Merge pull request #7566 from mailcow/feat/groups

[Web][Dovecot][SOGo][DockerApi] Add mailbox groups, shared mailboxes and identity provider sync

data/Dockerfiles/dockerapi/modules/DockerApi.py

@@ -412,6 +412,63 @@ class DockerApi:
 
         sogo_return = container.exec_run(["/bin/bash", "-c", f"sogo-tool rename-user '{old_username}' '{new_username}'"], user='sogo')
         return self.exec_run_handler('generic', sogo_return)
+  # api call: container_post - post_action: exec - cmd: sogo - task: subscribe
+  # Subscribes users to a folder of the owner, or unsubscribes them; values are passed as environment and
+  # arguments, never through the shell
+  def container_post__exec__sogo__subscribe(self, request_json, **kwargs):
+    if 'container_id' in kwargs:
+      filters = {"id": kwargs['container_id']}
+    elif 'container_name' in kwargs:
+      filters = {"name": kwargs['container_name']}
+
+    for container in self.sync_docker_client.containers.list(filters=filters):
+      owner = str(request_json.get('owner', ''))
+      folder = str(request_json.get('folder', ''))
+      users = [str(user) for user in request_json.get('users', []) if str(user)]
+      if not owner or not users or not re.match(r'^(Calendar|Contacts)/[A-Za-z0-9._-]+$', folder):
+        return Response(content=json.dumps({ 'type': 'danger', 'msg': 'owner, folder and users required' }, indent=4), media_type="application/json")
+      script = 'for user in "$@"; do sogo-tool manage-acl "$SOGO_ACTION" "$SOGO_OWNER" "$SOGO_FOLDER" "$user" || exit 1; done'
+      subscribe_return = container.exec_run(["/bin/bash", "-c", script, "subscribe"] + users, user='sogo',
+        environment={ 'SOGO_ACTION': 'unsubscribe' if request_json.get('unsubscribe') else 'subscribe', 'SOGO_OWNER': owner, 'SOGO_FOLDER': folder })
+      return self.exec_run_handler('generic', subscribe_return)
+  # api call: container_post - post_action: exec - cmd: sogo - task: init_user
+  # Creates the personal folders of users that never logged in to SOGo (e.g. shared mailboxes)
+  def container_post__exec__sogo__init_user(self, request_json, **kwargs):
+    if 'container_id' in kwargs:
+      filters = {"id": kwargs['container_id']}
+    elif 'container_name' in kwargs:
+      filters = {"name": kwargs['container_name']}
+
+    for container in self.sync_docker_client.containers.list(filters=filters):
+      users = [str(user) for user in request_json.get('users', []) if str(user)]
+      if not users:
+        return Response(content=json.dumps({ 'type': 'danger', 'msg': 'users required' }, indent=4), media_type="application/json")
+      init_return = container.exec_run(["/bin/bash", "-c", 'for user in "$@"; do sogo-tool init-user "$user" || exit 1; done', "init_user"] + users, user='sogo')
+      return self.exec_run_handler('generic', init_return)
+  # api call: container_post - post_action: exec - cmd: doveadm - task: subscribe_shared
+  # Subscribes users to every folder of a mailbox shared with them (Shared/<owner>/...), or unsubscribes them
+  def container_post__exec__doveadm__subscribe_shared(self, request_json, **kwargs):
+    if 'container_id' in kwargs:
+      filters = {"id": kwargs['container_id']}
+    elif 'container_name' in kwargs:
+      filters = {"name": kwargs['container_name']}
+
+    for container in self.sync_docker_client.containers.list(filters=filters):
+      owner = str(request_json.get('owner', ''))
+      users = [str(user) for user in request_json.get('users', []) if str(user)]
+      if not owner or not users or any(c in owner for c in '/*%'):
+        return Response(content=json.dumps({ 'type': 'danger', 'msg': 'owner and users required' }, indent=4), media_type="application/json")
+      if request_json.get('unsubscribe'):
+        # Without access the user no longer sees the folders, their names come from the owner
+        script = ('set -o pipefail; for user in "$@"; do doveadm mailbox list -u "$SUB_OWNER" | while IFS= read -r folder; do '
+          'case "$folder" in Shared|Shared/*) continue;; esac; doveadm mailbox unsubscribe -u "$user" "Shared/$SUB_OWNER/$folder" || exit 1; '
+          'done || exit 1; done')
+      else:
+        # No visible folder means no access yet (ACL, auth cache): fail, so the subscription is retried
+        script = ('for user in "$@"; do folders=$(doveadm mailbox list -u "$user" "Shared/$SUB_OWNER/*") && [ -n "$folders" ] || exit 1; '
+          'while IFS= read -r folder; do doveadm mailbox subscribe -u "$user" "$folder" || exit 1; done <<< "$folders"; done')
+      subscribe_return = container.exec_run(["/bin/bash", "-c", script, "subscribe_shared"] + users, environment={ 'SUB_OWNER': owner })
+      return self.exec_run_handler('generic', subscribe_return)
   # api call: container_post - post_action: exec - cmd: doveadm - task: get_acl
   def container_post__exec__doveadm__get_acl(self, request_json, **kwargs):
     if 'container_id' in kwargs:
@@ -439,7 +496,8 @@ class DockerApi:
           if len(acls) >= 2:
             for acl in acls[1:]:
               user_id, rights = acl.split(maxsplit=1)
-              user_id = user_id.split('=')[1]
+              # user=<name> as plain name, other identifiers (group=...) keep their type
+              user_id = user_id.split('=', 1)[1] if user_id.startswith('user=') else user_id
               mailbox_seen.append(mailbox)
               formatted_acls.append({ 'user': id, 'id': user_id, 'mailbox': mailbox, 'rights': rights.split() })
         elif "Shared" in shared_folder and "/" in shared_folder:
@@ -476,7 +534,7 @@ class DockerApi:
       id = request_json['id'].replace("'", "'\\''")
 
       if user and mailbox and id:
-        acl_delete_return = container.exec_run(["/bin/bash", "-c", f"doveadm acl delete -u '{user}' '{mailbox}' 'user={id}'"])
+        acl_delete_return = container.exec_run(["/bin/bash", "-c", f"doveadm acl delete -u '{user}' '{mailbox}' '{self.acl_identifier(id)}'"])
         return self.exec_run_handler('generic', acl_delete_return)
   # api call: container_post - post_action: exec - cmd: doveadm - task: set_acl
   def container_post__exec__doveadm__set_acl(self, request_json, **kwargs):
@@ -510,8 +568,50 @@ class DockerApi:
           rights += right + " "
 
       if user and mailbox and id and rights:
-        acl_set_return = container.exec_run(["/bin/bash", "-c", f"doveadm acl set -u '{user}' '{mailbox}' 'user={id}' {rights}"])
+        acl_set_return = container.exec_run(["/bin/bash", "-c", f"doveadm acl set -u '{user}' '{mailbox}' '{self.acl_identifier(id)}' {rights}"])
         return self.exec_run_handler('generic', acl_set_return)
+  # api call: container_post - post_action: exec - cmd: doveadm - task: set_acl_all
+  # Sets the rights of an identifier on every folder of a mailbox, no rights = delete; values are passed as
+  # environment, never through the shell
+  def container_post__exec__doveadm__set_acl_all(self, request_json, **kwargs):
+    if 'container_id' in kwargs:
+      filters = {"id": kwargs['container_id']}
+    elif 'container_name' in kwargs:
+      filters = {"name": kwargs['container_name']}
+
+    for container in self.sync_docker_client.containers.list(filters=filters):
+      user = request_json.get('user', '')
+      id = self.acl_identifier(request_json.get('id', ''))
+      rights = [right.lower() for right in request_json.get('rights', []) if right.lower() in self.acl_rights]
+      if not user or id in ('user=', 'group='):
+        return Response(content=json.dumps({ 'type': 'danger', 'msg': 'user and id required' }, indent=4), media_type="application/json")
+      action = 'doveadm acl set -u "$ACL_USER" "$folder" "$ACL_ID" $ACL_RIGHTS' if rights else 'doveadm acl delete -u "$ACL_USER" "$folder" "$ACL_ID"'
+      script = ('set -o pipefail; doveadm mailbox list -u "$ACL_USER" | while IFS= read -r folder; do '
+        'case "$folder" in Shared/*) continue;; esac; ' + action + ' || exit 1; done && doveadm acl recalc -u "$ACL_USER"')
+      acl_return = container.exec_run(["/bin/bash", "-c", script],
+        environment={ 'ACL_USER': user, 'ACL_ID': id, 'ACL_RIGHTS': ' '.join(rights) })
+      return self.exec_run_handler('generic', acl_return)
+  # api call: container_post - post_action: exec - cmd: doveadm - task: auth_cache_flush
+  # Drops cached userdb results (e.g. acl_groups) of the given users, all users if none are given
+  def container_post__exec__doveadm__auth_cache_flush(self, request_json, **kwargs):
+    if 'container_id' in kwargs:
+      filters = {"id": kwargs['container_id']}
+    elif 'container_name' in kwargs:
+      filters = {"name": kwargs['container_name']}
+
+    for container in self.sync_docker_client.containers.list(filters=filters):
+      users = [str(user) for user in request_json.get('users', []) if str(user)]
+      flush_return = container.exec_run(["doveadm", "auth", "cache", "flush"] + users)
+      return self.exec_run_handler('generic', flush_return)
+
+  # Rights doveadm acl set accepts from the API
+  acl_rights = ["admin", "create", "delete", "expunge", "insert", "lookup", "post", "read", "write", "write-deleted", "write-seen"]
+
+  # ACL identifier for doveadm: "user=<name>" for a plain name, "user=..." / "group=..." as given
+  def acl_identifier(self, id):
+    if id.startswith('user=') or id.startswith('group='):
+      return id
+    return 'user=' + id
 
 
   # Collect host stats

data/Dockerfiles/dovecot/docker-entrypoint.sh

@@ -127,7 +127,8 @@ cat <<EOF > /etc/dovecot/sql/dovecot-dict-sql-userdb.conf
 # Autogenerated by mailcow
 driver = mysql
 connect = "host=/var/run/mysqld/mysqld.sock dbname=${DBNAME} user=${DBUSER} password=${DBPASS}"
-user_query = SELECT CONCAT(JSON_UNQUOTE(JSON_VALUE(attributes, '$.mailbox_format')), mailbox_path_prefix, '%d/%n/${MAILDIR_SUB}:VOLATILEDIR=/var/volatile/%u:INDEX=/var/vmail_index/%u') AS mail, '%s' AS protocol, 5000 AS uid, 5000 AS gid, concat('*:bytes=', quota) AS quota_rule FROM mailbox WHERE username = '%u' AND (active = '1' OR active = '2')
+# acl_groups: active mailbox groups of the user, IMAP grants are ACLs on group=mcg_<id>
+user_query = SELECT CONCAT(JSON_UNQUOTE(JSON_VALUE(attributes, '$.mailbox_format')), mailbox_path_prefix, '%d/%n/${MAILDIR_SUB}:VOLATILEDIR=/var/volatile/%u:INDEX=/var/vmail_index/%u') AS mail, '%s' AS protocol, 5000 AS uid, 5000 AS gid, concat('*:bytes=', quota) AS quota_rule, (SELECT GROUP_CONCAT(CONCAT('mcg_', gm.group_id)) FROM mailbox_group_member gm JOIN mailbox_group g ON g.id = gm.group_id AND g.active = 1 WHERE gm.username = mailbox.username) AS acl_groups FROM mailbox WHERE username = '%u' AND (active = '1' OR active = '2')
 iterate_query = SELECT username FROM mailbox WHERE active = '1' OR active = '2';
 EOF
 
@@ -304,6 +305,15 @@ IMAPSYNC_TABLE=$(mariadb --skip-ssl --socket=/var/run/mysqld/mysqld.sock -u ${DB
 # Envsubst maildir_gc
 echo "$(envsubst < /usr/local/bin/maildir_gc.sh)" > /usr/local/bin/maildir_gc.sh
 
+# Wait for updated schema (DB_VERSION from docker-compose.yml), the userdb query reads tables the init_db of php-fpm creates on updates
+DBV_NOW=$(mariadb --skip-ssl --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "SELECT version FROM versions WHERE application = 'db_schema';" -BN)
+while [[ "${DBV_NOW}" != "${DB_VERSION}" ]]; do
+  echo "Waiting for schema update..."
+  sleep 5
+  DBV_NOW=$(mariadb --skip-ssl --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "SELECT version FROM versions WHERE application = 'db_schema';" -BN)
+done
+echo "DB schema is ${DBV_NOW}"
+
 # GUID generation
 while [[ ${VERSIONS_OK} != 'OK' ]]; do
   if [[ ! -z $(mariadb --skip-ssl --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -B -e "SELECT 'OK' FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_SCHEMA = \"${DBNAME}\" AND TABLE_NAME = 'versions'") ]]; then

data/Dockerfiles/sogo/bootstrap-sogo.sh

@@ -13,13 +13,11 @@ do
   sleep 3
 done
 
-# Wait for updated schema
+# Wait for updated schema (DB_VERSION from docker-compose.yml)
 DBV_NOW=$(mariadb --skip-ssl --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "SELECT version FROM versions WHERE application = 'db_schema';" -BN)
-DBV_NEW=$(grep -oE '\$db_version = .*;' init_db.inc.php | sed 's/$db_version = //g;s/;//g' | cut -d \" -f2)
-while [[ "${DBV_NOW}" != "${DBV_NEW}" ]]; do
+while [[ "${DBV_NOW}" != "${DB_VERSION}" ]]; do
   echo "Waiting for schema update..."
   DBV_NOW=$(mariadb --skip-ssl --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "SELECT version FROM versions WHERE application = 'db_schema';" -BN)
-  DBV_NEW=$(grep -oE '\$db_version = .*;' init_db.inc.php | sed 's/$db_version = //g;s/;//g' | cut -d \" -f2)
   sleep 5
 done
 echo "DB schema is ${DBV_NOW}"

data/conf/phpfpm/crons/group-grants.php

@@ -0,0 +1,65 @@
+<?php
+
+require_once(__DIR__ . '/../web/inc/vars.inc.php');
+if (file_exists(__DIR__ . '/../web/inc/vars.local.inc.php')) {
+  include_once(__DIR__ . '/../web/inc/vars.local.inc.php');
+}
+require_once __DIR__ . '/../web/inc/lib/vendor/autoload.php';
+
+$dsn = $database_type . ":unix_socket=" . $database_sock . ";dbname=" . $database_name;
+$opt = [
+  PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
+  PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
+  PDO::ATTR_EMULATE_PREPARES   => false,
+];
+try {
+  $pdo = new PDO($dsn, $database_user, $database_pass, $opt);
+} catch (PDOException $e) {
+  fwrite(STDERR, "DB connect failed: " . $e->getMessage() . "\n");
+  exit(1);
+}
+
+$redis = new Redis();
+try {
+  if (!empty(getenv('REDIS_SLAVEOF_IP'))) {
+    $redis->connect(getenv('REDIS_SLAVEOF_IP'), getenv('REDIS_SLAVEOF_PORT'));
+  } else {
+    $redis->connect('redis-mailcow', 6379);
+  }
+  $redis->auth(getenv("REDISPASS"));
+} catch (Exception $e) {
+  fwrite(STDERR, "Redis connect failed: " . $e->getMessage() . "\n");
+  exit(1);
+}
+
+function logMsg($priority, $message, $task = "Group Shares") {
+  global $redis;
+  $redis->lPush('CRON_LOG', json_encode(array(
+    "time" => time(),
+    "priority" => $priority,
+    "task" => $task,
+    "message" => $message,
+  )));
+}
+
+require_once __DIR__ . '/../web/inc/functions.inc.php';
+require_once __DIR__ . '/../web/inc/functions.docker.inc.php';
+
+// One run at a time, released when the process ends
+$lock = fopen('/tmp/group-grants.lock', 'c');
+if ($lock === false || !flock($lock, LOCK_EX | LOCK_NB)) {
+  exit(0);
+}
+
+$sharing = \Mailcow\MailboxGroup\MailboxGroupModule::create($pdo, \Mailcow\Core\Context::system())->sharing;
+
+// Every minute: subscriptions of changed groups; failed ones are retried and logged by the full run
+if ((int)date('i') % 15 !== 0) {
+  $sharing->syncSubscriptions();
+  exit(0);
+}
+
+// Every 15 minutes: IMAP ACLs on new top-level folders and failed grants, SOGo grants of owners that opened SOGo meanwhile
+foreach ($sharing->reconcile() as $warning) {
+  logMsg("warning", $warning[0] . ": " . html_entity_decode(implode(", ", array_slice($warning, 1))));
+}

