Dovecot Proxy with mysql passdb and oauth2 authentication: upgrade from 2.3.21 to 2.4.3 does not work

7 Apr 2026


      Hi,
I am running a Dovecot IMAP/POP3 proxy in my test environment using the latest version, 2.3.21, installed from the Dovecot repository.
It functions as a pure IMAP/POP3 proxy for 7 different IMAP backends (currently always Dovecot 2.3.21).
The proxy retrieves all its information from a MySQL database mainly the ip-address to which backend he should pass the connection and forwards all
authentication information to the backend. This has always worked without any issues so far.
Now I'm trying to upgrade the proxy from 2.3.21 to 2.4.3.
I tried to convert my 2.3.21 configuration to 2.4.3 with your very helpfull tool from https://dovecot.org/upgrader/.
But now when I try to start dovecot I get the followong error in my logs:
...
2026-04-07T12:00:57.692994+02:00 imap-dev dovecot: auth: Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth
2026-04-07T12:00:57.695908+02:00 imap-dev dovecot: auth: Debug: Module loaded: /usr/lib/dovecot/modules/auth/libdriver_mysql.so
2026-04-07T12:00:57.696532+02:00 imap-dev dovecot: auth: Fatal: Cannot initialize oauth2: Missing oauth2_introspection_mode setting
2026-04-07T12:00:57.697569+02:00 imap-dev dovecot: master: Error: service(auth): command startup failed, throttling for 4.000 secs
...
As I just said, the server only works as a proxy (no mailboxes hosted on itself, etc).
Have you any idea how I can solve this issues?
Below my current .deb packages installed and "doveconf -n" from 2.4.3.
Many thanks in advance
Urban

dpkg -l |grep dovecot
ii  dovecot-core                  2:2.4.3-1+debian12             amd64        secure POP3/IMAP server - core files
ii  dovecot-imapd                 2:2.4.3-1+debian12             amd64        secure POP3/IMAP server - IMAP daemon
ii  dovecot-ldap                  2:2.4.3-1+debian12             amd64        secure POP3/IMAP server - LDAP support
ii  dovecot-lmtpd                 2:2.4.3-1+debian12             amd64        secure POP3/IMAP server - LMTP server
ii  dovecot-managesieved          2:2.4.3-1+debian12             amd64        secure POP3/IMAP server - ManageSieve server
ii  dovecot-mysql                 2:2.4.3-1+debian12             amd64        secure POP3/IMAP server - MySQL support
ii  dovecot-pop3d                 2:2.4.3-1+debian12             amd64        secure POP3/IMAP server - POP3 daemon
ii  dovecot-sieve                 2:2.4.3-1+debian12             amd64        secure POP3/IMAP server - Sieve filters support
2.4.3-1+debian12 (c1b22ef978): /etc/dovecot/dovecot.conf
Pigeonhole version 2.4.3-1+debian12 (99939e07)
OS: Linux 6.1.0-31-amd64 x86_64 Debian 12.13
Hostname: imap-dev.domain.com
dovecot_config_version = 2.4.3
auth_cache_negative_ttl = 0
auth_cache_size = 128 M
auth_cache_ttl = 0
auth_debug = yes
auth_debug_passwords = yes
auth_failure_delay = 5 secs
auth_mechanisms = plain login oauthbearer xoauth2
auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_%@
auth_username_translation = %@
dovecot_storage_version = 2.4.0
login_log_format_elements = user=<%{user}> method=%{mechanism} rip=%{remote_ip} lip=%{local_ip} mpid=%{mail_pid} %{secured} %{ssl_security}
managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags
copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext
protocols = imap sieve
sql_driver = mysql
ssl_min_protocol = TLSv1
verbose_proctitle = yes
namespace inbox {
inbox = yes
mailbox Drafts {
special_use = "\\Drafts"
}
mailbox Junk {
special_use = "\\Junk"
}
mailbox Sent {
special_use = "\\Sent"
}
mailbox "Sent Messages" {
special_use = "\\Sent"
}
mailbox Trash {
special_use = "\\Trash"
}
}
passdb sql {
default_password_scheme = PLAIN
query = SELECT NULL AS password, 'y' AS nodb, SUBSTRING_INDEX(SUBSTRING_INDEX(param, '[', -1), ']', 1) AS host, '%{user}' AS destuser, 'Y' AS
nologin, 'Y' AS nopassword, 'Y' AS proxy, '%{mechanism}' AS proxy_mech FROM mail_username WHERE user = '%{user}' AND allow_login = 'y' AND
('%{protocol}' = 'imap' OR '%{protocol}' = 'sieve');
}
mysql devdb1.domain.com {
dbname = mailconfig_dev
password = # hidden, use -P to show it
user = imap-dev
}
sieve_script personal {
driver = file
path = ~/sieve
}
service imap-login {
process_min_avail = 2
restart_request_count = unlimited
vsz_limit = 512 M
}
service managesieve-login {
inet_listener sieve {
port = 4190
}
}
service pop3-login {
process_min_avail = 2
restart_request_count = unlimited
vsz_limit = 256 M
}
service tcpwrap {
unix_listener login/tcpwrap {
group = $SET:default_login_user
mode = 0600
user = $SET:default_login_user
}
}
ssl_server {
cert_file = /etc/letsencrypt/live/domain.com/fullchain.pem
dh_file = /etc/dovecot/dh.pem
key_file = /etc/letsencrypt/live/domain.com/privkey.pem
prefer_ciphers = server
}
protocol imap {
imap_capability = IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE
login_greeting = Domain-Dev IMAP Server ready.
}
protocol pop3 {
login_greeting = Domain-Dev POP3 Server ready.
pop3_enable_last = yes
pop3_uidl_format = %{uid | substr(0, 8)}%{uidvalidity | substr(0, 8)}
}

Dovecot Proxy with mysql passdb and oauth2 authentication: upgrade from 2.3.21 to 2.4.3 does not work

Urban Loesch

dpkg -l |grep dovecot

2.4.3-1+debian12 (c1b22ef978): /etc/dovecot/dovecot.conf

Pigeonhole version 2.4.3-1+debian12 (99939e07)

OS: Linux 6.1.0-31-amd64 x86_64 Debian 12.13

Hostname: imap-dev.domain.com