feat: enforce strict OIDC email binding by default and improve admin UX

Author: bjoernch

.env.example

@@ -20,6 +20,7 @@ OIDC_CLIENT_SECRET=
 OIDC_REDIRECT_URI=http://localhost:8080/plugins/universal_oidc_mail_sso/callback_bridge.php
 OIDC_POST_LOGOUT_REDIRECT_URI=http://localhost:8080/
 ALLOWED_EMAIL_DOMAIN=
+ALLOW_CUSTOM_MAILBOX_EMAIL=false
 
 # 32 random bytes base64; generate with:
 # openssl rand -base64 32

docker-compose.yml

@@ -44,6 +44,7 @@ services:
       OIDC_POST_LOGOUT_REDIRECT_URI: ${OIDC_POST_LOGOUT_REDIRECT_URI}
       OIDC_SCOPES: ${OIDC_SCOPES}
       ALLOWED_EMAIL_DOMAIN: ${ALLOWED_EMAIL_DOMAIN}
+      ALLOW_CUSTOM_MAILBOX_EMAIL: ${ALLOW_CUSTOM_MAILBOX_EMAIL}
       ADMIN_GROUP_NAME: ${ADMIN_GROUP_NAME}
       ADMIN_EMAILS: ${ADMIN_EMAILS}
       RCUBE_MAILBOX_KEY: ${RCUBE_MAILBOX_KEY}

plugins/universal_oidc_mail_sso/README.md

@@ -11,6 +11,9 @@ Roundcube plugin for:
 - OIDC discovery from `OIDC_ISSUER`
 - PKCE (`S256`) + `state` + `nonce`
 - ID token validation via JWKS (`RS256`)
+- Strong identity binding by default:
+  - mailbox email is locked to the verified OIDC `email` claim
+  - admins can optionally allow custom mailbox email overrides
 - Required claim mapping:
   - stable user id: `sub`
   - email/login id: `email` (required)
@@ -25,6 +28,11 @@ Roundcube plugin for:
 - Built-in IMAP/SMTP credential test before saving profile
 - Audit log table for authentication/provisioning events
 - Admin dashboard for mapped accounts + audit history (restricted by OIDC group)
+- Admin controls for lifecycle/security:
+  - enable/disable mapped users
+  - delete mapped users
+  - restrict allowed email domains and IMAP/SMTP hosts
+  - toggle strict OIDC-email binding policy
 - Session-based setup form throttle + CSRF protection
 - Reverse proxy aware redirect URI construction (`X-Forwarded-Proto`, `X-Forwarded-Host`, `FORCE_HTTPS`)
 
@@ -60,6 +68,7 @@ Optional:
 - `OIDC_REDIRECT_URI` (if omitted, plugin computes from request/proxy headers)
 - `OIDC_POST_LOGOUT_REDIRECT_URI`
 - `ALLOWED_EMAIL_DOMAIN` (optional; empty or `*` allows all domains)
+- `ALLOW_CUSTOM_MAILBOX_EMAIL=false` (default strict binding to OIDC email)
 - `FORCE_HTTPS=true`
 - `DISABLE_PASSWORD_LOGIN=true`
 - `ADMIN_GROUP_NAME=webmail_admin`
@@ -184,6 +193,7 @@ Covers:
 - Decrypted credentials are used only in memory at auth/connect time.
 - Logs intentionally avoid secrets/tokens/passwords.
 - Missing claim/domain mismatch/missing mailbox/decrypt failures fail closed.
+- Mailbox email binding is strict by default (OIDC `email` must match setup email).
 - CSRF token enforced on connect form submission.
 - Basic session-based rate limit applied to setup submissions.
 

plugins/universal_oidc_mail_sso/config.inc.php.dist

@@ -8,6 +8,7 @@ $config['universal_oidc_mail_sso_redirect_uri'] = getenv('OIDC_REDIRECT_URI') ?:
 $config['universal_oidc_mail_sso_post_logout_redirect_uri'] = getenv('OIDC_POST_LOGOUT_REDIRECT_URI') ?: null;
 $config['universal_oidc_mail_sso_scopes'] = getenv('OIDC_SCOPES') ?: 'openid email profile groups';
 $config['universal_oidc_mail_sso_allowed_email_domain'] = getenv('ALLOWED_EMAIL_DOMAIN') ?: '';
+$config['universal_oidc_mail_sso_allow_custom_mailbox_email'] = getenv('ALLOW_CUSTOM_MAILBOX_EMAIL') ?: false;
 
