Roundcube: sign in with ns8-idp #8263

Roundcube webmail users must type their password in the webmail login page. With single sign-on they open the webmail without typing the password again, and Roundcube reads the mailbox on their behalf with the sign-in token instead of a password.

Proposed solution

• In the Roundcube application settings, select an OIDC provider among those available in the cluster. The option is hidden if no provider is installed.
• The administrator can decide not to use single sign-on, even if a provider is installed: the default is no provider, and users keep signing in with their password.
• Register the Roundcube client with register-client, adding the client of the bound Mail application to the token audience, because the mail server accepts only tokens that list it.
• Configure the Roundcube OAuth2 login, and use the token to authenticate to IMAP and SMTP (XOAUTH2 / OAUTHBEARER).
• Keep the configuration up to date on service-oidc-changed events, and remove it when the provider is removed.
• If the realm accepts only federated logins, send users straight to the provider, and document the emergency login path.

Alternative solutions

• Sign in with OIDC, then access the mailbox with a master user: simpler, but grants Roundcube access to every mailbox, which is not acceptable.

Additional context

Depends on #8264.

See also

• Parent: Single sign-on for applications with ns8-idp #8258
• Roundcube OAuth2 configuration: https://github.com/roundcube/roundcubemail/wiki/Configuration:-OAuth2
• https://github.com/NethServer/ns8-roundcubemail