data/conf/phpfpm/crons/identity-sync.php

@@ -0,0 +1,95 @@
+<?php
+
+require_once(__DIR__ . '/../web/inc/vars.inc.php');
+if (file_exists(__DIR__ . '/../web/inc/vars.local.inc.php')) {
+  include_once(__DIR__ . '/../web/inc/vars.local.inc.php');
+}
+require_once __DIR__ . '/../web/inc/lib/vendor/autoload.php';
+
+$dsn = $database_type . ":unix_socket=" . $database_sock . ";dbname=" . $database_name;
+$opt = [
+  PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
+  PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
+  PDO::ATTR_EMULATE_PREPARES   => false,
+];
+try {
+  $pdo = new PDO($dsn, $database_user, $database_pass, $opt);
+} catch (PDOException $e) {
+  fwrite(STDERR, "DB connect failed: " . $e->getMessage() . "\n");
+  exit(1);
+}
+
+$redis = new Redis();
+try {
+  if (!empty(getenv('REDIS_SLAVEOF_IP'))) {
+    $redis->connect(getenv('REDIS_SLAVEOF_IP'), getenv('REDIS_SLAVEOF_PORT'));
+  } else {
+    $redis->connect('redis-mailcow', 6379);
+  }
+  $redis->auth(getenv("REDISPASS"));
+} catch (Exception $e) {
+  fwrite(STDERR, "Redis connect failed: " . $e->getMessage() . "\n");
+  exit(1);
+}
+
+function logMsg($priority, $message, $task = "Identity Sync") {
+  global $redis;
+  $redis->lPush('CRON_LOG', json_encode(array(
+    "time" => time(),
+    "priority" => $priority,
+    "task" => $task,
+    "message" => $message,
+  )));
+}
+
+require_once __DIR__ . '/../web/inc/functions.inc.php';
+require_once __DIR__ . '/../web/inc/functions.auth.inc.php';
+require_once __DIR__ . '/../web/inc/sessions.inc.php';
+require_once __DIR__ . '/../web/inc/functions.mailbox.inc.php';
+require_once __DIR__ . '/../web/inc/functions.ratelimit.inc.php';
+require_once __DIR__ . '/../web/inc/functions.acl.inc.php';
+
+// The legacy mailbox functions run as admin
+$_SESSION['mailcow_cc_username'] = "admin";
+$_SESSION['mailcow_cc_role'] = "admin";
+$_SESSION['acl']['tls_policy'] = "1";
+$_SESSION['acl']['quarantine_notification'] = "1";
+$_SESSION['acl']['quarantine_category'] = "1";
+$_SESSION['acl']['ratelimit'] = "1";
+$_SESSION['acl']['sogo_access'] = "1";
+$_SESSION['acl']['protocol_access'] = "1";
+$_SESSION['acl']['mailbox_relayhost'] = "1";
+$_SESSION['acl']['unlimited_quota'] = "1";
+
+// One run at a time, released when the process ends
+$lock = fopen('/tmp/identity-sync.lock', 'c');
+if ($lock === false || !flock($lock, LOCK_EX | LOCK_NB)) {
+  exit(0);
+}
+
+// Users, offboarding and groups of Keycloak or LDAP; requested runs first, else every sync_interval minutes.
+// The IdP is only contacted when a run is due.
+$iam_settings = identity_provider('get');
+$identity = \Mailcow\Identity\IdentityModule::create($pdo, \Mailcow\Core\Context::system(), $iam_settings, function () {
+  return identity_provider('init');
+});
+$run = $identity->sync->runDue();
+if ($run !== null) {
+  $summary = $run['summary'];
+  if ($run['status'] == 'error') {
+    logMsg("err", ucfirst($run['mode']) . " failed: " . $summary['error']);
+  } else {
+    $counts = array();
+    foreach ($summary['counts'] as $key => $count) {
+      if ($count > 0) $counts[] = $key . "=" . $count;
+    }
+    logMsg(($run['status'] == 'blocked') ? "warning" : "info", ucfirst($run['mode']) . " " . $run['status'] . ": " . (empty($counts) ? "no changes" : implode(", ", $counts)));
+    foreach ($summary['details']['conflicts'] as $conflict) {
+      logMsg("warning", $conflict);
+    }
+    foreach ($summary['errors'] ?? array() as $error) {
+      logMsg("err", $error);
+    }
+  }
+}
+session_destroy();

data/conf/phpfpm/crons/keycloak-sync.php

@@ -1,231 +0,0 @@
-<?php
-
-require_once(__DIR__ . '/../web/inc/vars.inc.php');
-if (file_exists(__DIR__ . '/../web/inc/vars.local.inc.php')) {
-  include_once(__DIR__ . '/../web/inc/vars.local.inc.php');
-}
-require_once __DIR__ . '/../web/inc/lib/vendor/autoload.php';
-
-// Init database
-//$dsn = $database_type . ':host=' . $database_host . ';dbname=' . $database_name;
-$dsn = $database_type . ":unix_socket=" . $database_sock . ";dbname=" . $database_name;
-$opt = [
-    PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
-    PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
-    PDO::ATTR_EMULATE_PREPARES   => false,
-];
-try {
-  $pdo = new PDO($dsn, $database_user, $database_pass, $opt);
-}
-catch (PDOException $e) {
-  logMsg("err", $e->getMessage());
-  session_destroy();
-  exit;
-}
-
-// Init Redis
-$redis = new Redis();
-try {
-  if (!empty(getenv('REDIS_SLAVEOF_IP'))) {
-    $redis->connect(getenv('REDIS_SLAVEOF_IP'), getenv('REDIS_SLAVEOF_PORT'));
-  }
-  else {
-    $redis->connect('redis-mailcow', 6379);
-  }
-  $redis->auth(getenv("REDISPASS"));
-}
-catch (Exception $e) {
-  echo "Exiting: " . $e->getMessage();
-  session_destroy();
-  exit;
-}
-
-function logMsg($priority, $message, $task = "Keycloak Sync") {
-  global $redis;
-
-  $finalMsg = array(
-    "time" => time(),
-    "priority" => $priority,
-    "task" => $task,
-    "message" => $message
-  );
-  $redis->lPush('CRON_LOG', json_encode($finalMsg));
-}
-
-// Load core functions first
-require_once __DIR__ . '/../web/inc/functions.inc.php';
-require_once __DIR__ . '/../web/inc/functions.auth.inc.php';
-require_once __DIR__ . '/../web/inc/sessions.inc.php';
-require_once __DIR__ . '/../web/inc/functions.mailbox.inc.php';
-require_once __DIR__ . '/../web/inc/functions.ratelimit.inc.php';
-require_once __DIR__ . '/../web/inc/functions.acl.inc.php';
-
-$_SESSION['mailcow_cc_username'] = "admin";
-$_SESSION['mailcow_cc_role'] = "admin";
-$_SESSION['acl']['tls_policy'] = "1";
-$_SESSION['acl']['quarantine_notification'] = "1";
-$_SESSION['acl']['quarantine_category'] = "1";
-$_SESSION['acl']['ratelimit'] = "1";
-$_SESSION['acl']['sogo_access'] = "1";
-$_SESSION['acl']['protocol_access'] = "1";
-$_SESSION['acl']['mailbox_relayhost'] = "1";
-$_SESSION['acl']['unlimited_quota'] = "1";
-
-$iam_settings = identity_provider('get');
-if ($iam_settings['authsource'] != "keycloak" || (intval($iam_settings['periodic_sync']) != 1 && intval($iam_settings['import_users']) != 1)) {
-  session_destroy();
-  exit;
-}
-
-// Set pagination variables
-$start = 0;
-$max = 100;
-
-// lock sync if already running
-$lock_file = '/tmp/iam-sync.lock';
-if (file_exists($lock_file)) {
-  $lock_file_parts = explode("\n", file_get_contents($lock_file));
-  $pid = $lock_file_parts[0];
-  if (count($lock_file_parts) > 1){
-    $last_execution = $lock_file_parts[1];
-    $elapsed_time = (time() - $last_execution) / 60;
-    if ($elapsed_time < intval($iam_settings['sync_interval'])) {
-      logMsg("warning", "Sync not ready (".number_format((float)$elapsed_time, 2, '.', '')."min / ".$iam_settings['sync_interval']."min)");
-      session_destroy();
-      exit;
-    }
-  }
-
-  if (posix_kill($pid, 0)) {
-    logMsg("warning", "Sync is already running");
-    session_destroy();
-    exit;
-  } else {
-    unlink($lock_file);
-  }
-}
-$lock_file_handle = fopen($lock_file, 'w');
-fwrite($lock_file_handle, getmypid());
-fclose($lock_file_handle);
-
-// Init Keycloak Provider
-$iam_provider = identity_provider('init');
-
-// Loop until all users have been retrieved
-while (true) {
-  // Get admin access token
-  $admin_token = identity_provider("get-keycloak-admin-token");
-
-  // Make the API request to retrieve the users
-  $url = "{$iam_settings['server_url']}/admin/realms/{$iam_settings['realm']}/users?first=$start&max=$max";
-  $ch = curl_init();
-  curl_setopt($ch, CURLOPT_URL, $url);
-  curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
-  curl_setopt($ch, CURLOPT_HTTPHEADER, [
-    "Content-Type: application/json",
-    "Authorization: Bearer " . $admin_token
-  ]);
-  $response = curl_exec($ch);
-  $code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
-  curl_close($ch);
-
-  if ($code != 200){
-    logMsg("err", "Received HTTP {$code}");
-    session_destroy();
-    exit;
-  }
-  try {
-    $response = json_decode($response, true);
-  } catch (Exception $e) {
-    logMsg("err", $e->getMessage());
-    break;
-  }
-  if (!is_array($response)){
-    logMsg("err", "Received malformed response from keycloak api");
-    break;
-  }
-  if (count($response) == 0) {
-    break;
-  }
-
-  // Process the batch of users
-  foreach ($response as $user) {
-    if (empty($user['email'])){
-      logMsg("warning", "No email address in keycloak found for user " . $user['name']);
-      continue;
-    }
-
-    // try get mailbox user
-    $stmt = $pdo->prepare("SELECT
-      mailbox.*,
-      domain.active AS d_active
-      FROM `mailbox`
-      INNER JOIN domain on mailbox.domain = domain.domain
-      WHERE `kind` NOT REGEXP 'location|thing|group'
-        AND `username` = :user");
-    $stmt->execute(array(':user' => $user['email']));
-    $row = $stmt->fetch(PDO::FETCH_ASSOC);
-
-    // check if matching attribute mapping exists
-    $user_template = $user['attributes']['mailcow_template'][0];
-    $mapper_key = array_search($user_template, $iam_settings['mappers']);
-
-    $_SESSION['access_all_exception'] = '1';
-    if (!$row && intval($iam_settings['import_users']) == 1){
-      if ($mapper_key === false){
-        if (!empty($iam_settings['default_template'])) {
-          $mbox_template = $iam_settings['default_template'];
-          logMsg("warning", "Using default template for user " . $user['email']);
-        } else {
-          logMsg("warning", "No matching attribute mapping found for user " . $user['email']);
-          continue;
-        }
-      } else {
-        $mbox_template = $iam_settings['templates'][$mapper_key];
-      }
-      // mailbox user does not exist, create...
-      logMsg("info", "Creating user " . $user['email']);
-      $create_res = mailbox('add', 'mailbox_from_template', array(
-        'domain' => explode('@', $user['email'])[1],
-        'local_part' => explode('@', $user['email'])[0],
-        'name' => $user['firstName'] . " " . $user['lastName'],
-        'authsource' => 'keycloak',
-        'template' => $mbox_template
-      ));
-      if (!$create_res){
-        logMsg("err", "Could not create user " . $user['email']);
-        continue;
-      }
-    } else if ($row && intval($iam_settings['periodic_sync']) == 1 && $row['authsource'] == "keycloak") {
-      if ($mapper_key === false){
-        logMsg("warning", "No matching attribute mapping found for user " . $user['email']);
-        continue;
-      }
-      $mbox_template = $iam_settings['templates'][$mapper_key];
-      // mailbox user does exist, sync attribtues...
-      logMsg("info", "Syncing attributes for user " . $user['email']);
-      mailbox('edit', 'mailbox_from_template', array(
-        'username' => $user['email'],
-        'name' => $user['firstName'] . " " . $user['lastName'],
-        'template' => $mbox_template
-      ));
-    } else {
-      // skip mailbox user
-      logMsg("info", "Skipping user " . $user['email']);
-    }
-    $_SESSION['access_all_exception'] = '0';
-
-    sleep(0.025);
-  }
-
-  // Update the pagination variables for the next batch
-  $start += $max;
-  sleep(1);
-}
-
-logMsg("info", "DONE!");
-// add last execution time to lock file
-$lock_file_handle = fopen($lock_file, 'w');
-fwrite($lock_file_handle, getmypid() . "\n" . time());
-fclose($lock_file_handle);
-session_destroy();

data/conf/phpfpm/crons/ldap-sync.php

@@ -1,198 +0,0 @@
-<?php
-
-require_once(__DIR__ . '/../web/inc/vars.inc.php');
-if (file_exists(__DIR__ . '/../web/inc/vars.local.inc.php')) {
-  include_once(__DIR__ . '/../web/inc/vars.local.inc.php');
-}
-require_once __DIR__ . '/../web/inc/lib/vendor/autoload.php';
-
-// Init database
-//$dsn = $database_type . ':host=' . $database_host . ';dbname=' . $database_name;
-$dsn = $database_type . ":unix_socket=" . $database_sock . ";dbname=" . $database_name;
-$opt = [
-    PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
-    PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
-    PDO::ATTR_EMULATE_PREPARES   => false,
-];
-try {
-  $pdo = new PDO($dsn, $database_user, $database_pass, $opt);
-}
-catch (PDOException $e) {
-  logMsg("err", $e->getMessage());
-  session_destroy();
-  exit;
-}
-
-// Init Redis
-$redis = new Redis();
-try {
-  if (!empty(getenv('REDIS_SLAVEOF_IP'))) {
-    $redis->connect(getenv('REDIS_SLAVEOF_IP'), getenv('REDIS_SLAVEOF_PORT'));
-  }
-  else {
-    $redis->connect('redis-mailcow', 6379);
-  }
-  $redis->auth(getenv("REDISPASS"));
-}
-catch (Exception $e) {
-  echo "Exiting: " . $e->getMessage();
-  session_destroy();
-  exit;
-}
-
-function logMsg($priority, $message, $task = "LDAP Sync") {
-  global $redis;
-
-  $finalMsg = array(
-    "time" => time(),
-    "priority" => $priority,
-    "task" => $task,
-    "message" => $message
-  );
-  $redis->lPush('CRON_LOG', json_encode($finalMsg));
-}
-
-// Load core functions first
-require_once __DIR__ . '/../web/inc/functions.inc.php';
-require_once __DIR__ . '/../web/inc/functions.auth.inc.php';
-require_once __DIR__ . '/../web/inc/sessions.inc.php';
-require_once __DIR__ . '/../web/inc/functions.mailbox.inc.php';
-require_once __DIR__ . '/../web/inc/functions.ratelimit.inc.php';
-require_once __DIR__ . '/../web/inc/functions.acl.inc.php';
-
-$_SESSION['mailcow_cc_username'] = "admin";
-$_SESSION['mailcow_cc_role'] = "admin";
-$_SESSION['acl']['tls_policy'] = "1";
-$_SESSION['acl']['quarantine_notification'] = "1";
-$_SESSION['acl']['quarantine_category'] = "1";
-$_SESSION['acl']['ratelimit'] = "1";
-$_SESSION['acl']['sogo_access'] = "1";
-$_SESSION['acl']['protocol_access'] = "1";
-$_SESSION['acl']['mailbox_relayhost'] = "1";
-$_SESSION['acl']['unlimited_quota'] = "1";
-
-$iam_settings = identity_provider('get');
-if ($iam_settings['authsource'] != "ldap" || (intval($iam_settings['periodic_sync']) != 1 && intval($iam_settings['import_users']) != 1)) {
-  session_destroy();
-  exit;
-}
-
-// Set pagination variables
-$start = 0;
-$max = 100;
-
-// lock sync if already running
-$lock_file = '/tmp/iam-sync.lock';
-if (file_exists($lock_file)) {
-  $lock_file_parts = explode("\n", file_get_contents($lock_file));
-  $pid = $lock_file_parts[0];
-  if (count($lock_file_parts) > 1){
-    $last_execution = $lock_file_parts[1];
-    $elapsed_time = (time() - $last_execution) / 60;
-    if ($elapsed_time < intval($iam_settings['sync_interval'])) {
-      logMsg("warning", "Sync not ready (".number_format((float)$elapsed_time, 2, '.', '')."min / ".$iam_settings['sync_interval']."min)");
-      session_destroy();
-      exit;
-    }
-  }
-
-  if (posix_kill($pid, 0)) {
-    logMsg("warning", "Sync is already running");
-    session_destroy();
-    exit;
-  } else {
-    unlink($lock_file);
-  }
-}
-$lock_file_handle = fopen($lock_file, 'w');
-fwrite($lock_file_handle, getmypid());
-fclose($lock_file_handle);
-
-// Init Provider
-$iam_provider = identity_provider('init');
-
-// Get ldap users
-$ldap_query = $iam_provider->query();
-if (!empty($iam_settings['filter'])) {
-  $ldap_query = $ldap_query->rawFilter($iam_settings['filter']);
-}
-$response = $ldap_query->where($iam_settings['username_field'], "*")
-  ->where($iam_settings['attribute_field'], "*")
-  ->select([$iam_settings['username_field'], $iam_settings['attribute_field'], 'displayname'])
-  ->paginate($max);
-
-// Process the users
-foreach ($response as $user) {
-  // try get mailbox user
-  $stmt = $pdo->prepare("SELECT
-    mailbox.*,
-    domain.active AS d_active
-    FROM `mailbox`
-    INNER JOIN domain on mailbox.domain = domain.domain
-    WHERE `kind` NOT REGEXP 'location|thing|group'
-      AND `username` = :user");
-  $stmt->execute(array(':user' => $user[$iam_settings['username_field']][0]));
-  $row = $stmt->fetch(PDO::FETCH_ASSOC);
-
-  // check if matching attribute mapping exists
-  $user_template = $user[$iam_settings['attribute_field']][0];
-  $mapper_key = array_search($user_template, $iam_settings['mappers']);
-
-  if (empty($user[$iam_settings['username_field']][0])){
-    logMsg("warning", "Skipping user " . $user['displayname'][0] . " due to empty LDAP ". $iam_settings['username_field'] . " property.");
-    continue;
-  }
-
-  $_SESSION['access_all_exception'] = '1';
-  if (!$row && intval($iam_settings['import_users']) == 1){
-    if ($mapper_key === false){
-      if (!empty($iam_settings['default_template'])) {
-        $mbox_template = $iam_settings['default_template'];
-      } else {
-        logMsg("warning", "No matching attribute mapping found for user " . $user[$iam_settings['username_field']][0]);
-        continue;
-      }
-    } else {
-      $mbox_template = $iam_settings['templates'][$mapper_key];
-    }
-    // mailbox user does not exist, create...
-    logMsg("info", "Creating user " .  $user[$iam_settings['username_field']][0]);
-    $create_res = mailbox('add', 'mailbox_from_template', array(
-      'domain' => explode('@',  $user[$iam_settings['username_field']][0])[1],
-      'local_part' => explode('@',  $user[$iam_settings['username_field']][0])[0],
-      'name' => $user['displayname'][0],
-      'authsource' => 'ldap',
-      'template' => $mbox_template
-    ));
-    if (!$create_res){
-      logMsg("err", "Could not create user " . $user[$iam_settings['username_field']][0]);
-      continue;
-    }
-  } else if ($row && intval($iam_settings['periodic_sync']) == 1 && $row['authsource'] == "ldap") {
-    if ($mapper_key === false){
-      logMsg("warning", "No matching attribute mapping found for user " . $user[$iam_settings['username_field']][0]);
-      continue;
-    }
-    $mbox_template = $iam_settings['templates'][$mapper_key];
-    // mailbox user does exist, sync attribtues...
-    logMsg("info", "Syncing attributes for user " . $user[$iam_settings['username_field']][0]);
-    mailbox('edit', 'mailbox_from_template', array(
-      'username' =>  $user[$iam_settings['username_field']][0],
-      'name' => $user['displayname'][0],
-      'template' => $mbox_template
-    ));
-  } else {
-    // skip mailbox user
-    logMsg("info", "Skipping user " .  $user[$iam_settings['username_field']][0]);
-  }
-  $_SESSION['access_all_exception'] = '0';
-
-  sleep(0.025);
-}
-
-logMsg("info", "DONE!");
-// add last execution time to lock file
-$lock_file_handle = fopen($lock_file, 'w');
-fwrite($lock_file_handle, getmypid() . "\n" . time());
-fclose($lock_file_handle);
-session_destroy();