 // Security / behavior
 $config['universal_oidc_mail_sso_mailbox_key'] = getenv('RCUBE_MAILBOX_KEY') ?: '';

plugins/universal_oidc_mail_sso/skins/elastic/templates/admin_dashboard.html

@@ -14,6 +14,8 @@
     th, td { border:1px solid #d8e0ea; padding:6px 8px; text-align:left; vertical-align:top; }
     th { background:#f6f8fb; }
     .hint { color:#5d6c7c; font-size:12px; margin-top:8px; }
+    .info { margin-top:10px; background:#f2f7ff; border:1px solid #bcd3ff; border-radius:8px; padding:10px 12px; }
+    .info ul { margin:8px 0 0 18px; padding:0; color:#2f4760; font-size:13px; }
     label { display:block; font-size:13px; font-weight:600; margin:0 0 6px; }
     input { width:100%; box-sizing:border-box; padding:8px 10px; border:1px solid #c5cfda; border-radius:8px; font-size:13px; margin-bottom:8px; }
     button { background:#0b5fff; color:#fff; border:none; border-radius:8px; padding:10px 14px; font-size:13px; cursor:pointer; }
@@ -25,6 +27,15 @@
     <section class="card">
       <h1>SSO Admin Dashboard</h1>
       <div class="hint">Access is restricted to users in the <code>webmail_admin</code> group (configurable).</div>
+      <div class="info">
+        <strong>Universal OIDC Mail SSO capabilities</strong>
+        <ul>
+          <li>OIDC login with automatic mailbox profile mapping.</li>
+          <li>Strict email identity binding by default (OIDC email only).</li>
+          <li>Central policy controls for allowed email domains and IMAP/SMTP hosts.</li>
+          <li>Audit trail and account lifecycle actions (disable/delete mappings).</li>
+        </ul>
+      </div>
     </section>
 
     <section class="card">
@@ -41,6 +52,8 @@ <h2>Access Policies</h2>
         <label for="allowed_smtp_hosts">Allowed SMTP hosts (comma-separated, `*` = any)</label>
         <input id="allowed_smtp_hosts" name="allowed_smtp_hosts" type="text" value="{{allowed_smtp_hosts}}" placeholder="smtp.example.com,mail.example.org">
 
+        <label><input type="checkbox" name="allow_custom_mailbox_email" value="1" {{allow_custom_mailbox_email_checked}}> Allow users to override mailbox email (default: disabled/strict OIDC email binding)</label>
+
         <button type="submit">Save Policies</button>
       </form>
       <div class="hint">These policies are enforced on setup and SSO autologin.</div>

plugins/universal_oidc_mail_sso/skins/elastic/templates/connect_mailbox.html

@@ -19,21 +19,32 @@
     .pizsso-success { background:#e9f9ef; border:1px solid #8ed6a4; color:#0f5f2b; border-radius:8px; padding:10px 12px; margin:0 0 14px; }
     .actions { display:flex; gap:10px; margin-top:16px; flex-wrap:wrap; }
     .actions button.secondary { background:#fff; color:#0b5fff; border:1px solid #8fb4ff; }
+    .info { margin:0 0 14px; background:#f2f7ff; border:1px solid #bcd3ff; border-radius:8px; padding:10px 12px; }
+    .info ul { margin:8px 0 0 18px; padding:0; color:#2f4760; font-size:13px; }
     @media (max-width: 720px) { .card { margin:20px 12px; } .grid { grid-template-columns:1fr; } }
   </style>
 </head>
 <body>
   <main class="card">
     <h1>Connect account</h1>
     <p>Enter your mailbox password (or app-password) once. It will be encrypted and reused for automatic login.</p>
+    <div class="info">
+      <strong>Why this setup is secure and convenient</strong>
+      <ul>
+        <li>By default, your mailbox email is locked to your verified OIDC email.</li>
+        <li>Your mailbox password is encrypted before it is stored.</li>
+        <li>After setup, login is passwordless through your OIDC provider.</li>
+      </ul>
+    </div>
     {{message}}
     <form method="post" action="{{form_action}}">
       <input type="hidden" name="_token" value="{{csrf_token}}">
 
