Starstruk Logo MarkStarstruk

2025-03

mailcow/mailcow-dockerized2025-03Mar 25, 2025by FreddleSpl0it

AI Summary

Introduces external Identity Providers (Keycloak, LDAP, OIDC), separates authentication paths for Admin/Domain Admin/Users, disables direct SOGo login, and upgrades Alpine to 3.21.

Key Highlights

  • External Identity Provider support (Keycloak, LDAP, OIDC)
  • Separated login paths (/admin, /domainadmin, /)
  • Direct SOGo login disabled
  • Alpine 3.21 upgrade

Breaking Changes

  • Logins for Administrator, Domain Administrator, and Users have been separated to specific paths.
  • Direct SOGo login is now disabled; users must use the mailcow login UI.

New Features

  • External Identity Provider configuration
  • Dovecot password caching
  • 2FA protected mailboxes require app passwords for protocol authentication

Full Release Notes

This release includes features that have been tested in the nightly branch over the past year. If you’ve been following our [nightly progress update](https://mailcow.email/posts/2025/nightly-progress/), you may already be familiar with some of the changes listed below.

> [!CAUTION]
> **Before updating, please ensure you have a current backup of your installation.**
>
>This update heavily changes the authentication process. If you don’t want to apply the 2025-03 update, you can switch to the legacy branch with `./update.sh --legacy`.  
>The legacy branch will **only** receive security updates until February 2026.  
>[Read more about the legacy branch](https://docs.mailcow.email/maintenance/update/#update-variants)

## Breaking Changes

Logins for Administrator, Domain Administrator, and Users have been separated:

- **Administrator Login:** `/admin`  
- **Domain Administrator Login:** `/domainadmin`  
- **Users:** `/`

Direct SOGo login is now disabled. All unauthenticated requests to `/SOGo` will be redirected to `/`.  
Users must use the mailcow login.  
Administrators can define whether a user should be redirected to the mailcow UI or SOGo after login.

## Other Notable Changes
- All Alpine-based images have been updated to Alpine 3.21.
- 2FA protected mailboxes will need an app password for authentication with mail protocols.

## New Feature

mailcow now supports **external Identity Providers** for authentication.  
This is optional — administrators can configure an external identity provider, which can be used alongside the SQL database for authentication.  
You can even configure which authentication source a specific user should use.

Currently supported Identity Providers:

1. **Keycloak** – [Documentation](https://docs.mailcow.email/manual-guides/mailcow-UI/u_e-mailcow_ui-keycloak/)  
2. **LDAP/AD** – [Documentation](https://docs.mailcow.email/manual-guides/mailcow-UI/u_e-mailcow_ui-ldap/)  
3. **Generic OIDC** – [Documentation](https://docs.mailcow.email/manual-guides/mailcow-UI/u_e-mailcow_ui-generic-oidc/)

## Improvements
mailcow now uses **Dovecot's password caching** to reduce authentication-related load.

## Changelog
**Full Changelog**: https://github.com/mailcow/mailcow-dockerized/compare/2025-02...2025-03

## New Contributors
* @marvinruder made their first contribution in https://github.com/mailcow/mailcow-dockerized/pull/6365