data/web/admin/mailbox.php

@@ -10,6 +10,7 @@ $_SESSION['return_to'] = $_SERVER['REQUEST_URI'];
 
 
 $js_minifier->add('/web/js/site/imapsync.js');
+$js_minifier->add('/web/js/site/groups.js');
 $js_minifier->add('/web/js/site/mailbox.js');
 $js_minifier->add('/web/js/presets/sieveMailbox.js');
 $js_minifier->add('/web/js/site/pwgen.js');
@@ -39,6 +40,7 @@ $template_data = [
   'global_filters' => mailbox('get', 'global_filter_details'),
   'domains' => $domains,
   'mailboxes' => $mailboxes,
+  'mbox_templates' => mailbox('get', 'mailbox_templates'),
   'lang_mailbox' => json_encode($lang['mailbox']),
   'lang_rl' => json_encode($lang['ratelimit']),
   'lang_edit' => json_encode($lang['edit']),

data/web/admin/system.php

@@ -12,6 +12,7 @@ $fido2_data = fido2(array("action" => "get_friendly_names"));
 $js_minifier->add('/web/js/site/admin.js');
 $js_minifier->add('/web/js/presets/rspamd.js');
 $js_minifier->add('/web/js/site/pwgen.js');
+$js_minifier->add('/web/js/site/identity.js');
 
 // all domains
 $domains = mailbox('get', 'domains');

data/web/api/openapi.yaml

@@ -1260,9 +1260,123 @@ paths:
                 tls_enforce_out:
                   description: force oubound tmail tls encryption
                   type: boolean
+                shared:
+                  description: >-
+                    shared mailbox: no login of its own, members of groups open it through shares;
+                    password and password2 may be empty (a random password is set)
+                  type: boolean
               type: object
       summary: Create mailbox
 
+  /api/v1/add/mailbox-group:
+    post:
+      responses:
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "200":
+          content:
+            application/json:
+              examples:
+                response:
+                  value:
+                    - log:
+                        - mailbox_group
+                        - add
+                        - group
+                        - domain: example.org
+                          name: Sales
+                          local_part: sales
+                          members:
+                            - alice@example.org
+                      msg:
+                        - group_added
+                        - Sales
+                      type: success
+              schema:
+                properties:
+                  log:
+                    description: contains request object
+                    items: {}
+                    type: array
+                  msg:
+                    items: {}
+                    type: array
+                  type:
+                    enum:
+                      - success
+                      - danger
+                      - warning
+                      - error
+                    type: string
+                type: object
+          description: OK
+          headers: {}
+      tags:
+        - Groups
+      description: >-
+        Create a mailbox group (admins; domain admins with the "mailbox_groups"
+        ACL for their domains). With an address the group is a distribution
+        list; its alias is maintained by the group and read-only in the alias
+        API.
+      operationId: Create group
+      requestBody:
+        content:
+          application/json:
+            schema:
+              example:
+                domain: example.org
+                name: Sales
+                local_part: sales
+                members:
+                  - alice@example.org
+                  - bob@example.org
+                send_as:
+                  - shared@example.org
+                sender_allowed: "1"
+                active: "1"
+              properties:
+                domain:
+                  description: domain of the group (required)
+                  type: string
+                name:
+                  description: unique per domain, max. 100 characters
+                  type: string
+                description:
+                  description: max. 255 characters
+                  type: string
+                local_part:
+                  description: local part of the group address (domain of the group), empty = no address
+                  type: string
+                address:
+                  description: full group address instead of local_part, empty = no address
+                  type: string
+                members:
+                  description: >-
+                    mailboxes (array or list separated by commas, spaces or
+                    newlines); replaces the manual members you may access
+                  type: array
+                send_as:
+                  description: addresses (mailbox or alias) or @domain the members may send as
+                  type: array
+                sender_allowed:
+                  description: members may send as the group address
+                  type: boolean
+                sogo_visible:
+                  description: show the group address as SOGo identity (needs sender_allowed)
+                  type: boolean
+                internal:
+                  description: only accept mail from senders of the domain
+                  type: boolean
+                template_id:
+                  description: mailbox template applied to the members (admin only), empty = none
+                  type: number
+                priority:
+                  description: highest priority wins if a mailbox is in several groups with a template (admin only)
+                  type: number
+                active:
+                  type: boolean
+              type: object
+      summary: Create group
   /api/v1/add/oauth2-client:
     post:
       responses:
@@ -2673,6 +2787,103 @@ paths:
                   type: object
               type: object
       summary: Delete mailbox
+  /api/v1/delete/mailbox-group:
+    post:
+      responses:
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "200":
+          content:
+            application/json:
+              examples:
+                response:
+                  value:
+                    - log:
+                        - mailbox_group
+                        - delete
+                        - group
+                        - id:
+                            - "7"
+                      msg:
+                        - group_removed
+                        - Sales
+                      type: success
+              schema:
+                properties:
+                  log:
+                    description: contains request object
+                    items: {}
+                    type: array
+                  msg:
+                    items: {}
+                    type: array
+                  type:
+                    enum:
+                      - success
+                      - danger
+                      - warning
+                      - error
+                    type: string
+                type: object
+          description: OK
+          headers: {}
+      tags:
+        - Groups
+      description: >-
+        Delete groups by ID. Members keep their settings; their group alias and
+        send-as rights of the group are removed.
+      operationId: Delete groups
+      requestBody:
+        content:
+          application/json:
+            schema:
+              example:
+                - "7"
+              properties:
+                items:
+                  description: contains list of group IDs you want to delete
+                  type: object
+              type: object
+      summary: Delete groups
+  /api/v1/delete/identity-link:
+    post:
+      responses:
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "200":
+          content:
+            application/json:
+              examples:
+                response:
+                  value:
+                    - log:
+                        - identity_provider
+                        - delete
+                        - link
+                        - - alice@example.org
+                      msg:
+                        - iam_link_removed
+                        - alice@example.org
+                      type: success
+          description: OK
+          headers: {}
+      tags:
+        - Identity Provider
+      description: >-
+        Removes the link between mailboxes and their Identity Provider users (admins only). The mailbox is
+        linked again by email on the next sync run or login, e.g. after its address was given to another
+        Identity Provider user.
+      operationId: Delete identity links
+      requestBody:
+        content:
+          application/json:
+            schema:
+              example:
+                - alice@example.org
+              items:
+                type: string
+              type: array
+      summary: Delete identity links
   /api/v1/delete/mailq:
     post:
       responses:
@@ -4025,6 +4236,9 @@ paths:
                     sogo_access:
                       description: is access to SOGo webmail active or not
                       type: boolean
+                    shared:
+                      description: shared mailbox, no login of its own (IMAP, SMTP, SOGo, app passwords, mailcow UI)
+                      type: boolean
                   type: object
                 items:
                   description: contains list of mailboxes you want update
@@ -4111,6 +4325,219 @@ paths:
                   type: object
               type: object
       summary: Update mailbox custom attributes
+  /api/v1/edit/mailbox-group:
+    post:
+      responses:
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "200":
+          content:
+            application/json:
+              examples:
+                response:
+                  value:
+                    - log:
+                        - mailbox_group
+                        - edit
+                        - group
+                        - id:
+                            - "7"
+                          add_members:
+                            - carol@example.org
+                      msg:
+                        - group_modified
+                        - Sales
+                      type: success
+              schema:
+                properties:
+                  log:
+                    description: contains request object
+                    items: {}
+                    type: array
+                  msg:
+                    items: {}
+                    type: array
+                  type:
+                    enum:
+                      - success
+                      - danger
+                      - warning
+                      - error
+                    type: string
+                type: object
+          description: OK
+          headers: {}
+      tags:
+        - Groups
+      description: >-
+        Update groups. Attributes you do not send keep their value. Members
+        synced from the identity provider cannot be removed here
+        (group_member_idp).
+      operationId: Update groups
+      requestBody:
+        content:
+          application/json:
+            schema:
+              example:
+                items:
+                  - "7"
+                attr:
+                  add_members:
+                    - carol@example.org
+              properties:
+                attr:
+                  properties:
+                    name:
+                      description: unique per domain, max. 100 characters
+                      type: string
+                    description:
+                      description: max. 255 characters
+                      type: string
+                    local_part:
+                      description: local part of the group address (domain of the group), empty = no address
+                      type: string
+                    address:
+                      description: full group address instead of local_part, empty = no address
+                      type: string
+                    members:
+                      description: >-
+                        mailboxes (array or list separated by commas, spaces or
+                        newlines); replaces the manual members you may access
+                      type: array
+                    send_as:
+                      description: addresses (mailbox or alias) or @domain the members may send as
+                      type: array
+                    sender_allowed:
+                      description: members may send as the group address
+                      type: boolean
+                    sogo_visible:
+                      description: show the group address as SOGo identity (needs sender_allowed)
+                      type: boolean
+                    internal:
+                      description: only accept mail from senders of the domain
+                      type: boolean
+                    template_id:
+                      description: mailbox template applied to the members (admin only), empty = none
+                      type: number
+                    priority:
+                      description: highest priority wins if a mailbox is in several groups with a template (admin only)
+                      type: number
+                    active:
+                      type: boolean
+                    add_members:
+                      description: mailboxes to add
+                      type: array
+                    remove_members:
+                      description: manual members to remove
+                      type: array
+                    reapply_template:
+                      description: apply the effective templates to all members again (admin only)
+                      type: boolean
+                    imap_grants:
+                      description: >-
+                        replaces the mailbox access of the members (Dovecot ACL on every folder of the
+                        mailbox, shown as Shared/<mailbox>); rights read, write or full; you need access
+                        to each mailbox; subscribe = the group-grants cron subscribes the folders for every
+                        member once (within 15 minutes)
+                      type: array
+                      items:
+                        type: object
+                        properties:
+                          owner:
+                            type: string
+                          rights:
+                            type: string
+                            enum: [read, write, full]
+                          subscribe:
+                            type: boolean
+                            default: false
+                      example:
+                        - owner: shared@example.org
+                          rights: write
+                          subscribe: true
+                    sogo_grants:
+                      description: >-
+                        replaces the SOGo folders shared with the members; folder = SOGo folder ID
+                        (default personal); pending until the mailbox opened SOGo once; subscribe = the
+                        group-grants cron subscribes every member once (within 15 minutes)
+                      type: array
+                      items:
+                        type: object
+                        properties:
+                          owner:
+                            type: string
+                          type:
+                            type: string
+                            enum: [Calendar, Contacts]
+                          folder:
+                            type: string
+                            default: personal
+                          access:
+                            type: string
+                            enum: [read, write]
+                          subscribe:
+                            type: boolean
+                            default: false
+                      example:
+                        - owner: shared@example.org
+                          type: Calendar
+                          access: write
+                          subscribe: true
+                  type: object
+                items:
+                  description: contains list of group IDs you want to update
+                  type: object
+              type: object
+      summary: Update groups
+  /api/v1/edit/identity-provider-sync:
+    post:
+      responses:
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "200":
+          content:
+            application/json:
+              examples:
+                response:
+                  value:
+                    - log:
+                        - identity_provider
+                        - edit
+                        - sync
+                        - mode: preview
+                      msg: iam_sync_requested
+                      type: success
+          description: OK
+          headers: {}
+      tags:
+        - Identity Provider
+      description: >-
+        Queues a sync run of the Identity Provider (Keycloak and LDAP, admins only). The identity-sync cron
+        starts it within a minute. `preview` lists the changes without applying them, `run` applies them,
+        `force` applies them without the change limit (offboarding_limit).
+      operationId: Request identity sync run
+      requestBody:
+        content:
+          application/json:
+            schema:
+              example:
+                items:
+                  - sync
+                attr:
+                  mode: preview
+              properties:
+                items:
+                  type: array
+                  default: ["sync"]
+                attr:
+                  type: object
+                  properties:
+                    mode:
+                      type: string
+                      enum: [preview, run, force]
+                      default: run
+              type: object
+      summary: Request identity sync run
   /api/v1/edit/mailq:
     post:
       responses:
@@ -5898,6 +6325,203 @@ paths:
       description: You can list all mailboxes existing in system.
       operationId: Get mailboxes
       summary: Get mailboxes
+  "/api/v1/get/mailbox-group/{id}":
+    get:
+      parameters:
+        - description: id of the group, or "all" (optionally followed by /domain1,domain2)
+          example: all
+          in: path
+          name: id
+          required: true
+          schema:
+            type: string
+        - description: e.g. api-key-string
+          example: api-key-string
+          in: header
+          name: X-API-Key
+          required: false
+          schema:
+            type: string
+      responses:
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "200":
+          content:
+            application/json:
+              examples:
+                response:
+                  value:
+                    - id: 7
+                      domain: example.org
+                      name: Sales
+                      description: Sales team
+                      address: sales@example.org
+                      sender_allowed: 1
+                      sogo_visible: 0
+                      internal: 0
+                      template_id: 3
+                      template: Staff
+                      priority: 10
+                      idp_ref: null
+                      members:
+                        - username: alice@example.org
+                          source: manual
+                        - username: bob@example.org
+                          source: idp
+                      send_as:
+                        - shared@example.org
+                      imap_grants:
+                        - owner: shared@example.org
+                          rights: write
+                          subscribe: 1
+                          state: applied
+                          last_error: null
+                      sogo_grants:
+                        - owner: shared@example.org
+                          type: Calendar
+                          folder: personal
+                          access: write
+                          subscribe: 1
+                          state: applied
+                          last_error: null
+                      active: 1
+                      created: "2026-10-25 12:00:00"
+                      modified: null
+                      can_edit: true
+          description: OK
+          headers: {}
+      tags:
+        - Groups
+      description: >-
+        Groups visible to the caller (admins all, domain admins their domains).
+      operationId: Get groups
+      summary: Get groups
+  "/api/v1/get/mailbox-group/member/{username}":
+    get:
+      parameters:
+        - description: mailbox
+          example: alice@example.org
+          in: path
+          name: username
+          required: true
+          schema:
+            type: string
+      responses:
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "200":
+          content:
+            application/json:
+              examples:
+                response:
+                  value:
+                    groups:
+                      - id: 7
+                        domain: example.org
+                        name: Sales
+                        address: sales@example.org
+                        sender_allowed: 1
+                        active: 1
+                        priority: 10
+                        template: Staff
+                        source: manual
+                    template: Staff
+                    send_as:
+                      - sales@example.org
+                      - shared@example.org
+          description: OK
+          headers: {}
+      tags:
+        - Groups
+      description: >-
+        Groups of a mailbox, its effective group template and the addresses it
+        may send as through groups.
+      operationId: Get group memberships
+      summary: Get group memberships
+  /api/v1/get/identity-provider/sync-status:
+    get:
+      responses:
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "200":
+          content:
+            application/json:
+              examples:
+                response:
+                  value:
+                    provider: keycloak
+                    can_sync: true
+                    sync_enabled: true
+                    counts:
+                      accounts: 120
+                      linked: 118
+                      idp_disabled: 2
+                      missing: 1
+                    runs:
+                      - id: 42
+                        provider: keycloak
+                        mode: run
+                        status: ok
+                        requested_by: ""
+                        created: "2026-10-25 12:00:00"
+                        started: "2026-10-25 12:00:01"
+                        finished: "2026-10-25 12:00:03"
+                        summary:
+                          counts:
+                            creates: 1
+                            deactivate: 1
+                            memberships: 2
+                          details:
+                            creates:
+                              - new@example.org
+                            deactivate:
+                              - left@example.org
+                            conflicts: []
+                          errors: []
+                          blocked: false
+                          mode: run
+          description: OK
+          headers: {}
+      tags:
+        - Identity Provider
+      description: >-
+        Sync status (admins only): mailboxes of the Identity Provider and their links, and the last sync runs
+        with their summary. Run status: pending, running, ok, blocked (change limit), error (listing failed,
+        nothing was changed).
+      operationId: Get identity sync status
+      summary: Get identity sync status
+  "/api/v1/get/identity-link/{username}":
+    get:
+      parameters:
+        - description: mailbox
+          example: alice@example.org
+          in: path
+          name: username
+          required: true
+          schema:
+            type: string
+      responses:
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "200":
+          content:
+            application/json:
+              examples:
+                response:
+                  value:
+                    provider: keycloak
+                    external_id: 8d5da28d-7541-428b-8356-a9704f73e7f4
+                    idp_disabled: 0
+                    missing_since: null
+          description: OK
+          headers: {}
+      tags:
+        - Identity Provider
+      description: >-
+        Identity Provider user a mailbox is linked to (admins, and domain admins for their mailboxes).
+        `idp_disabled` = login was disabled by the sync, `missing_since` = not listed by the Identity Provider.
+      operationId: Get identity link
+      summary: Get identity link
   /api/v1/get/mailq/all:
     get:
       responses:
@@ -7199,7 +7823,7 @@ paths:
                       description: An optional LDAP search filter to refine which users can authenticate.
                       type: string
                     attribute_field:
-                      description: Specifies an LDAP attribute that holds a specific value which can be mapped to a mailbox template using the Attribute Mapping section. Required if `authsource` is ldap.
+                      description: (Optional) Specifies an LDAP attribute that holds a specific value which can be mapped to a mailbox template using the Attribute Mapping section.
                       type: string
                     binddn:
                       description: The Distinguished Name (DN) of the LDAP user that will be used to authenticate and perform LDAP searches. This account should have sufficient permissions to read the required attributes. Required if `authsource` is ldap.
@@ -7220,6 +7844,53 @@ paths:
                       description: Specifies the OIDC scopes requested during authentication.
                       type: string
                       default: "openid profile email mailcow_template"
+                    offboarding:
+                      description: (Keycloak, LDAP) Users disabled in the Identity Provider, or missing in two complete sync runs, get login disabled (mailbox active = 2, mail is still received). Only mailboxes disabled by the sync are enabled again.
+                      type: boolean
+                      default: false
+                    offboarding_limit:
+                      description: (Keycloak, LDAP) Sync runs that would disable more mailboxes or remove more group memberships than this share in percent (at least 5) are blocked.
+                      type: number
+                      default: 10
+                    group_sync:
+                      description: (Keycloak, LDAP) Syncs the members of Identity Provider groups to mailbox groups. Members added in mailcow stay.
+                      type: boolean
+                      default: false
+                    group_autocreate:
+                      description: (Keycloak, LDAP) Creates a mailbox group for every Identity Provider group without one. The group mail becomes its address if it is free.
+                      type: boolean
+                      default: false
+                    group_default_domain:
+                      description: (Keycloak, LDAP) Domain of new groups whose mail is not in a mailcow domain.
+                      type: string
+                    group_paths:
+                      description: (Keycloak) Comma-separated group paths, e.g. `/Sales` or `/mailcow/*` (all groups below /mailcow). Needs the `query-groups` permission.
+                      type: string
+                    id_attribute:
+                      description: (LDAP) Attribute with a stable user id. Empty = objectGUID, entryUUID, nsUniqueId or ipaUniqueID. Changing it links all mailboxes again by email.
+                      type: string
+                    disabled_filter:
+                      description: (LDAP) Filter for disabled users. Active Directory accounts with ACCOUNTDISABLE in userAccountControl are always disabled.
+                      type: string
+                    group_basedn:
+                      description: (LDAP) Base DN of the group search, default `basedn`.
+                      type: string
+                    group_filter:
+                      description: (LDAP) Filter for the synced groups, required for group sync.
+                      type: string
+                    group_name_attribute:
+                      description: (LDAP) Attribute with the group name.
+                      type: string
+                      default: cn
+                    group_member_mode:
+                      description: "(LDAP) Source of the memberships: memberof (memberOf of the users), member (member attribute of the groups) or ad_chain (Active Directory incl. nested groups)."
+                      type: string
+                      enum: [memberof, member, ad_chain]
+                      default: memberof
+                    group_member_attribute:
+                      description: (LDAP) Member attribute for group_member_mode member, e.g. member or uniqueMember.
+                      type: string
+                      default: member
             examples:
               keycloak:
                 value:
@@ -7320,6 +7991,8 @@ tags:
     description: Use mailcow as a oAuth server
   - name: API Keys
     description: Manage API keys
+  - name: Groups
+    description: Mailbox groups (distribution lists, send-as rights, templates)
   - name: Routing
     description: Define your own email routes
   - name: Resources