       <div class="grid">
         <div class="full">
           <label for="email">Email</label>
-          <input id="email" name="email" type="email" required value="{{email}}">
+          <input id="email" name="email" type="email" required value="{{email}}" {{email_readonly_attr}}>
+          {{email_policy_hint}}
         </div>
 
         <div class="full">
@@ -91,7 +102,7 @@ <h1>Connect account</h1>
         <button class="secondary" type="submit" name="intent" value="test">Test connection</button>
         <button type="submit" name="intent" value="save">Save and continue</button>
       </div>
-      <div class="hint">No plaintext passwords are stored in the database.</div>
+      <div class="hint">Admins can review mappings and enforce domain/host restrictions in the SSO admin dashboard.</div>
     </form>
   </main>
 </body>

plugins/universal_oidc_mail_sso/universal_oidc_mail_sso.php

@@ -71,11 +71,27 @@ public function init(): void
 
     public function startup(array $args): array
     {
+        $action = rcube_utils::get_input_value('_action', rcube_utils::INPUT_GPC);
+
+        // If admin plugin endpoints are accessed directly without a Roundcube
+        // session, start OIDC login flow instead of failing with access errors.
+        if ($this->rc->task === 'settings'
+            && is_string($action)
+            && in_array($action, [
+                self::ACTION_ADMIN,
+                self::ACTION_ADMIN_SAVE_POLICY,
+                self::ACTION_ADMIN_DELETE_USER,
+                self::ACTION_ADMIN_SET_USER_STATUS,
+            ], true)
+            && empty($_SESSION['user_id'])
+        ) {
+            $this->redirectTo($this->urlForAction(self::ACTION_LOGIN));
+        }
+
         if ($this->rc->task !== 'login' || !empty($_SESSION['user_id'])) {
             return $args;
         }
 
-        $action = rcube_utils::get_input_value('_action', rcube_utils::INPUT_GPC);
         if (is_string($action) && strpos($action, 'plugin.universal_oidc_mail_sso_') === 0) {
             // Fallback direct dispatcher for environments where register_action
             // doesn't route plugin actions in login task as expected.
@@ -461,7 +477,7 @@ public function actionSaveMailbox(): void
             return;
         }
 
-        if ($email !== strtolower((string) $oidcEmail)) {
+        if ($this->isStrictOidcEmailBinding() && $email !== strtolower((string) $oidcEmail)) {
             $this->renderConnectMailboxPage('Email must match your OIDC account.');
             return;
         }
@@ -577,12 +593,17 @@ private function renderConnectMailboxPage(string $message, bool $isError = true,
         $imapSecurity = (string) ($values['imap_security'] ?? $this->cfg('default_imap_security', 'ssl'));
         $smtpSecurity = (string) ($values['smtp_security'] ?? $this->cfg('default_smtp_security', 'tls'));
         $smtpAuthChecked = (string) ($values['smtp_auth'] ?? (((string) $this->cfg('default_smtp_auth', '1') !== '0') ? '1' : '0'));
+        $strictEmailBinding = $this->isStrictOidcEmailBinding();
 
         $replacements = [
             '{{form_action}}' => htmlspecialchars($this->rc->url(['task' => 'login', 'action' => self::ACTION_SAVE_MAILBOX]), ENT_QUOTES, 'UTF-8'),
             '{{csrf_token}}' => htmlspecialchars(rcmail::get_instance()->get_request_token(), ENT_QUOTES, 'UTF-8'),
             '{{message}}' => $message !== '' ? '<div class="' . ($isError ? 'pizsso-error' : 'pizsso-success') . '">' . htmlspecialchars($message, ENT_QUOTES, 'UTF-8') . '</div>' : '',
             '{{email}}' => htmlspecialchars($email, ENT_QUOTES, 'UTF-8'),
+            '{{email_readonly_attr}}' => $strictEmailBinding ? 'readonly' : '',
+            '{{email_policy_hint}}' => $strictEmailBinding
+                ? '<div class="hint">Email is locked to your verified OIDC account by admin policy.</div>'
+                : '<div class="hint">Admin policy allows overriding mailbox email.</div>',
             '{{imap_host}}' => htmlspecialchars((string) ($values['imap_host'] ?? $this->cfg('default_imap_host', 'imap.example.com')), ENT_QUOTES, 'UTF-8'),
             '{{imap_port}}' => htmlspecialchars((string) ($values['imap_port'] ?? $this->cfg('default_imap_port', '993')), ENT_QUOTES, 'UTF-8'),
             '{{imap_security_ssl_selected}}' => ($imapSecurity === 'ssl') ? 'selected' : '',
@@ -700,6 +721,7 @@ private function getPolicies(): array
             'allowed_email_domains',
             'allowed_imap_hosts',
             'allowed_smtp_hosts',
+            'allow_custom_mailbox_email',
         ]);
 
