Learn Mailserver - Roundcube Advanced: Plugins & Multi-Auth

#Introduction

The basic webmail has been working since episode 8. This episode turns it into a grown-up webmail: plugins. Roundcube is designed to be modular — almost every advanced feature comes from a plugin, and multi-authentication configuration opens the door to integrating with your identity system.

We'll install the essential plugins (password, managesieve, enigma, archive, markasjunk), learn how to enable them via config.inc.php, then connect Roundcube to OAuth2/OIDC — a capability massively improved since Roundcube 1.7.

#Roundcube Plugin Anatomy

A plugin is a directory at plugins/<name>/ containing one or more PHP classes that extend Roundcube's behavior. Each plugin is enabled via the plugins array in the configuration:

ls /var/www/webmail/plugins/

This list shows the bundled installed plugins. Activation is just adding them to the plugins array — Roundcube 1.7 makes this easy via the console:

php /var/www/webmail/bin/console config set plugins '["password","managesieve","enigma","archive","markasjunk"]'

After saving, the plugins become active on page reload. Some plugins need additional configuration in config/config.inc.php via $config['plugin_<name>_...'].

#Essential Plugins: password, archive, markasjunk

Three plugins that change daily user experience:

• password — users change their own password, directly updating the hash in the virtual users database. A key plugin for admins who don't want to serve "please change my password" requests.
• archive — an "Archive" button that moves email to the Archive folder, encouraging a tidy storage culture.
• markasjunk — a "Mark as spam" button that moves email to the Junk folder and (if connected) trains SpamAssassin's bayes.

The password configuration determines the database connection:

php /var/www/webmail/bin/console config set password_driver sql
php /var/www/webmail/bin/console config set password_db_dsn 'mysql://mail:ganti-password@localhost/maildb'

With password_db_dsn pointing at the virtual users database, a password change directly updates the virtual_users table — and because Dovecot reads from the same database, the change takes effect instantly.

#managesieve: Rule-Based Email Filtering

Sieve is a server-side filtering language: rules run in Dovecot without the client needing to be active. The managesieve plugin gives users a visual interface to manage Sieve scripts — and we also need to enable the support in Dovecot.

In Roundcube, enable the plugin and point it at Dovecot's Managesieve port:

php /var/www/webmail/bin/console config set plugins '["password","managesieve","enigma","archive","markasjunk"]'
php /var/www/webmail/bin/console config set managesieve_host 'ssl://localhost'
php /var/www/webmail/bin/console config set managesieve_port 4190

On the Dovecot side, enable the Sieve plugin in conf.d/20-lmtp.conf (already prepared in episode 9):

protocol lmtp {
  mail_plugins = sieve
}
service managesieve-login {
  inet_listener sieve {
    port = 4190
  }
}

An example rule produced by Managesieve — moving newsletter email to the Updates folder:

require ["fileinto"];
 
if anyof (header "subject" contains "[Newsletter]") {
  fileinto "Updates";
  stop;
}

This rule is executed by Dovecot when email arrives, even while the user is offline.

#enigma: OpenPGP in the Webmail

enigma integrates OpenPGP into the interface: users store private keys, encrypt/sign email, and read encrypted email — all from the browser. Activation:

php /var/www/webmail/bin/console config set enigma_pgp_homedir '/var/www/webmail/enigma'
php /var/www/webmail/bin/console config set enigma_pgp_privkeys '/var/www/webmail/enigma/privkeys'

Make sure the directory is writable by the web process and not publicly readable. Enigma uses the gnupg installed on the server — check availability with gpg --version.

#Multi-Auth: LDAP and OAuth2/OIDC

Roundcube by default only recognizes users in the mail database. For environments with centralized identity, there are two paths:

OAuth2/OIDC login — Roundcube 1.7 greatly improved OIDC support, so webmail can join the organization's SSO. Configuration via config:

php /var/www/webmail/bin/console config set oauth_provider 'generic'
php /var/www/webmail/bin/console config set oauth_client_id 'roundcube-app'
php /var/www/webmail/bin/console config set oauth_client_secret 'rahasia'
php /var/www/webmail/bin/console config set oauth_auth_uri 'https://auth.example.com/application/o/authorize/'
php /var/www/webmail/bin/console config set oauth_token_uri 'https://auth.example.com/application/o/token/'

LDAP address book — the ldap plugin allows contact search on an LDAP/AD server. This complements SSO: login identity from OIDC, contact directory from LDAP.

#Customization: Skin and Language

Finally, a branding touch:

php /var/www/webmail/bin/console config set skin elastic
php /var/www/webmail/bin/console config set language id_ID

skin elastic is the built-in responsive theme; language id_ID activates the Indonesian language pack (make sure it's installed in program/localization/id_ID/). The skin and language combination shapes users' first impression — a small detail with a big impact on adoption.

#Conclusion

Episode 20 is done. Key takeaways:

• Plugins are enabled via the plugins array; the bin/console config set console is the safest way.
• password updates the hash directly in the virtual users database.
• managesieve connects Roundcube to Dovecot's Sieve for server-side filters.
• enigma brings OpenPGP to the webmail.
• OAuth2/OIDC (greatly improved in Roundcube 1.7) opens the SSO path, with careful identity mapping.

The webmail is now mature. In episode 21 we look ahead: Modern Features & Roadmap — Postfix 3.11, Dovecot 2.4, and Roundcube 1.7, plus 2026 industry trends. See you in episode 21!