data/web/domainadmin/mailbox.php

@@ -10,6 +10,7 @@ $_SESSION['return_to'] = $_SERVER['REQUEST_URI'];
 
 
 $js_minifier->add('/web/js/site/imapsync.js');
+$js_minifier->add('/web/js/site/groups.js');
 $js_minifier->add('/web/js/site/mailbox.js');
 $js_minifier->add('/web/js/presets/sieveMailbox.js');
 $js_minifier->add('/web/js/site/pwgen.js');

data/web/edit.php

@@ -99,6 +99,22 @@ if (isset($_SESSION['mailcow_cc_role'])) {
         $template = 'edit/oauth2client.twig';
         $template_data = ['oauth2client' => $oauth2client];
     }
+    elseif (isset($_GET['mailbox-group']) &&
+      is_numeric($_GET['mailbox-group'])) {
+        $result = \Mailcow\MailboxGroup\MailboxGroupModule::fromGlobals()->api->getGroup($_GET['mailbox-group']);
+        $template = 'edit/mailbox-group.twig';
+        // Member candidates: mailboxes of the domains the caller manages
+        $mailboxes = [];
+        foreach (mailbox('get', 'domains') as $domain) {
+          foreach (mailbox('get', 'mailboxes', $domain) as $mailbox) {
+            $mailboxes[] = $mailbox;
+          }
+        }
+        $template_data = [
+          'mailboxes' => $mailboxes,
+          'mbox_templates' => ($_SESSION['mailcow_cc_role'] == 'admin') ? mailbox('get', 'mailbox_templates') : [],
+        ];
+    }
     elseif (isset($_GET['api-key']) &&
       is_numeric($_GET['api-key'])) {
         $result = \Mailcow\ApiKey\ApiKeyModule::fromGlobals()->api->getKey($_GET['api-key']);
@@ -141,6 +157,8 @@ if (isset($_SESSION['mailcow_cc_role'])) {
           'get_tls_policy' => $get_tls_policy,
           'rlyhosts' => $rlyhosts,
           'sender_acl_handles' => mailbox('get', 'sender_acl_handles', $mailbox),
+          'mailbox_groups' => \Mailcow\MailboxGroup\MailboxGroupModule::fromGlobals()->api->getMemberships($mailbox),
+          'identity_link' => \Mailcow\Identity\IdentityModule::fromGlobals()->api->getLink($mailbox),
           'user_acls' => acl('get', 'user', $mailbox),
           'mailbox_details' => $result,
           'iam_settings' => $iam_settings,
@@ -237,6 +255,7 @@ else {
 }
 
 $js_minifier->add('/web/js/site/imapsync.js');
+$js_minifier->add('/web/js/site/groups.js');
 $js_minifier->add('/web/js/site/edit.js');
 $js_minifier->add('/web/js/site/pwgen.js');
 

data/web/inc/footer.inc.php

@@ -73,6 +73,7 @@ $globalVariables = [
   'lang_success' => json_encode($lang['success']),
   'lang_danger' => json_encode($lang['danger']),
   'lang_syncjobs' => json_encode($lang['syncjobs']),
+  'lang_groups' => json_encode($lang['groups']),
   'docker_timeout' => $DOCKER_TIMEOUT,
   'session_lifetime' => (int)$SESSION_LIFETIME,
   'csrf_token' => $_SESSION['CSRF']['TOKEN'],

data/web/inc/functions.auth.inc.php

@@ -262,12 +262,20 @@ function user_login($user, $pass, $extra = null){
 
   // check if user has access to service (imap, smtp, pop3, sieve) if service is set
   $row['attributes'] = json_decode($row['attributes'], true);
+  // Shared mailboxes have no login of their own, members open them through group shares
+  if (($row['attributes']['shared'] ?? '0') == '1') {
+    return false;
+  }
   if ($extra['service'] != 'NONE') {
     $key = strtolower($extra['service']) . "_access";
     if (isset($row['attributes'][$key]) && $row['attributes'][$key] != '1') {
       return false;
     }
   }
+  // IdP accounts: refuse inactive mailboxes and domains before asking the IdP (no template side effects)
+  if ($row['authsource'] != 'mailcow' && ($row['active'] != '1' || $row['d_active'] != '1')) {
+    return false;
+  }
   switch ($row['authsource']) {
     case 'keycloak':
       // user authsource is keycloak, try using via rest flow
@@ -462,6 +470,7 @@ function apppass_login($user, $pass, $extra = null){
       AND `mailbox`.`active` = '1'
       AND `domain`.`active` = '1'
       AND `app_passwd`.`active` = '1'
+      AND COALESCE(JSON_UNQUOTE(JSON_VALUE(`mailbox`.`attributes`, '$.shared')), '0') != '1'
       AND `app_passwd`.`mailbox` = :user"
   );
   // fetch password data
@@ -525,7 +534,11 @@ function keycloak_mbox_login_rest($user, $pass, $extra = null){
       'Authorization: Bearer ' . $admin_token,
       'Content-Type: application/json'
   ));
-  $user_res = json_decode(curl_exec($curl), true)[0];
+  if (intval($iam_settings['ignore_ssl_error']) == 1) {
+    curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, false);
+    curl_setopt($curl, CURLOPT_SSL_VERIFYHOST, 0);
+  }
+  $users = json_decode(curl_exec($curl), true);
   $code = curl_getinfo($curl, CURLINFO_HTTP_CODE);
   curl_close($curl);
   if ($code != 200) {
@@ -536,6 +549,14 @@ function keycloak_mbox_login_rest($user, $pass, $extra = null){
     );
     return false;
   }
+  // exact=true can still return several users with that email
+  if (!is_array($users) || count($users) != 1) {
+    return false;
+  }
+  $user_res = $users[0];
+  if (empty($user_res['enabled'])) {
+    return false;
+  }
   if (!isset($user_res['attributes']['mailcow_password']) || !is_array($user_res['attributes']['mailcow_password'])){
     $_SESSION['return'][] =  array(
       'type' => 'danger',
@@ -560,18 +581,28 @@ function keycloak_mbox_login_rest($user, $pass, $extra = null){
   }
 
   // get mapped template
-  $user_template = $user_res['attributes']['mailcow_template'][0];
-  $mapper_key = array_search($user_template, $iam_settings['mappers']);
+  $name = trim(($user_res['firstName'] ?? '') . ' ' . ($user_res['lastName'] ?? ''));
+  $idp_login = \Mailcow\Auth\AuthModule::fromGlobals()->idp;
+  $mapped_template = $idp_login->mappedTemplate($user_res['attributes']['mailcow_template'] ?? array());
 
   if (!$create) {
+    if (!$idp_login->verifyLink('keycloak', $user, (string)($user_res['id'] ?? ''))) {
+      $_SESSION['return'][] =  array(
+        'type' => 'danger',
+        'log' => array(__FUNCTION__, $user, '*', 'The mailbox is linked to another IdP user'),
+        'msg' => 'generic_server_error'
+      );
+      return false;
+    }
     // login success
-    if ($mapper_key !== false) {
+    $update_template = $idp_login->templateFor($user, $mapped_template);
+    if ($update_template !== null) {
       // update user
       $_SESSION['access_all_exception'] = '1';
       mailbox('edit', 'mailbox_from_template', array(
         'username' => $user,
-        'name' => $user_res['name'],
-        'template' => $iam_settings['templates'][$mapper_key]
+        'name' => $name,
+        'template' => $update_template
       ));
       $_SESSION['access_all_exception'] = '0';
     }
@@ -590,7 +621,7 @@ function keycloak_mbox_login_rest($user, $pass, $extra = null){
     return false;
   }
   // check if matching attribute exist
-  if (empty($iam_settings['mappers']) || !$user_template || $mapper_key === false) {
+  if ($mapped_template === null) {
     if (!empty($iam_settings['default_template'])) {
       $mbox_template = $iam_settings['default_template'];
     } else {
@@ -602,7 +633,16 @@ function keycloak_mbox_login_rest($user, $pass, $extra = null){
       return false;
     }
   } else {
-    $mbox_template = $iam_settings['templates'][$mapper_key];
+    $mbox_template = $mapped_template;
+  }
+
+  if (!$idp_login->mayCreate('keycloak', $user, (string)($user_res['id'] ?? ''))) {
+    $_SESSION['return'][] =  array(
+      'type' => 'danger',
+      'log' => array(__FUNCTION__, $user, '*', 'The IdP user is linked to another mailbox'),
+      'msg' => 'generic_server_error'
+    );
+    return false;
   }
 
   // create mailbox
@@ -610,7 +650,7 @@ function keycloak_mbox_login_rest($user, $pass, $extra = null){
   $create_res = mailbox('add', 'mailbox_from_template', array(
     'domain' => explode('@', $user)[1],
     'local_part' => explode('@', $user)[0],
-    'name' => $user_res['name'],
+    'name' => $name,
     'authsource' => 'keycloak',
     'template' => $mbox_template
   ));
@@ -624,6 +664,7 @@ function keycloak_mbox_login_rest($user, $pass, $extra = null){
     );
     return false;
   }
+  $idp_login->storeLink('keycloak', $user, (string)($user_res['id'] ?? ''));
 
   return 'user';
 }
@@ -655,7 +696,8 @@ function ldap_mbox_login($user, $pass, $extra = null){
       $ldap_query = $ldap_query->rawFilter($iam_settings['filter']);
     }
     $ldap_query = $ldap_query->where($iam_settings['username_field'], '=', $user)
-      ->select([$iam_settings['username_field'], $iam_settings['attribute_field'], 'displayname', 'distinguishedname', 'dn']);
+      ->select(array_values(array_filter(array_merge([$iam_settings['username_field'], $iam_settings['attribute_field'], 'displayname', 'distinguishedname', 'dn'],
+        \Mailcow\Identity\Directory\LdapDirectory::idAttributes($iam_settings['id_attribute'] ?? '')))));
 
     $user_res = $ldap_query->firstOrFail();
   } catch (Exception $e) {
@@ -684,18 +726,28 @@ function ldap_mbox_login($user, $pass, $extra = null){
   }
 
