natureshadow/user_identities_oidc

Populates a user's identities from their userinfo after OAuth/OIDC login

1.0.2 2025-07-07 20:01 UTC

Requires

• php: >=7.3.0
• roundcube/plugin-installer: ~0.3.5

GPL-3.0-or-later

• Tim Frost
• Dominik George

README

This plugin synchronizes mail identities from information provided by the OpenID Connect / OAuth2 provider used for login.

Requirements

The OIDC provider must provide an array of user identity records under some claim, e.g.:

{
  "mail_identities": [
    {
      "name": "Kanga Roo",
      "email": "[e-mail]"
    }
  ]
}

Roundcube configuration

Roundcube must be configured for OAuth2 authentication with a known userinfo_endpoint (either explicitly, or from a discovery document). The OAuth scopes list must contain the scope allowing access to the mail identities claim, which also must be configured:

// Generic OAuth / OIDC configuration
$config['oauth_provider'] = 'generic';  
$config['oauth_provider_name'] = 'example';
$config['oauth_client_id'] = 'xxx';  
$config['oauth_client_secret'] = 'xxx';
$config['oauth_config_uri'] = 'https://example.com/.well-known/openid-configuration';

// Include the scope providing the mail_identities claim
$config['oauth_scope'] = 'openid mail_identities';

// Enable synchronization on login
$config['user_identities_oidc_onlogin'] = true;
$config['user_identities_oidc_claim'] = 'mail_identities';