On 21/08/2024 11:53 EEST v--- via dovecot <dovecot@dovecot.org> wrote:

Hello! I'm using dovecot with keycloak for oauth authentication. My config is:

client_id = dovecot client_secret = MY_SECRET introspection_url = https://MY_KEYCLOAK/realms/master/protocol/openid-connect/token/introspect introspection_mode = post pass_attrs = pass=%{oauth2:access_token}

Everything worked great on version 2.3.20. After upgrading to version 2.3.21.1 oauth stopped working with errors:

auth: Debug: http-client: conn [::1]:443 [1]: Got 401 response for request [Req1: POST https://MY_KEYCLOAK/realms/master/protocol/openid-connect/token/introspect]: Unauthorized (took 5 ms + >Aug 16 00:23:58 auth: Error: oauth2(MY_EMAIL,127.0.0.1,<HADwdb8f+PN/AAAB>): oauth2 failed: Introspection failed: No username returned

I tried all combination of configurations, debugging and versions of keycloak. Seems something was broken in this version of dovecot.

Hi!

Release notes say

oauth2: Dovecot would send client_id and client_secret as POST parameters to introspection server. These need to be optionally in Basic auth instead as required by OIDC specification.

this is a slightly obscure way to say that you need to change your

introspection_url = https://client_id:client_secret@MY_KEYCLOAK/...

(see https://github.com/dovecot/core/blob/d492236fa077cba1222695ca3267afb76723567...)

Aki