   // get mapped template
-  $user_template = $user_res[$iam_settings['attribute_field']][0];
-  $mapper_key = array_search($user_template, $iam_settings['mappers']);
+  $idp_login = \Mailcow\Auth\AuthModule::fromGlobals()->idp;
+  $mapped_template = $idp_login->mappedTemplate($user_res[$iam_settings['attribute_field']] ?? array());
+  $external_id = \Mailcow\Identity\Directory\LdapDirectory::entryId($user_res, $iam_settings['id_attribute'] ?? '');
 
   if (!$create) {
+    if (!$idp_login->verifyLink('ldap', $user, $external_id)) {
+      $_SESSION['return'][] =  array(
+        'type' => 'danger',
+        'log' => array(__FUNCTION__, $user, '*', 'The mailbox is linked to another IdP user'),
+        'msg' => 'generic_server_error'
+      );
+      return false;
+    }
     // login success
-    if ($mapper_key !== false) {
+    $update_template = $idp_login->templateFor($user, $mapped_template);
+    if ($update_template !== null) {
       // update user
       $_SESSION['access_all_exception'] = '1';
       mailbox('edit', 'mailbox_from_template', array(
         'username' => $user,
         'name' => $user_res['displayname'][0],
-        'template' => $iam_settings['templates'][$mapper_key]
+        'template' => $update_template
       ));
       $_SESSION['access_all_exception'] = '0';
     }
@@ -714,7 +766,7 @@ function ldap_mbox_login($user, $pass, $extra = null){
     return false;
   }
   // check if matching attribute exist
-  if (empty($iam_settings['mappers']) || !$user_template || $mapper_key === false) {
+  if ($mapped_template === null) {
     if (!empty($iam_settings['default_template'])) {
       $mbox_template = $iam_settings['default_template'];
     } else {
@@ -726,7 +778,16 @@ function ldap_mbox_login($user, $pass, $extra = null){
       return false;
     }
   } else {
-    $mbox_template = $iam_settings['templates'][$mapper_key];
+    $mbox_template = $mapped_template;
+  }
+
+  if (!$idp_login->mayCreate('ldap', $user, $external_id)) {
+    $_SESSION['return'][] =  array(
+      'type' => 'danger',
+      'log' => array(__FUNCTION__, $user, '*', 'The IdP user is linked to another mailbox'),
+      'msg' => 'generic_server_error'
+    );
+    return false;
   }
 
   // create mailbox
@@ -748,6 +809,7 @@ function ldap_mbox_login($user, $pass, $extra = null){
     );
     return false;
   }
+  $idp_login->storeLink('ldap', $user, $external_id);
 
   return 'user';
 }

data/web/inc/functions.inc.php

@@ -2360,6 +2360,7 @@ function identity_provider($_action = null, $_data = null, $_extra = null) {
   $data_log = $_data;
   if (isset($data_log['client_secret'])) $data_log['client_secret'] = '*';
   if (isset($data_log['access_token'])) $data_log['access_token'] = '*';
+  if (isset($data_log['bindpass'])) $data_log['bindpass'] = '*';
 
   switch ($_action) {
     case 'get':
@@ -2370,9 +2371,12 @@ function identity_provider($_action = null, $_data = null, $_extra = null) {
       foreach($rows as $row){
         switch ($row["key"]) {
           case "redirect_url_extra":
+            $settings[$row["key"]] = json_decode($row["value"]);
+          break;
           case "mappers":
           case "templates":
-            $settings[$row["key"]] = json_decode($row["value"]);
+            // Parallel lists; older rows can be JSON objects, decode as arrays to keep the keys aligned
+            $settings[$row["key"]] = (array)json_decode($row["value"], true);
           break;
           case "use_ssl":
           case "use_tls":
@@ -2455,6 +2459,13 @@ function identity_provider($_action = null, $_data = null, $_extra = null) {
 
       $_data['ignore_ssl_error']    = isset($_data['ignore_ssl_error']) ? boolval($_data['ignore_ssl_error']) : false;
       $_data['login_provisioning']  = isset($_data['login_provisioning']) ? boolval($_data['login_provisioning']) : false;
+      // Identity sync: offboarding and groups (Keycloak and LDAP)
+      $sync_settings = array('offboarding', 'offboarding_limit', 'group_sync', 'group_autocreate', 'group_default_domain');
+      $_data['offboarding']          = isset($_data['offboarding']) ? intval($_data['offboarding']) : 0;
+      $_data['offboarding_limit']    = isset($_data['offboarding_limit']) && is_numeric($_data['offboarding_limit']) ? min(100, max(0, intval($_data['offboarding_limit']))) : 10;
+      $_data['group_sync']           = isset($_data['group_sync']) ? intval($_data['group_sync']) : 0;
+      $_data['group_autocreate']     = isset($_data['group_autocreate']) ? intval($_data['group_autocreate']) : 0;
+      $_data['group_default_domain'] = isset($_data['group_default_domain']) ? strtolower(trim($_data['group_default_domain'])) : "";
       switch ($_data['authsource']) {
         case "keycloak":
           $_data['server_url']        = (!empty($_data['server_url'])) ? rtrim($_data['server_url'], '/') : null;
@@ -2463,7 +2474,8 @@ function identity_provider($_action = null, $_data = null, $_extra = null) {
           $_data['import_users']      = isset($_data['import_users']) ? intval($_data['import_users']) : 0;
           $_data['sync_interval']     = (!empty($_data['sync_interval'])) ? intval($_data['sync_interval']) : 15;
           $_data['sync_interval']     = $_data['sync_interval'] < 1 ? 1 : $_data['sync_interval'];
-          $required_settings          = array('authsource', 'server_url', 'realm', 'client_id', 'client_secret', 'redirect_url', 'version', 'mailpassword_flow', 'periodic_sync', 'import_users', 'sync_interval', 'ignore_ssl_error', 'login_provisioning');
+          $_data['group_paths']       = isset($_data['group_paths']) ? trim($_data['group_paths']) : "";
+          $required_settings          = array_merge(array('authsource', 'server_url', 'realm', 'client_id', 'client_secret', 'redirect_url', 'version', 'mailpassword_flow', 'periodic_sync', 'import_users', 'sync_interval', 'ignore_ssl_error', 'login_provisioning', 'group_paths'), $sync_settings);
         break;
         case "generic-oidc":
           $_data['authorize_url']     = (!empty($_data['authorize_url'])) ? $_data['authorize_url'] : null;
@@ -2484,7 +2496,14 @@ function identity_provider($_action = null, $_data = null, $_extra = null) {
           $_data['use_tls']           = isset($_data['use_tls']) && !$_data['use_ssl'] ? boolval($_data['use_tls']) : false;
           $_data['sync_interval']     = (!empty($_data['sync_interval'])) ? intval($_data['sync_interval']) : 15;
           $_data['sync_interval']     = $_data['sync_interval'] < 1 ? 1 : $_data['sync_interval'];
-          $required_settings          = array('authsource', 'host', 'port', 'basedn', 'username_field', 'filter', 'attribute_field', 'binddn', 'bindpass', 'periodic_sync', 'import_users', 'sync_interval', 'use_ssl', 'use_tls', 'ignore_ssl_error', 'login_provisioning');
+          $_data['id_attribute']      = isset($_data['id_attribute']) ? strtolower(trim($_data['id_attribute'])) : "";
+          $_data['disabled_filter']   = isset($_data['disabled_filter']) ? trim($_data['disabled_filter']) : "";
+          $_data['group_basedn']      = isset($_data['group_basedn']) ? trim($_data['group_basedn']) : "";
+          $_data['group_filter']      = isset($_data['group_filter']) ? trim($_data['group_filter']) : "";
+          $_data['group_name_attribute'] = (!empty($_data['group_name_attribute'])) ? strtolower(trim($_data['group_name_attribute'])) : "cn";
+          $_data['group_member_mode'] = isset($_data['group_member_mode']) && in_array($_data['group_member_mode'], array('memberof', 'member', 'ad_chain')) ? $_data['group_member_mode'] : "memberof";
+          $_data['group_member_attribute'] = (!empty($_data['group_member_attribute'])) ? strtolower(trim($_data['group_member_attribute'])) : "member";
+          $required_settings          = array_merge(array('authsource', 'host', 'port', 'basedn', 'username_field', 'filter', 'attribute_field', 'binddn', 'bindpass', 'periodic_sync', 'import_users', 'sync_interval', 'use_ssl', 'use_tls', 'ignore_ssl_error', 'login_provisioning', 'id_attribute', 'disabled_filter', 'group_basedn', 'group_filter', 'group_name_attribute', 'group_member_mode', 'group_member_attribute'), $sync_settings);
         break;
       }
 
@@ -2506,6 +2525,10 @@ function identity_provider($_action = null, $_data = null, $_extra = null) {
         $stmt->bindParam(':value', $_data[$setting]);
         $stmt->execute();
       }
+      // Stored LDAP ids of another id attribute never match again, the mailboxes are linked by email again
+      if ($_data['authsource'] == 'ldap' && ($iam_settings['id_attribute'] ?? '') != $_data['id_attribute']) {
+        $pdo->query("UPDATE `identity_link` SET `external_id` = NULL WHERE `provider` = 'ldap'");
+      }
       $pdo->commit();
 
       // add redirect_url_extra
@@ -2533,19 +2556,26 @@ function identity_provider($_action = null, $_data = null, $_extra = null) {
         $_data['mappers'] = (!is_array($_data['mappers'])) ? array($_data['mappers']) : $_data['mappers'];
         $_data['templates'] = (!is_array($_data['templates'])) ? array($_data['templates']) : $_data['templates'];
 
-        $mappers = array_filter($_data['mappers']);
-        $templates = array_filter($_data['templates']);
-        if (count($mappers) == count($templates)){
-          $mappers = json_encode($mappers);
-          $templates = json_encode($templates);
-
-          $stmt = $pdo->prepare("INSERT INTO identity_provider (`key`, `value`) VALUES ('mappers', :value) ON DUPLICATE KEY UPDATE `value` = VALUES(`value`);");
-          $stmt->bindParam(':value', $mappers);
-          $stmt->execute();
-          $stmt = $pdo->prepare("INSERT INTO identity_provider (`key`, `value`) VALUES ('templates', :value) ON DUPLICATE KEY UPDATE `value` = VALUES(`value`);");
-          $stmt->bindParam(':value', $templates);
-          $stmt->execute();
+        // Keep mapper/template pairs together, incomplete rows are dropped
+        $mappers = array();
+        $templates = array();
+        $template_values = array_values($_data['templates']);
+        foreach (array_values($_data['mappers']) as $i => $mapper) {
+          if ((string)$mapper === '' || (string)($template_values[$i] ?? '') === '') {
+            continue;
+          }
+          $mappers[] = $mapper;
+          $templates[] = $template_values[$i];
         }
+        $mappers = json_encode($mappers);
+        $templates = json_encode($templates);
+
+        $stmt = $pdo->prepare("INSERT INTO identity_provider (`key`, `value`) VALUES ('mappers', :value) ON DUPLICATE KEY UPDATE `value` = VALUES(`value`);");
+        $stmt->bindParam(':value', $mappers);
+        $stmt->execute();
+        $stmt = $pdo->prepare("INSERT INTO identity_provider (`key`, `value`) VALUES ('templates', :value) ON DUPLICATE KEY UPDATE `value` = VALUES(`value`);");
+        $stmt->bindParam(':value', $templates);
+        $stmt->execute();
       }
 
       // delete old access_token
@@ -2670,6 +2700,8 @@ function identity_provider($_action = null, $_data = null, $_extra = null) {
       }
 
       $stmt = $pdo->query("DELETE FROM identity_provider;");
+      $stmt = $pdo->query("DELETE FROM identity_link;");
+      $stmt = $pdo->query("DELETE FROM identity_sync_run;");
 
       $_SESSION['return'][] =  array(
         'type' => 'success',
@@ -2790,8 +2822,8 @@ function identity_provider($_action = null, $_data = null, $_extra = null) {
       }
 
       // get mapped template
-      $user_template = $info['mailcow_template'];
-      $mapper_key = array_search($user_template, $iam_settings['mappers']);
+      $idp_login = \Mailcow\Auth\AuthModule::fromGlobals()->idp;
+      $mapped_template = $idp_login->mappedTemplate($info['mailcow_template'] ?? array());
 
       // token valid, get mailbox
       $stmt = $pdo->prepare("SELECT
@@ -2813,13 +2845,23 @@ function identity_provider($_action = null, $_data = null, $_extra = null) {
           );
           return false;
         }
-        if ($mapper_key !== false) {
+        if (!$idp_login->verifyLink($iam_settings['authsource'], $info['email'], (string)($info['sub'] ?? ''))) {
+          clear_session();
+          $_SESSION['return'][] =  array(
+            'type' => 'danger',
+            'log' => array(__FUNCTION__, $info['email'], 'The mailbox is linked to another IdP user'),
+            'msg' => 'login_failed'
+          );
+          return false;
+        }
+        $update_template = $idp_login->templateFor($info['email'], $mapped_template);
+        if ($update_template !== null) {
           // update user
           $_SESSION['access_all_exception'] = '1';
           mailbox('edit', 'mailbox_from_template', array(
             'username' => $info['email'],
             'name' => $info['name'],
-            'template' => $iam_settings['templates'][$mapper_key]
+            'template' => $update_template
           ));
           $_SESSION['access_all_exception'] = '0';
 
@@ -2834,11 +2876,11 @@ function identity_provider($_action = null, $_data = null, $_extra = null) {
           $stmt->execute(array(':user' => $info['email']));
           $row = $stmt->fetch(PDO::FETCH_ASSOC);
         }
-        if ($row['active'] != 1 || $row['d_active'] != 1) {
+        if ($row['active'] != 1 || $row['d_active'] != 1 || (json_decode($row['attributes'], true)['shared'] ?? '0') == '1') {
           clear_session();
           $_SESSION['return'][] =  array(
             'type' => 'danger',
-            'log' => array(__FUNCTION__, $info['email'], 'Domain or mailbox is inactive'),
+            'log' => array(__FUNCTION__, $info['email'], 'Domain or mailbox is inactive or shared'),
             'msg' => 'login_failed'
           );
           return false;
@@ -2864,7 +2906,7 @@ function identity_provider($_action = null, $_data = null, $_extra = null) {
         return false;
       }
 
-      if (empty($iam_settings['mappers']) || empty($user_template) || $mapper_key === false){
+      if ($mapped_template === null){
         if (!empty($iam_settings['default_template'])) {
           $mbox_template = $iam_settings['default_template'];
         } else {
@@ -2877,7 +2919,17 @@ function identity_provider($_action = null, $_data = null, $_extra = null) {
           return false;
         }
       } else {
-        $mbox_template = $iam_settings['templates'][$mapper_key];
+        $mbox_template = $mapped_template;
+      }
+
+      if (!$idp_login->mayCreate($iam_settings['authsource'], $info['email'], (string)($info['sub'] ?? ''))) {
+        clear_session();
+        $_SESSION['return'][] =  array(
+          'type' => 'danger',
+          'log' => array(__FUNCTION__, $info['email'], 'The IdP user is linked to another mailbox'),
+          'msg' => 'login_failed'
+        );
+        return false;
       }
 
       // create mailbox
@@ -2899,6 +2951,7 @@ function identity_provider($_action = null, $_data = null, $_extra = null) {
         );
         return false;
       }
+      $idp_login->storeLink($iam_settings['authsource'], $info['email'], (string)($info['sub'] ?? ''));
 
       // double check if mailbox and domain is active
       $stmt = $pdo->prepare("SELECT * FROM `mailbox`
@@ -2955,6 +3008,26 @@ function identity_provider($_action = null, $_data = null, $_extra = null) {
         return false;
       }
 
+      // The mailbox may have been deleted or deactivated since the login
+      $stmt = $pdo->prepare("SELECT `mailbox`.`authsource` FROM `mailbox`
+        INNER JOIN `domain` ON `mailbox`.`domain` = `domain`.`domain`
+        WHERE `kind` NOT REGEXP 'location|thing|group'
+          AND `mailbox`.`active` = '1'
+          AND `domain`.`active` = '1'
+          AND COALESCE(JSON_UNQUOTE(JSON_VALUE(`mailbox`.`attributes`, '$.shared')), '0') != '1'
+          AND `username` = :user");
+      $stmt->execute(array(':user' => $info['email']));
+      $row = $stmt->fetch(PDO::FETCH_ASSOC);
+      if (!$row || !in_array($row['authsource'], array('keycloak', 'generic-oidc'))) {
+        clear_session();
+        $_SESSION['return'][] =  array(
+          'type' => 'danger',
+          'log' => array(__FUNCTION__, $info['email'], 'Mailbox or domain is inactive or not of type OIDC'),
+          'msg' => 'refresh_login_failed'
+        );
+        return false;
+      }
+
       set_user_loggedin_session($info['email']);
       $_SESSION['iam_token'] = $plain_token;
       $_SESSION['iam_refresh_token'] = $plain_refreshtoken;

data/web/inc/functions.mailbox.inc.php

@@ -938,6 +938,8 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
           $eas_access = (isset($_data['eas_access'])) ? intval($_data['eas_access']) : intval($MAILBOX_DEFAULT_ATTRIBUTES['eas_access']);
           $dav_access = (isset($_data['dav_access'])) ? intval($_data['dav_access']) : intval($MAILBOX_DEFAULT_ATTRIBUTES['dav_access']);
           $relayhost = (isset($_data['relayhost'])) ? intval($_data['relayhost']) : 0;
+          // Shared mailbox: no login of its own, members open it through group shares
+          $shared = (isset($_data['shared'])) ? intval($_data['shared']) : 0;
           $quarantine_notification = (isset($_data['quarantine_notification'])) ? strval($_data['quarantine_notification']) : strval($MAILBOX_DEFAULT_ATTRIBUTES['quarantine_notification']);
           $quarantine_category = (isset($_data['quarantine_category'])) ? strval($_data['quarantine_category']) : strval($MAILBOX_DEFAULT_ATTRIBUTES['quarantine_category']);
           // Validate quarantine_category
@@ -971,6 +973,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
               'eas_access' => strval($eas_access),
               'dav_access' => strval($dav_access),
               'relayhost' => strval($relayhost),
+              'shared' => strval($shared),
               'passwd_update' => time(),
               'mailbox_format' => strval($MAILBOX_DEFAULT_ATTRIBUTES['mailbox_format']),
               'quarantine_notification' => strval($quarantine_notification),
@@ -1050,7 +1053,11 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
             );
             return false;
           }
-          if ($authsource == 'mailcow'){
+          if ($authsource == 'mailcow' && $shared == 1 && empty($password) && empty($password2)) {
+            // Nobody logs in to a shared mailbox, a random password keeps it unusable
+            $password_hashed = hash_password(bin2hex(random_bytes(32)));
+          }
+          elseif ($authsource == 'mailcow'){
             if (password_check($password, $password2) !== true) {
               return false;
             }
@@ -1268,7 +1275,16 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
             }
           }
 