         return $this->policyCache;
@@ -913,6 +935,18 @@ private function isAdminUser(): bool
         return false;
     }
 
+    private function isStrictOidcEmailBinding(): bool
+    {
+        $policies = $this->getPolicies();
+        $policyVal = strtolower(trim((string) ($policies['allow_custom_mailbox_email'] ?? '')));
+        if ($policyVal !== '') {
+            return !in_array($policyVal, ['1', 'true', 'yes', 'on'], true);
+        }
+
+        // Strict by default unless explicitly disabled.
+        return !$this->cfgBool('allow_custom_mailbox_email', false);
+    }
+
     public function actionAdminDashboard(): void
     {
         if ($this->rc->task !== 'settings') {
@@ -993,6 +1027,10 @@ public function actionAdminDashboard(): void
             '{{allowed_domains}}' => htmlspecialchars((string) ($policies['allowed_email_domains'] ?? ''), ENT_QUOTES, 'UTF-8'),
             '{{allowed_imap_hosts}}' => htmlspecialchars((string) ($policies['allowed_imap_hosts'] ?? ''), ENT_QUOTES, 'UTF-8'),
             '{{allowed_smtp_hosts}}' => htmlspecialchars((string) ($policies['allowed_smtp_hosts'] ?? ''), ENT_QUOTES, 'UTF-8'),
+            '{{allow_custom_mailbox_email_checked}}' => !empty($policies['allow_custom_mailbox_email'])
+                && in_array(strtolower((string) $policies['allow_custom_mailbox_email']), ['1', 'true', 'yes', 'on'], true)
+                ? 'checked'
+                : '',
         ]);
 
         header('Content-Type: text/html; charset=UTF-8');
@@ -1015,10 +1053,12 @@ public function actionAdminSavePolicy(): void
         $allowedDomains = trim((string) rcube_utils::get_input_value('allowed_email_domains', rcube_utils::INPUT_POST));
         $allowedImapHosts = trim((string) rcube_utils::get_input_value('allowed_imap_hosts', rcube_utils::INPUT_POST));
         $allowedSmtpHosts = trim((string) rcube_utils::get_input_value('allowed_smtp_hosts', rcube_utils::INPUT_POST));
+        $allowCustomMailboxEmail = rcube_utils::get_input_value('allow_custom_mailbox_email', rcube_utils::INPUT_POST) ? '1' : '0';
 
         $this->storage->setPolicy('allowed_email_domains', $allowedDomains);
         $this->storage->setPolicy('allowed_imap_hosts', $allowedImapHosts);
         $this->storage->setPolicy('allowed_smtp_hosts', $allowedSmtpHosts);
+        $this->storage->setPolicy('allow_custom_mailbox_email', $allowCustomMailboxEmail);
         $this->policyCache = null;
 
         $this->audit('admin_policy', 'ok', 'policy updated');
@@ -1163,6 +1203,7 @@ private function cfg(string $name, ?string $default = null): ?string
             'redirect_uri' => 'OIDC_REDIRECT_URI',
             'post_logout_redirect_uri' => 'OIDC_POST_LOGOUT_REDIRECT_URI',
             'allowed_email_domain' => 'ALLOWED_EMAIL_DOMAIN',
+            'allow_custom_mailbox_email' => 'ALLOW_CUSTOM_MAILBOX_EMAIL',
             'mailbox_key' => 'RCUBE_MAILBOX_KEY',
             'force_https' => 'FORCE_HTTPS',
             'disable_password_login' => 'DISABLE_PASSWORD_LOGIN',