLIENT_SECRET=mock-oauth-secret
and a PUBLIC_URL, and its sign-in page approves the demo user at once.