-          return mailbox('add', 'mailbox', $mailbox_attributes);
+          $result = mailbox('add', 'mailbox', $mailbox_attributes);
+          if ($result !== false) {
+            // Remember the applied template, see edit mailbox_from_template
+            $stmt = $pdo->prepare("UPDATE `mailbox` SET `attributes` = JSON_SET(`attributes`, '$.template', :template) WHERE `username` = :username");
+            $stmt->execute(array(
+              ':template' => $_data['template'],
+              ':username' => strtolower(trim($_data['local_part'])) . '@' . idn_to_ascii(strtolower(trim($_data['domain'])), 0, INTL_IDNA_VARIANT_UTS46)
+            ));
+          }
+          return $result;
         break;
         case 'mta_sts':
           $domain       = idn_to_ascii(strtolower(trim($_data['domain'])), 0, INTL_IDNA_VARIANT_UTS46);
@@ -2208,6 +2224,14 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
               );
               continue;
             }
+            if (!empty($is_now['group_id'])) {
+              $_SESSION['return'][] = array(
+                'type' => 'danger',
+                'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
+                'msg' => array('alias_group_managed', htmlspecialchars($is_now['address']))
+              );
+              continue;
+            }
             if ($_data['expand_alias'] === true || $_data['expand_alias'] == 1) {
               $stmt = $pdo->prepare("SELECT `address` FROM `alias`
                 WHERE `address` = :address
@@ -2370,7 +2394,8 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
                 // Delete from sender_acl to prevent duplicates
                 $stmt = $pdo->prepare("DELETE FROM `sender_acl` WHERE
                   `logged_in_as` = :goto AND
-                  `send_as` = :address");
+                  `send_as` = :address AND
+                  `group_id` IS NULL");
                 $stmt->execute(array(
                   ':goto' => $goto,
                   ':address' => $address
@@ -2404,6 +2429,10 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
                 ':active' => $active,
                 ':id' => $is_now['id']
               ));
+              if ($address != $is_now['address']) {
+                // Send-as grants of groups follow the address
+                \Mailcow\MailboxGroup\MailboxGroupModule::fromGlobals()->api->addressRenamed($is_now['address'], $address);
+              }
             }
             $_SESSION['return'][] = array(
               'type' => 'success',
@@ -2785,6 +2814,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
               (int)$eas_access     = (isset($_data['eas_access']) && hasACLAccess("protocol_access")) ? intval($_data['eas_access']) : intval($is_now['attributes']['eas_access']);
               (int)$dav_access    = (isset($_data['dav_access']) && hasACLAccess("protocol_access")) ? intval($_data['dav_access']) : intval($is_now['attributes']['dav_access']);
               (int)$relayhost       = (isset($_data['relayhost']) && hasACLAccess("mailbox_relayhost")) ? intval($_data['relayhost']) : intval($is_now['attributes']['relayhost']);
+              (int)$shared          = (isset($_data['shared'])) ? intval($_data['shared']) : intval($is_now['attributes']['shared'] ?? 0);
               (int)$quota_m         = (isset_has_content($_data['quota'])) ? intval($_data['quota']) : ($is_now['quota'] / 1048576);
               $name                 = (!empty($_data['name'])) ? ltrim(rtrim($_data['name'], '>'), '<') : $is_now['name'];
               $domain               = $is_now['domain'];
@@ -3007,7 +3037,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
                 $sender_acl_merged = array_merge($sender_acl_domain_admin, $sender_acl_admin);
                 // If merged array still contains "*", set it as only value
                 !in_array('*', $sender_acl_merged) ?: $sender_acl_merged = array('*');
-                $stmt = $pdo->prepare("DELETE FROM `sender_acl` WHERE `external` = 0 AND `logged_in_as` = :username");
+                $stmt = $pdo->prepare("DELETE FROM `sender_acl` WHERE `external` = 0 AND `group_id` IS NULL AND `logged_in_as` = :username");
                 $stmt->execute(array(
                   ':username' => $username
                 ));
@@ -3039,7 +3069,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
                 }
               }
               else {
-                $stmt = $pdo->prepare("DELETE FROM `sender_acl` WHERE `external` = 0 AND `logged_in_as` = :username");
+                $stmt = $pdo->prepare("DELETE FROM `sender_acl` WHERE `external` = 0 AND `group_id` IS NULL AND `logged_in_as` = :username");
                 $stmt->execute(array(
                   ':username' => $username
                 ));
@@ -3080,6 +3110,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
                   `attributes` = JSON_SET(`attributes`, '$.sieve_access', :sieve_access),
                   `attributes` = JSON_SET(`attributes`, '$.pop3_access', :pop3_access),
                   `attributes` = JSON_SET(`attributes`, '$.relayhost', :relayhost),
+                  `attributes` = JSON_SET(`attributes`, '$.shared', :shared),
                   `attributes` = JSON_SET(`attributes`, '$.smtp_access', :smtp_access),
                   `attributes` = JSON_SET(`attributes`, '$.eas_access', :eas_access),
                   `attributes` = JSON_SET(`attributes`, '$.dav_access', :dav_access),
@@ -3102,6 +3133,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
                 ':dav_access' => $dav_access,
                 ':recovery_email' => $pw_recovery_email,
                 ':relayhost' => $relayhost,
+                ':shared' => strval($shared),
                 ':username' => $username,
                 ':authsource' => $authsource
               ));
@@ -3258,7 +3290,12 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
               "imapsync" => ['user2'],
               'bcc_maps' => ['local_dest', 'bcc_dest'],
               'recipient_maps' => ['old_dest', 'new_dest'],
-              'sender_acl' => ['logged_in_as', 'send_as']
+              'sender_acl' => ['logged_in_as', 'send_as'],
+              'identity_link' => ['username'],
+              'mailbox_group_imap_grant' => ['owner'],
+              'mailbox_group_sogo_grant' => ['owner'],
+              'mailbox_group_sogo_acl' => ['c_uid'],
+              'mailbox_group_subscription' => ['username', 'owner']
             ];
             foreach ($tables as $table => $columns) {
               foreach ($columns as $column) {
@@ -3272,6 +3309,8 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
 
             // Sync sources created by / targeting the mailbox and its OAuth tokens (owner); a PDOException rolls back below
             \Mailcow\Imapsync\ImapsyncModule::fromGlobals()->sources->onAccountRenamed($old_username, $new_username);
+            // Group memberships and send-as grants follow, group aliases are rebuilt
+            \Mailcow\MailboxGroup\MailboxGroupModule::fromGlobals()->hooks->onMailboxRenamed($old_username, $new_username);
 
             // Update c_uid, c_name and mail in _sogo_static_view table
             $pdo->prepare("UPDATE _sogo_static_view SET c_uid = :new_username, c_name = :new_username2, mail = :new_username3 WHERE c_uid = :old_username")
@@ -3370,10 +3409,27 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
           $attribute_hash = sha1(json_encode($mbox_template_data["attributes"]));
           $is_now = mailbox('get', 'mailbox_details', $_data['username']);
           $name = ltrim(rtrim($_data['name'], '>'), '<');
-          if ($is_now['attributes']['attribute_hash'] == $attribute_hash && $is_now['name'] == $name)
+          // Last applied template, null for mailboxes created before it was recorded
+          $applied_template = $is_now['attributes']['template'] ?? null;
+          $stmt_template = $pdo->prepare("UPDATE `mailbox` SET `attributes` = JSON_SET(`attributes`, '$.template', :template) WHERE `username` = :username");
+          if ($is_now['attributes']['attribute_hash'] == $attribute_hash && $is_now['name'] == $name) {
+            if ($applied_template === null) {
+              $stmt_template->execute(array(':template' => $_data['template'], ':username' => $_data['username']));
+            }
             return true;
+          }
 
           $mbox_template_data = json_decode($mbox_template_data["attributes"], true);
+          // Any manual edit clears attribute_hash: re-applying the same template must not undo a manual (de)activation
+          if ($applied_template === null || $applied_template === $_data['template']) {
+            unset($mbox_template_data['active']);
+          }
+          // Login disabled by the IdP sync is only lifted by the sync
+          $stmt = $pdo->prepare("SELECT `idp_disabled` FROM `identity_link` WHERE `username` = :username");
+          $stmt->execute(array(':username' => $_data['username']));
+          if (intval($stmt->fetchColumn()) == 1) {
+            unset($mbox_template_data['active']);
+          }
           $mbox_template_data['attribute_hash'] = $attribute_hash;
           $mbox_template_data['name'] = $name;
           $quarantine_attributes = array('username' => $_data['username']);
@@ -3416,6 +3472,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
           if ($result === false) return $result;
           $result = acl('edit', 'user', $acl_attributes);
           if ($result === false) return $result;
+          $stmt_template->execute(array(':template' => $_data['template'], ':username' => $_data['username']));
 
           $_SESSION['return'] = array();
           return true;
@@ -3528,6 +3585,8 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
               ":template" => $_data["template"] ,
               ":attributes" => json_encode($attr)
             ));
+            // Mailboxes with this effective group template get the new settings
+            \Mailcow\MailboxGroup\MailboxGroupModule::fromGlobals()->api->templateChanged((int)$id);
           }
 
 
@@ -3959,7 +4018,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
           }
           // Return array $data['sender_acl_domains/addresses']['ro'] with read-only objects
           // Return array $data['sender_acl_domains/addresses']['rw'] with read-write objects (can be deleted)
-          $stmt = $pdo->prepare("SELECT REPLACE(`send_as`, '@', '') AS `send_as` FROM `sender_acl` WHERE `logged_in_as` = :logged_in_as AND `external` = '0' AND (`send_as` LIKE '@%' OR `send_as` = '*')");
+          $stmt = $pdo->prepare("SELECT REPLACE(`send_as`, '@', '') AS `send_as` FROM `sender_acl` WHERE `logged_in_as` = :logged_in_as AND `external` = '0' AND `group_id` IS NULL AND (`send_as` LIKE '@%' OR `send_as` = '*')");
           $stmt->execute(array(':logged_in_as' => $_data));
           $domain_rows = $stmt->fetchAll(PDO::FETCH_ASSOC);
           while ($domain_row = array_shift($domain_rows)) {
@@ -3978,7 +4037,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
               $data['sender_acl_domains']['rw'][] = $domain_row['send_as'];
             }
           }
-          $stmt = $pdo->prepare("SELECT `send_as` FROM `sender_acl` WHERE `logged_in_as` = :logged_in_as AND `external` = '0' AND (`send_as` NOT LIKE '@%' AND `send_as` != '*')");
+          $stmt = $pdo->prepare("SELECT `send_as` FROM `sender_acl` WHERE `logged_in_as` = :logged_in_as AND `external` = '0' AND `group_id` IS NULL AND (`send_as` NOT LIKE '@%' AND `send_as` != '*')");
           $stmt->execute(array(':logged_in_as' => $_data));
           $address_rows = $stmt->fetchAll(PDO::FETCH_ASSOC);
           while ($address_row = array_shift($address_rows)) {
@@ -4436,7 +4495,9 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
             `sogo_visible`,
             `sender_allowed`,
             `created`,
-            `modified`
+            `modified`,
+            `group_id`,
+            (SELECT `name` FROM `mailbox_group` WHERE `mailbox_group`.`id` = `alias`.`group_id`) AS `group_name`
               FROM `alias`
                   WHERE (`id` = :id OR `address` = :address) AND `address` != `goto`");
           $stmt->execute(array(
@@ -4469,6 +4530,9 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
           $aliasdata['sogo_visible'] = $row['sogo_visible'];
           $aliasdata['sogo_visible_int'] = $row['sogo_visible'];
           $aliasdata['sender_allowed'] = $row['sender_allowed'];
+          // Distribution address of a mailbox group, read-only here
+          $aliasdata['group_id'] = $row['group_id'];
+          $aliasdata['group_name'] = $row['group_name'];
           $aliasdata['created'] = $row['created'];
           $aliasdata['modified'] = $row['modified'];
           if (!hasDomainAccess($_SESSION['mailcow_cc_username'], $_SESSION['mailcow_cc_role'], $aliasdata['domain'])) {
@@ -4909,7 +4973,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
             $mailboxdata['is_relayed'] = $row['backupmx'];
             // Internal send-as ACL for this mailbox, mirrors the sender_acl field accepted by edit/mailbox
             $mailboxdata['sender_acl'] = array();
-            $stmt = $pdo->prepare("SELECT `send_as` FROM `sender_acl` WHERE `logged_in_as` = :username AND `external` = '0'");
+            $stmt = $pdo->prepare("SELECT `send_as` FROM `sender_acl` WHERE `logged_in_as` = :username AND `external` = '0' AND `group_id` IS NULL");
             $stmt->execute(array(':username' => $_data));
             $sender_acl_rows = $stmt->fetchAll(PDO::FETCH_ASSOC);
             foreach ($sender_acl_rows as $sender_acl_row) {
@@ -5283,6 +5347,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
             $stmt->execute(array(
               ':domain' => $domain,
             ));
+            \Mailcow\MailboxGroup\MailboxGroupModule::fromGlobals()->api->domainDeleted($domain);
             $stmt = $pdo->prepare("DELETE FROM `imapsync_source_domain` WHERE `domain` = :domain");
             $stmt->execute(array(
               ':domain' => $domain,
@@ -5410,6 +5475,14 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
               );
               continue;
             }
+            if (!empty($alias_data['group_id'])) {
+              $_SESSION['return'][] = array(
+                'type' => 'danger',
+                'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
+                'msg' => array('alias_group_managed', htmlspecialchars($alias_data['address']))
+              );
+              continue;
+            }
 
             // Track affected mailboxes for SOGo update (capture before deletion)
             if (!empty($alias_data['goto'])) {
@@ -5430,6 +5503,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
             $stmt->execute(array(
               ':alias_address' => $alias_data['address']
             ));
+            \Mailcow\MailboxGroup\MailboxGroupModule::fromGlobals()->api->addressDeleted($alias_data['address']);
             $_SESSION['return'][] = array(
               'type' => 'success',
               'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
@@ -5470,6 +5544,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
             $stmt->execute(array(
               ':alias_domain' => $alias_domain,
             ));
+            \Mailcow\MailboxGroup\MailboxGroupModule::fromGlobals()->api->domainDeleted($alias_domain);
             $stmt = $pdo->prepare("DELETE FROM `alias` WHERE `domain` = :alias_domain");
             $stmt->execute(array(
               ':alias_domain' => $alias_domain,
@@ -5552,7 +5627,8 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
                 'msg' => 'Could not move maildir to garbage collector: variables local_part and/or domain empty'
               );
             }
-            $stmt = $pdo->prepare("DELETE FROM `alias` WHERE `goto` = :username");
+            \Mailcow\MailboxGroup\MailboxGroupModule::fromGlobals()->api->mailboxDeleted($username);
+            $stmt = $pdo->prepare("DELETE FROM `alias` WHERE `goto` = :username AND `group_id` IS NULL");
             $stmt->execute(array(
               ':username' => $username
             ));

data/web/inc/init_db.inc.php

@@ -4,7 +4,20 @@ function init_db_schema()
   try {
     global $pdo;
 
-    $db_version = "22102026_1200";
+    // Defined once as DB_VERSION in docker-compose.yml
+    $db_version = (string)getenv('DB_VERSION');
+    if ($db_version === '') {
+      if (php_sapi_name() == "cli") {
+        echo "DB initialization failed: DB_VERSION is not set" . PHP_EOL;
+      } else {
+        $_SESSION['return'][] = array(
+          'type' => 'danger',
+          'log' => array(__FUNCTION__),
+          'msg' => 'Database not initialized: DB_VERSION is not set.'
+        );
+      }
+      return false;
+    }
 
