Hi all,
We'd like to enable OAuth with Keycloak in Dovecot, after enabling 'OAUTHBEARER XOAUTH2' in Dovecot based on online document, I can confirm Dovecot is ready for OAuth using openssl command, however when the auth request comes in, it failed in establishing a SSL connection with Keycloak server on port 443, shown as following in debug logs. I can confirming using commands 'openssl s_client -connect <keycloak_server>:443' or 'curl -v https://<keycloak_server/' all returns normal and no errors. Altering some of the SSL options in dovecot such as 'ssl_ca = </etc/pki/CA/certs/root_ca.pem' or 'ssl_client_ca_file = </etc/pki/CA/certs/root_ca.pem' does not help either. The certificate are NOT self-signed but signed the legit authorities. So I'm not sure why dovecot could not establish the connections.
Debug logs:
----------------------------------------------------
Dec 5 14:32:22 mktst4 dovecot: auth: Debug: http-client: conn
10.0.2.2:443 [0]: Connection disconnect
Dec 5 14:32:22 mktst4 dovecot: auth: Debug: http-client: conn
10.0.2.2:443 [0]: Connection destroy
----------------------------------------------------
#dovecot -n
----------------------------------------------------
# 2.2.36 (1f10bfa63): /etc/dovecot/dovecot.conf
# OS: Linux 3.10.0-1062.4.3.el7.x86_64 x86_64 Red Hat Enterprise Linux Server release 7.7 (Maipo)
# Hostname:
mktst4.sdcc.bnl.govauth_debug = yes
auth_debug_passwords = yes
auth_mechanisms = oauthbearer xoauth2
auth_verbose = yes
auth_verbose_passwords = yes
first_valid_uid = 1000
mail_debug = yes
mail_location = maildir:~/Maildir
mbox_write_locks = fcntl
namespace inbox {
inbox = yes
location =
mailbox Drafts {
special_use = \Drafts
}
mailbox Junk {
special_use = \Junk
}
mailbox Sent {
special_use = \Sent
}
mailbox "Sent Messages" {
special_use = \Sent
}
mailbox Trash {
special_use = \Trash
}
prefix =
}
passdb {
args = /etc/dovecot/dovecot-oauth2.conf.ext
driver = oauth2
mechanisms = oauthbearer xoauth2
}
protocols = imap
service auth {
unix_listener /var/spool/postfix/private/auth {
group = postfix
mode = 0666
user = postfix
}
}
ssl = required
ssl_ca = </etc/pki/CA/certs/2.pem
ssl_cert = </etc/pki/dovecot/certs/dovecot.pem
ssl_cipher_list = ECDH+AESGCM:ECDH+CHACHA20:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:!aNULL:!MD5:!DSS:!RSA
ssl_client_ca_file = </etc/pki/CA/certs/2.pem
ssl_key = # hidden, use -P to show it
ssl_prefer_server_ciphers = yes
ssl_require_crl = no
userdb {
args = uid=vmail gid=vmail home=/var/vmail/%u
driver = static
}
----------------------------------------------------
# cat /etc/dovecot/conf.d/auth-oauth2.conf.ext
----------------------------------------------------
passdb {
driver = oauth2
mechanisms = oauthbearer xoauth2
args = /etc/dovecot/dovecot-oauth2.conf.ext
}
userdb {
driver = static
args = uid=vmail gid=vmail home=/var/vmail/%u
}
----------------------------------------------------
I wonder if anyone has experienced this possibly know what's going on.
Thanks!
Mizuki