OidcProvider

Configures the OAuth and OpenID Connect provider settings.

This object can be configured from the WebUI under Settings › Authentication › OIDC Provider

Fields

`authCodeExpiry`

Type: Duration · default: 600000 · min: 600000

Expiration time of an authorization code issued by the authorization code flow. OAuth clients require at least 10 minutes.

`refreshTokenExpiry`

Type: Duration · default: 2592000000 · min: 86400000

How long an OAuth application can stay unused before it is signed out. Each refresh issues a new refresh token valid for this long, so a grant ends only after this much inactivity. Values below 30 days do not follow the OAuth profile for open public clients and make mail applications ask users to sign in again more often.

`accessTokenExpiry`

Type: Duration · default: 3600000 · min: 600000

Expiration time of an OAuth access token. OAuth clients require at least 10 minutes and expect at least 1 hour.

`userCodeExpiry`

Type: Duration · default: 1800000

Expiration time of a user code issued by the device authentication flow

`idTokenExpiry`

Type: Duration · default: 900000

Expiration time of an OpenID Connect ID token

`encryptionKey`

Type: SecretKey · required

Encryption key to use for OAuth

`signatureAlgorithm`

Type: JwtSignatureAlgorithm · default: "hs256"

JWT signature algorithm to use for OpenID Connect.

`signatureKey`

Type: SecretText · required

Contents of the private key PEM used to sign JWTs for OpenID Connect.

`clientMetadataDocuments`

Type: OAuthClientMetadataPolicy · default: "disabled"

Whether OAuth client ids that are HTTPS URLs of Client ID Metadata Documents published by third-party applications are accepted. Same domain accepts only documents hosted under the same registrable domain as this server. Third-party clients are always shown as unverified on the consent screen. Documents served by this server’s own web applications are always accepted.

JMAP API

The OidcProvider singleton is available via the urn:stalwart:jmap capability.

`x:OidcProvider/get`

This is a standard Foo/get method as defined in RFC 8620, Section 5.1.

For singletons, the ids argument should be the literal singleton (or null to return the single instance).

This method requires the sysOidcProviderGet permission.

curl -X POST https://mail.example.com/jmap/ \
  -H 'Authorization: Bearer $TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{
      "methodCalls": [
        [
          "x:OidcProvider/get",
          {
            "ids": [
              "singleton"
            ]
          },
          "c1"
        ]
      ],
      "using": [
        "urn:ietf:params:jmap:core",
        "urn:stalwart:jmap"
      ]
    }'

`x:OidcProvider/set`

This is a standard Foo/set method as defined in RFC 8620, Section 5.3.

For singletons, only the update argument with id singleton is accepted; create and destroy arguments are rejected.

This method requires the sysOidcProviderUpdate permission.

curl -X POST https://mail.example.com/jmap/ \
  -H 'Authorization: Bearer $TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{
      "methodCalls": [
        [
          "x:OidcProvider/set",
          {
            "update": {
              "singleton": {
                "authCodeExpiry": 600000
              }
            }
          },
          "c1"
        ]
      ],
      "using": [
        "urn:ietf:params:jmap:core",
        "urn:stalwart:jmap"
      ]
    }'

CLI

stalwart-cli wraps the same JMAP calls. See the CLI reference for installation, authentication, and general usage.

Fetch

stalwart-cli get OidcProvider

Update

stalwart-cli update OidcProvider --field authCodeExpiry=600000

Nested types

SecretKey

A secret value provided directly, from an environment variable, or from a file.

Value: Secret value. Carries the fields of SecretKeyValue.
EnvironmentVariable: Secret read from environment variable. Carries the fields of SecretKeyEnvironmentVariable.
File: Secret read from file. Carries the fields of SecretKeyFile.

SecretKeyValue

A secret value provided directly.

`secret`

Type: String · required · secret

Password or secret value

SecretKeyEnvironmentVariable

A secret value read from an environment variable.

`variableName`

Type: String · required

Environment variable name to read the secret from

SecretKeyFile

A secret value read from a file.

`filePath`

Type: String · required

File path to read the secret from

SecretText

A secret text value provided directly, from an environment variable, or from a file.

Text: Secret value. Carries the fields of SecretTextValue.
EnvironmentVariable: Secret read from environment variable. Carries the fields of SecretKeyEnvironmentVariable.
File: Secret read from file. Carries the fields of SecretKeyFile.

SecretTextValue

A secret text value provided directly.

`secret`

Type: Text · required · secret

Password or secret value

Enums

JwtSignatureAlgorithm

Value	Label
`es256`	ECDSA using P-256 and SHA-256
`es384`	ECDSA using P-384 and SHA-384
`ps256`	RSASSA-PSS using SHA-256 and MGF1 with SHA-256
`ps384`	RSASSA-PSS using SHA-384 and MGF1 with SHA-384
`ps512`	RSASSA-PSS using SHA-512 and MGF1 with SHA-512
`rs256`	RSASSA-PKCS1-v1_5 using SHA-256
`rs384`	RSASSA-PKCS1-v1_5 using SHA-384
`rs512`	RSASSA-PKCS1-v1_5 using SHA-512
`hs256`	HMAC using SHA-256
`hs384`	HMAC using SHA-384
`hs512`	HMAC using SHA-512

OAuthClientMetadataPolicy

Value	Label
`disabled`	Disabled
`sameDomain`	Same domain only
`any`	Any HTTPS URL