     $stmt = $pdo->query("SHOW TABLES LIKE 'versions'");
     $num_results = count($stmt->fetchAll(PDO::FETCH_ASSOC));
@@ -174,34 +187,6 @@ function init_db_schema()
         ),
         "attr" => "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC"
       ),
-      "alias" => array(
-        "cols" => array(
-          "id" => "INT NOT NULL AUTO_INCREMENT",
-          "address" => "VARCHAR(255) NOT NULL",
-          "goto" => "TEXT NOT NULL",
-          "domain" => "VARCHAR(255) NOT NULL",
-          "created" => "DATETIME(0) NOT NULL DEFAULT NOW(0)",
-          "modified" => "DATETIME ON UPDATE CURRENT_TIMESTAMP",
-          "private_comment" => "TEXT",
-          "public_comment" => "TEXT",
-          "sogo_visible" => "TINYINT(1) NOT NULL DEFAULT '1'",
-          "internal" => "TINYINT(1) NOT NULL DEFAULT '0'",
-          "sender_allowed" => "TINYINT(1) NOT NULL DEFAULT '1'",
-          "active" => "TINYINT(1) NOT NULL DEFAULT '1'"
-        ),
-        "keys" => array(
-          "primary" => array(
-            "" => array("id")
-          ),
-          "unique" => array(
-            "address" => array("address")
-          ),
-          "key" => array(
-            "domain" => array("domain")
-          )
-        ),
-        "attr" => "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC"
-      ),
       "api" => array(
         "cols" => array(
           "id" => "INT NOT NULL AUTO_INCREMENT",
@@ -226,20 +211,6 @@ function init_db_schema()
         ),
         "attr" => "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC"
       ),
-      "sender_acl" => array(
-        "cols" => array(
-          "id" => "INT NOT NULL AUTO_INCREMENT",
-          "logged_in_as" => "VARCHAR(255) NOT NULL",
-          "send_as" => "VARCHAR(255) NOT NULL",
-          "external" => "TINYINT(1) NOT NULL DEFAULT '0'"
-        ),
-        "keys" => array(
-          "primary" => array(
-            "" => array("id")
-          )
-        ),
-        "attr" => "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC"
-      ),
       "templates" => array(
         "cols" => array(
           "id" => "INT NOT NULL AUTO_INCREMENT",
@@ -418,6 +389,360 @@ function init_db_schema()
         ),
         "attr" => "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC"
       ),
+      "mailbox_group" => array(
+        "cols" => array(
+          "id" => "INT NOT NULL AUTO_INCREMENT",
+          "domain" => "VARCHAR(255) NOT NULL",
+          "name" => "VARCHAR(100) NOT NULL",
+          "description" => "VARCHAR(255) NOT NULL DEFAULT ''",
+          // distribution address, maintained as alias row with group_id
+          "address" => "VARCHAR(255) NULL DEFAULT NULL",
+          // members may send as the address
+          "sender_allowed" => "TINYINT(1) NOT NULL DEFAULT '0'",
+          "sogo_visible" => "TINYINT(1) NOT NULL DEFAULT '0'",
+          "internal" => "TINYINT(1) NOT NULL DEFAULT '0'",
+          "template_id" => "INT NULL DEFAULT NULL",
+          // highest priority wins when a mailbox is in several groups with a template
+          "priority" => "INT NOT NULL DEFAULT '0'",
+          // IdP group id: set = memberships are synced from the IdP
+          "idp_ref" => "VARCHAR(255) NULL DEFAULT NULL",
+          "created" => "DATETIME(0) NOT NULL DEFAULT NOW(0)",
+          "modified" => "DATETIME ON UPDATE CURRENT_TIMESTAMP",
+          "active" => "TINYINT(1) NOT NULL DEFAULT '1'"
+        ),
+        "keys" => array(
+          "primary" => array(
+            "" => array("id")
+          ),
+          "unique" => array(
+            "domain_name" => array("domain", "name"),
+            "address" => array("address"),
+            "idp_ref" => array("idp_ref")
+          ),
+          "fkey" => array(
+            "fk_mailbox_group_domain" => array(
+              "col" => "domain",
+              "ref" => "domain.domain",
+              "delete" => "CASCADE",
+              "update" => "NO ACTION"
+            ),
+            "fk_mailbox_group_template" => array(
+              "col" => "template_id",
+              "ref" => "templates.id",
+              "delete" => "SET NULL",
+              "update" => "NO ACTION"
+            )
+          )
+        ),
+        "attr" => "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC"
+      ),
+      "mailbox_group_member" => array(
+        "cols" => array(
+          "group_id" => "INT NOT NULL",
+          "username" => "VARCHAR(255) NOT NULL",
+          "source" => "ENUM('manual', 'idp') NOT NULL DEFAULT 'manual'",
+          "created" => "DATETIME(0) NOT NULL DEFAULT NOW(0)"
+        ),
+        "keys" => array(
+          "primary" => array(
+            "" => array("group_id", "username")
+          ),
+          "key" => array(
+            "username" => array("username")
+          ),
+          "fkey" => array(
+            "fk_mailbox_group_member_group" => array(
+              "col" => "group_id",
+              "ref" => "mailbox_group.id",
+              "delete" => "CASCADE",
+              "update" => "NO ACTION"
+            ),
+            "fk_mailbox_group_member_mailbox" => array(
+              "col" => "username",
+              "ref" => "mailbox.username",
+              "delete" => "CASCADE",
+              "update" => "NO ACTION"
+            )
+          )
+        ),
+        "attr" => "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC"
+      ),
+      "mailbox_group_send_as" => array(
+        "cols" => array(
+          "group_id" => "INT NOT NULL",
+          // address or @domain the members may send as
+          "address" => "VARCHAR(255) NOT NULL"
+        ),
+        "keys" => array(
+          "primary" => array(
+            "" => array("group_id", "address")
+          ),
+          "key" => array(
+            "address" => array("address")
+          ),
+          "fkey" => array(
+            "fk_mailbox_group_send_as_group" => array(
+              "col" => "group_id",
+              "ref" => "mailbox_group.id",
+              "delete" => "CASCADE",
+              "update" => "NO ACTION"
+            )
+          )
+        ),
+        "attr" => "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC"
+      ),
+      "mailbox_group_imap_grant" => array(
+        "cols" => array(
+          "id" => "INT NOT NULL AUTO_INCREMENT",
+          "group_id" => "INT NOT NULL",
+          // mailbox whose folders the members may access
+          "owner" => "VARCHAR(255) NOT NULL",
+          "rights" => "ENUM('read', 'write', 'full') NOT NULL DEFAULT 'read'",
+          // 1 = the group-grants cron subscribes the members to the folders (once per member)
+          "subscribe" => "TINYINT(1) NOT NULL DEFAULT '0'",
+          // removing = the ACL is deleted in Dovecot, then the row
+          "state" => "ENUM('pending', 'applied', 'failed', 'removing') NOT NULL DEFAULT 'pending'",
+          "last_error" => "TEXT",
+          "created" => "DATETIME(0) NOT NULL DEFAULT NOW(0)",
+          "modified" => "DATETIME ON UPDATE CURRENT_TIMESTAMP"
+        ),
+        "keys" => array(
+          "primary" => array(
+            "" => array("id")
+          ),
+          "unique" => array(
+            "group_owner" => array("group_id", "owner")
+          ),
+          "key" => array(
+            "owner" => array("owner")
+          ),
+          "fkey" => array(
+            "fk_mailbox_group_imap_grant_group" => array(
+              "col" => "group_id",
+              "ref" => "mailbox_group.id",
+              "delete" => "CASCADE",
+              "update" => "NO ACTION"
+            ),
+            "fk_mailbox_group_imap_grant_owner" => array(
+              "col" => "owner",
+              "ref" => "mailbox.username",
+              "delete" => "CASCADE",
+              "update" => "NO ACTION"
+            )
+          )
+        ),
+        "attr" => "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC"
+      ),
+      "mailbox_group_sogo_grant" => array(
+        "cols" => array(
+          "id" => "INT NOT NULL AUTO_INCREMENT",
+          "group_id" => "INT NOT NULL",
+          "owner" => "VARCHAR(255) NOT NULL",
+          "folder_type" => "ENUM('Calendar', 'Contacts') NOT NULL DEFAULT 'Calendar'",
+          "folder" => "VARCHAR(255) NOT NULL DEFAULT 'personal'",
+          "access" => "ENUM('read', 'write') NOT NULL DEFAULT 'read'",
+          // 1 = the group-grants cron subscribes the members to the folder (once per member)
+          "subscribe" => "TINYINT(1) NOT NULL DEFAULT '0'",
+          // pending = the owner has not opened SOGo yet, the folder does not exist
+          "state" => "ENUM('pending', 'applied', 'failed') NOT NULL DEFAULT 'pending'",
+          "last_error" => "TEXT",
+          "created" => "DATETIME(0) NOT NULL DEFAULT NOW(0)",
+          "modified" => "DATETIME ON UPDATE CURRENT_TIMESTAMP"
+        ),
+        "keys" => array(
+          "primary" => array(
+            "" => array("id")
+          ),
+          "unique" => array(
+            "group_folder" => array("group_id", "owner", "folder_type", "folder")
+          ),
+          "key" => array(
+            "owner" => array("owner")
+          ),
+          "fkey" => array(
+            "fk_mailbox_group_sogo_grant_group" => array(
+              "col" => "group_id",
+              "ref" => "mailbox_group.id",
+              "delete" => "CASCADE",
+              "update" => "NO ACTION"
+            ),
+            "fk_mailbox_group_sogo_grant_owner" => array(
+              "col" => "owner",
+              "ref" => "mailbox.username",
+              "delete" => "CASCADE",
+              "update" => "NO ACTION"
+            )
+          )
+        ),
+        "attr" => "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC"
+      ),
+      // sogo_acl rows written for a grant, so only those are ever removed again. No FK: rows of grants
+      // removed by a cascade stay until their sogo_acl rows are deleted (GroupRepository::cleanupSogoAcl())
+      "mailbox_group_sogo_acl" => array(
+        "cols" => array(
+          "acl_id" => "INT NOT NULL",
+          "grant_id" => "INT NOT NULL",
+          "c_uid" => "VARCHAR(255) NOT NULL",
+          "c_role" => "VARCHAR(80) NOT NULL"
+        ),
+        "keys" => array(
+          "primary" => array(
+            "" => array("acl_id")
+          ),
+          "key" => array(
+            "grant_id" => array("grant_id")
+          )
+        ),
+        "attr" => "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC"
+      ),
+      // IMAP and SOGo subscriptions made by the group-grants cron. No FK: rows of grants removed by a cascade stay
+      // until the members are unsubscribed again
+      "mailbox_group_subscription" => array(
+        "cols" => array(
+          "id" => "INT NOT NULL AUTO_INCREMENT",
+          "kind" => "ENUM('imap', 'sogo') NOT NULL",
+          // mailbox_group_imap_grant.id or mailbox_group_sogo_grant.id
+          "grant_id" => "INT NOT NULL",
+          "username" => "VARCHAR(255) NOT NULL",
+          "owner" => "VARCHAR(255) NOT NULL",
+          // SOGo: Calendar/<id> or Contacts/<id>, IMAP: empty (all folders of the owner)
+          "folder" => "VARCHAR(255) NOT NULL DEFAULT ''",
+          "created" => "DATETIME(0) NOT NULL DEFAULT NOW(0)"
+        ),
+        "keys" => array(
+          "primary" => array(
+            "" => array("id")
+          ),
+          "unique" => array(
+            "grant_username" => array("kind", "grant_id", "username")
+          ),
+          "key" => array(
+            "username" => array("username")
+          )
+        ),
+        "attr" => "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC"
+      ),
+      "identity_link" => array(
+        "cols" => array(
+          "username" => "VARCHAR(255) NOT NULL",
+          "provider" => "VARCHAR(20) NOT NULL",
+          // Keycloak user id (= OIDC sub), LDAP objectGUID/entryUUID/... or dn:<dn>, OIDC sub; NULL = not linked yet
+          "external_id" => "VARCHAR(255) NULL DEFAULT NULL",
+          // 1 = the sync set the mailbox to login disabled (active = 2)
+          "idp_disabled" => "TINYINT(1) NOT NULL DEFAULT '0'",
+          // first complete sync run that did not list the user
+          "missing_since" => "DATETIME NULL DEFAULT NULL",
+          "created" => "DATETIME(0) NOT NULL DEFAULT NOW(0)",
+          "modified" => "DATETIME ON UPDATE CURRENT_TIMESTAMP"
+        ),
+        "keys" => array(
+          "primary" => array(
+            "" => array("username")
+          ),
+          "unique" => array(
+            "provider_external_id" => array("provider", "external_id")
+          ),
+          "fkey" => array(
+            "fk_identity_link_mailbox" => array(
+              "col" => "username",
+              "ref" => "mailbox.username",
+              "delete" => "CASCADE",
+              "update" => "NO ACTION"
+            )
+          )
+        ),
+        "attr" => "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC"
+      ),
+      "identity_sync_run" => array(
+        "cols" => array(
+          "id" => "INT NOT NULL AUTO_INCREMENT",
+          "provider" => "VARCHAR(20) NOT NULL DEFAULT ''",
+          // run = scheduled or requested, preview = dry run, force = without the deactivation limit
+          "mode" => "ENUM('run', 'preview', 'force') NOT NULL DEFAULT 'run'",
+          "status" => "ENUM('pending', 'running', 'ok', 'blocked', 'error') NOT NULL DEFAULT 'pending'",
+          "requested_by" => "VARCHAR(255) NOT NULL DEFAULT ''",
+          "created" => "DATETIME(0) NOT NULL DEFAULT NOW(0)",
+          "started" => "DATETIME NULL DEFAULT NULL",
+          "finished" => "DATETIME NULL DEFAULT NULL",
+          "summary" => "MEDIUMTEXT"
+        ),
+        "keys" => array(
+          "primary" => array(
+            "" => array("id")
+          ),
+          "key" => array(
+            "status" => array("status")
+          )
+        ),
+        "attr" => "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC"
+      ),
+      // alias and sender_acl come after mailbox_group (foreign keys)
+      "alias" => array(
+        "cols" => array(
+          "id" => "INT NOT NULL AUTO_INCREMENT",
+          "address" => "VARCHAR(255) NOT NULL",
+          "goto" => "TEXT NOT NULL",
+          "domain" => "VARCHAR(255) NOT NULL",
+          "created" => "DATETIME(0) NOT NULL DEFAULT NOW(0)",
+          "modified" => "DATETIME ON UPDATE CURRENT_TIMESTAMP",
+          "private_comment" => "TEXT",
+          "public_comment" => "TEXT",
+          "sogo_visible" => "TINYINT(1) NOT NULL DEFAULT '1'",
+          "internal" => "TINYINT(1) NOT NULL DEFAULT '0'",
+          "sender_allowed" => "TINYINT(1) NOT NULL DEFAULT '1'",
+          "active" => "TINYINT(1) NOT NULL DEFAULT '1'",
+          // set = distribution address of a mailbox group, read-only in the alias UI
+          "group_id" => "INT NULL DEFAULT NULL"
+        ),
+        "keys" => array(
+          "primary" => array(
+            "" => array("id")
+          ),
+          "unique" => array(
+            "address" => array("address"),
+            "group_id" => array("group_id")
+          ),
+          "key" => array(
+            "domain" => array("domain")
+          ),
+          "fkey" => array(
+            "fk_alias_mailbox_group" => array(
+              "col" => "group_id",
+              "ref" => "mailbox_group.id",
+              "delete" => "CASCADE",
+              "update" => "NO ACTION"
+            )
+          )
+        ),
+        "attr" => "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC"
+      ),
+      "sender_acl" => array(
+        "cols" => array(
+          "id" => "INT NOT NULL AUTO_INCREMENT",
+          "logged_in_as" => "VARCHAR(255) NOT NULL",
+          "send_as" => "VARCHAR(255) NOT NULL",
+          "external" => "TINYINT(1) NOT NULL DEFAULT '0'",
+          // set = granted through a mailbox group, rebuilt by the group module
+          "group_id" => "INT NULL DEFAULT NULL"
+        ),
+        "keys" => array(
+          "primary" => array(
+            "" => array("id")
+          ),
+          "key" => array(
+            "group_id" => array("group_id")
+          ),
+          "fkey" => array(
+            "fk_sender_acl_mailbox_group" => array(
+              "col" => "group_id",
+              "ref" => "mailbox_group.id",
+              "delete" => "CASCADE",
+              "update" => "NO ACTION"
+            )
+          )
+        ),
+        "attr" => "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC"
+      ),
       "sieve_filters" => array(
         "cols" => array(
           "id" => "INT NOT NULL AUTO_INCREMENT",
@@ -727,7 +1052,8 @@ function init_db_schema()
           "mailbox_relayhost" => "TINYINT(1) NOT NULL DEFAULT '1'",
           "domain_relayhost" => "TINYINT(1) NOT NULL DEFAULT '1'",
           "domain_desc" => "TINYINT(1) NOT NULL DEFAULT '0'",
-          "alias_external_goto" => "TINYINT(1) NOT NULL DEFAULT '1'"
+          "alias_external_goto" => "TINYINT(1) NOT NULL DEFAULT '1'",
+          "mailbox_groups" => "TINYINT(1) NOT NULL DEFAULT '1'"
         ),
         "keys" => array(
           "primary" => array(
@@ -1807,6 +2133,18 @@ function init_db_schema()
     // fill quarantine.qhash
     $pdo->query("UPDATE `quarantine` SET `qhash` = SHA2(CONCAT(`id`, `qid`), 256) WHERE ISNULL(`qhash`)");
 
+    // Group rows that lost their group_id (init_db of an older version ran) belong to their group again, so the
+    // group can update its alias and revokes send-as rights of former members. An active group without rows of its
+    // own for a grant only exists after such a downgrade; manual rows next to group rows stay manual.
+    $pdo->query("UPDATE `alias` a JOIN `mailbox_group` g ON g.`address` = a.`address` SET a.`group_id` = g.`id` WHERE a.`group_id` IS NULL");
+    $pdo->query("UPDATE `sender_acl` s
+      JOIN `mailbox_group_member` m ON m.`username` = s.`logged_in_as`
+      JOIN `mailbox_group` g ON g.`id` = m.`group_id` AND g.`active` = 1
+      JOIN `mailbox_group_send_as` ga ON ga.`group_id` = m.`group_id` AND ga.`address` = s.`send_as`
+      SET s.`group_id` = m.`group_id`
+      WHERE s.`group_id` IS NULL AND s.`external` = 0
+        AND NOT EXISTS (SELECT 1 FROM (SELECT `group_id` FROM `sender_acl` WHERE `group_id` IS NOT NULL) own WHERE own.`group_id` = m.`group_id`)");
+
   } catch (PDOException $e) {
     if (php_sapi_name() == "cli") {
       echo "DB initialization failed: " . print_r($e, true) . PHP_EOL;

data/web/inc/lib/mailcow/ApiKey/Service/ApiKeyService.php

@@ -30,9 +30,7 @@ class ApiKeyService
     /** @throws AccessDenied unless an admin (login or read-write API key) */
     public function requireAdmin(): void
     {
-        if (!$this->context->isAdmin() || $this->context->isReadOnlyApi()) {
-            throw new AccessDenied();
-        }
+        $this->context->requireAdmin();
     }
 
     /** @return ApiKey[] all keys, service keys first; [] for other callers */
@@ -146,7 +144,7 @@ class ApiKeyService
 
     private function canRead(): bool
     {
-        return $this->context->isAdmin() && !$this->context->isReadOnlyApi();
+        return $this->context->hasAdminRights() && !$this->context->isReadOnlyApi();
     }
 
     /** @throws AccessDenied when missing, UserError api_key_service_locked for service keys */

data/web/inc/lib/mailcow/Auth/AuthModule.php

@@ -0,0 +1,36 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Mailcow\Auth;
+
+use Mailcow\Auth\Service\IdpLoginService;
+use Mailcow\Core\Context;
+use Mailcow\Identity\IdentityModule;
+use Mailcow\MailboxGroup\MailboxGroupModule;
+use PDO;
+
+/**
+ * Logins. For now the IdP login steps of the legacy flows (keycloak_mbox_login_rest(), ldap_mbox_login(),
+ * identity_provider('verify-sso')); the auth logic of the function files moves here step by step.
+ */
+class AuthModule
+{
+    public function __construct(public readonly IdpLoginService $idp)
+    {
+    }
+
+    /** @param array $iamSettings identity provider settings as identity_provider('get') returns them */
+    public static function create(PDO $pdo, Context $context, array $iamSettings): self
+    {
+        $identity = IdentityModule::create($pdo, $context, $iamSettings);
+        return new self(new IdpLoginService($identity->settings, $identity->links, MailboxGroupModule::create($pdo, $context)->templates));
+    }
+
+    /** Logins run before a session exists, so the default context is the system */
+    public static function fromGlobals(?Context $context = null): self
+    {
+        $settings = $GLOBALS['iam_settings'] ?? null;
+        return self::create($GLOBALS['pdo'], $context ?? Context::system(), is_array($settings) ? $settings : identity_provider('get'));
+    }
+}

data/web/inc/lib/mailcow/Auth/Service/IdpLoginService.php

@@ -0,0 +1,70 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Mailcow\Auth\Service;
+
+use Mailcow\Identity\Model\Settings;
+use Mailcow\Identity\Service\LinkService;
+use Mailcow\MailboxGroup\Service\TemplateService;
+use Throwable;
+
+/**
+ * Steps of an IdP login (Keycloak REST, LDAP bind, OIDC) the legacy login flows call. The link checks fail
+ * closed: an error denies the login.
+ */
+class IdpLoginService
+{
+    public function __construct(private Settings $settings, private LinkService $links, private TemplateService $templates)
+    {
+    }
+
+    /** Template of the first attribute mapping matching one of the IdP attribute values, null if none */
+    public function mappedTemplate(mixed $values): ?string
+    {
+        return $this->settings->mappedTemplate((array)$values);
+    }
+
+    /** Template for the login of an existing mailbox: its effective group template, else the mapped one */
+    public function templateFor(string $username, ?string $mapped): ?string
+    {
+        try {
+            return $this->templates->templateForLogin($username, $mapped);
+        } catch (Throwable $e) {
+            error_log('mailcow: group template lookup failed for ' . $username . ': ' . $e->getMessage());
+            return $mapped;
+        }
+    }
+
+    /** The IdP user may open the mailbox, an unlinked mailbox gets linked */
+    public function verifyLink(string $provider, string $username, string $externalId): bool
+    {
+        try {
+            return $this->links->verify($provider, $username, $externalId);
+        } catch (Throwable $e) {
+            error_log('mailcow: IdP link check failed for ' . $username . ': ' . $e->getMessage());
+            return false;
+        }
+    }
+
+    /** Before a mailbox is created on login: the IdP user must not own another mailbox */
+    public function mayCreate(string $provider, string $username, string $externalId): bool
+    {
+        try {
+            return $this->links->mayCreate($provider, $username, $externalId);
+        } catch (Throwable $e) {
+            error_log('mailcow: IdP link check failed for ' . $username . ': ' . $e->getMessage());
+            return false;
+        }
+    }
+
+    /** Links a mailbox created on login */
+    public function storeLink(string $provider, string $username, string $externalId): void
+    {
+        try {
+            $this->links->link($provider, $username, $externalId);
+        } catch (Throwable $e) {
+            error_log('mailcow: IdP link could not be stored for ' . $username . ': ' . $e->getMessage());
+        }
+    }
+}

data/web/inc/lib/mailcow/Core/ApiResponse.php

@@ -38,6 +38,12 @@ class ApiResponse
         return $this->danger($error->msg(), $log);
     }
 
+    /** Something went partly wrong, but the call itself succeeded */
+    public function warning(string|array $msg, array $log): void
+    {
+        $this->add('warning', $msg, $log);
+    }
+
     /** Messages collected since the last flush() */
     public function messages(): array
     {

data/web/inc/lib/mailcow/Core/Context.php

@@ -70,6 +70,24 @@ class Context
         return $this->apiAccess === 'ro';
     }
 
+    /** An admin, or a legacy call that may ignore ownership (access_all_exception) */
+    public function hasAdminRights(): bool
+    {
+        return $this->isAdmin() || $this->accessAll;
+    }
+
+    /**
+     * Admin rights; a write also needs more than a read-only API key.
+     *
+     * @throws AccessDenied
+     */
+    public function requireAdmin(bool $write = true): void
+    {
+        if (!$this->hasAdminRights() || ($write && $this->isReadOnlyApi())) {
+            throw new AccessDenied();
+        }
+    }
+
     public function hasAcl(string $name): bool
     {
         return isset($this->acl[$name]) && $this->acl[$name] == '1';

data/web/inc/lib/mailcow/Dovecot/DovecotModule.php

@@ -0,0 +1,22 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Mailcow\Dovecot;
+
+use Mailcow\Dovecot\Service\DovecotService;
+
+/**
+ * Dovecot through dockerapi (ACLs, subscriptions, auth cache). Modules use it instead of calling docker().
+ */
+class DovecotModule
+{
+    public function __construct(public readonly DovecotService $dovecot)
+    {
+    }
+
+    public static function create(): self
+    {
+        return new self(new DovecotService());
+    }
+}

data/web/inc/lib/mailcow/Dovecot/Service/DovecotService.php

@@ -0,0 +1,54 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Mailcow\Dovecot\Service;
+
+/**
+ * doveadm in the dovecot container through dockerapi. The docker() call sits in a protected method so tests can
+ * replace it.
+ */
+class DovecotService
+{
+    /**
+     * Sets the rights of an ACL identifier (user=<name>, group=<name>) on every folder of the owner; no rights
+     * remove it.
+     *
+     * @return ?string null on success, else the error of dockerapi
+     */
+    public function setAclAll(string $owner, string $identifier, array $rights): ?string
+    {
+        return self::error($this->exec(['cmd' => 'doveadm', 'task' => 'set_acl_all', 'user' => $owner, 'id' => $identifier,
+            'rights' => array_values($rights)]));
+    }
+
+    /**
+     * Subscribes the users to every folder of the owner they see under Shared/<owner>/, or unsubscribes them.
+     *
+     * @return ?string null on success, else the error of dockerapi
+     */
+    public function subscribeShared(string $owner, array $usernames, bool $unsubscribe = false): ?string
+    {
+        return self::error($this->exec(['cmd' => 'doveadm', 'task' => 'subscribe_shared', 'owner' => $owner,
+            'users' => array_values($usernames), 'unsubscribe' => $unsubscribe]));
+    }
+
+    /** Drops the cached userdb results, so changed userdb fields apply at the next login instead of after auth_cache_ttl */
+    public function flushAuthCache(array $usernames): void
+    {
+        if (!empty($usernames)) {
+            $this->exec(['cmd' => 'doveadm', 'task' => 'auth_cache_flush', 'users' => array_values($usernames)]);
+        }
+    }
+
+    protected function exec(array $fields): mixed
+    {
+        return docker('post', 'dovecot-mailcow', 'exec', $fields);
+    }
+
+    private static function error(mixed $response): ?string
+    {
+        $result = json_decode((string)$response, true);
+        return (($result['type'] ?? '') === 'success') ? null : (string)($result['msg'] ?? 'dockerapi did not answer');
+    }
+}

data/web/inc/lib/mailcow/Identity/Controller/IdentityApiController.php

@@ -0,0 +1,72 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Mailcow\Identity\Controller;
+
+use Mailcow\Core\ApiResponse;
+use Mailcow\Core\UserError;
+use Mailcow\Identity\Service\StatusService;
+use PDOException;
+
+/**
+ * HTTP API adapter for json_api.php (routes `identity-provider/sync-status`, `identity-provider-sync`,
+ * `identity-link`). Messages are logged as ['identity_provider', action, object, data].
+ */
+class IdentityApiController
+{
+    public function __construct(private StatusService $status, private ApiResponse $response)
+    {
+    }
+
+    /** GET identity-provider/sync-status */
+    public function getStatus(): array
+    {
+        try {
+            return $this->status->status();
+        } catch (UserError) {
+            return [];
+        }
+    }
+
+    /** POST edit/identity-provider-sync: attr mode = preview|run|force */
+    public function requestRun(array $attr): bool
+    {
+        return $this->handle('edit', 'sync', $attr, function (array $log) use ($attr): bool {
+            $this->status->requestRun($attr['mode'] ?? 'run');
+            return $this->response->success('iam_sync_requested', $log);
+        });
+    }
+
+    /** GET identity-link/<username> */
+    public function getLink(string $username): array
+    {
+        return $this->status->link($username) ?? [];
+    }
+
+    /** POST delete/identity-link: usernames */
+    public function unlink(array $items): bool
+    {
+        return $this->handle('delete', 'link', $items, function (array $log) use ($items): bool {
+            foreach ($items as $username) {
+                $this->status->unlink((string)$username);
+                $this->response->success(['iam_link_removed', htmlspecialchars((string)$username)], $log);
+            }
+            return true;
+        });
+    }
+
+    private function handle(string $action, string $object, mixed $data, callable $work): bool
+    {
+        $log = ['identity_provider', $action, $object, $data];
+        try {
+            $result = $work($log);
+        } catch (UserError $e) {
+            $result = $this->response->error($e, $log);
+        } catch (PDOException $e) {
+            $result = $this->response->danger(['mysql_error', $e->getMessage()], $log);
+        }
+        $this->response->flush();
+        return $result;
+    }
+}

data/web/inc/lib/mailcow/Identity/Directory/Directory.php

@@ -0,0 +1,21 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Mailcow\Identity\Directory;
+
+use Mailcow\Identity\Model\Listing;
+
+/**
+ * Lists users (and groups) of an IdP for the sync. Implementations: KeycloakDirectory, LdapDirectory.
+ */
+interface Directory
+{
+    /**
+     * The complete listing. Anything that could make it incomplete (HTTP or LDAP errors, size limits, ranged
+     * attributes) throws, because the sync treats users that are not listed as removed.
+     *
+     * @throws DirectoryException
+     */
+    public function listAll(bool $withGroups): Listing;
+}

data/web/inc/lib/mailcow/Identity/Directory/DirectoryException.php

@@ -0,0 +1,14 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Mailcow\Identity\Directory;
+
+use RuntimeException;
+
+/**
+ * The IdP could not be listed completely; the sync run stops without writing anything.
+ */
+class DirectoryException extends RuntimeException
+{
+}

data/web/inc/lib/mailcow/Identity/Directory/KeycloakDirectory.php

@@ -0,0 +1,105 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Mailcow\Identity\Directory;
+
+use Mailcow\Identity\Http\KeycloakClient;
+use Mailcow\Identity\Model\DirectoryGroup;
+use Mailcow\Identity\Model\DirectoryUser;
+use Mailcow\Identity\Model\Listing;
+use Mailcow\Identity\Model\Settings;
+
+/**
+ * Keycloak realm users and the groups selected by their path. Only direct group members count.
+ */
+class KeycloakDirectory implements Directory
+{
+    private const PAGE = 100;
+
+    public function __construct(private KeycloakClient $client, private Settings $settings)
+    {
+    }
+
+    public function listAll(bool $withGroups): Listing
+    {
+        $users = [];
+        foreach ($this->paged('/users', ['briefRepresentation' => 'false']) as $row) {
+            if (isset($row['id'])) {
+                $user = self::user($row);
+                $users[$user->id] = $user;
+            }
+        }
+        return new Listing($users, $withGroups ? $this->groups($users) : null);
+    }
+
+    /** A user of the admin REST API */
+    public static function user(array $row): DirectoryUser
+    {
+        $email = (isset($row['email']) && $row['email'] !== '') ? strtolower((string)$row['email']) : null;
+        return new DirectoryUser((string)$row['id'], $email, trim(($row['firstName'] ?? '') . ' ' . ($row['lastName'] ?? '')),
+            !empty($row['enabled']), array_map('strval', (array)($row['attributes']['mailcow_template'] ?? [])));
+    }
+
+    /**
+     * @param array<string, DirectoryUser> $users
+     * @return array<string, DirectoryGroup> selected groups, members limited to listed users
+     */
+    private function groups(array $users): array
+    {
+        $groups = [];
+        foreach ($this->paged('/groups', ['briefRepresentation' => 'false']) as $row) {
+            $this->collect($row, $groups);
+        }
+        foreach ($groups as $id => $group) {
+            foreach ($this->paged('/groups/' . rawurlencode((string)$id) . '/members', ['briefRepresentation' => 'true']) as $member) {
+                if (isset($member['id'], $users[$member['id']])) {
+                    $group->memberIds[] = (string)$member['id'];
+                }
+            }
+        }
+        return $groups;
+    }
+
+    /** Adds the group and its subgroups that match the configured paths (Keycloak >= 23 lists children separately) */
+    private function collect(array $row, array &$groups): void
+    {
+        $path = (string)($row['path'] ?? '/' . ($row['name'] ?? ''));
+        if ($this->selected($path)) {
+            $mail = $row['attributes']['mail'][0] ?? null;
+            $groups[(string)$row['id']] = new DirectoryGroup((string)$row['id'], (string)($row['name'] ?? $path),
+                is_string($mail) && $mail !== '' ? strtolower($mail) : null);
+        }
+        $children = $row['subGroups'] ?? [];
+        if (empty($children) && (int)($row['subGroupCount'] ?? 0) > 0) {
+            $children = $this->paged('/groups/' . rawurlencode((string)$row['id']) . '/children', ['briefRepresentation' => 'false']);
+        }
+        foreach ($children as $child) {
+            $this->collect($child, $groups);
+        }
+    }
+
+    /** '/a' exactly, '/a/*' every group below /a, '/*' every group */
+    private function selected(string $path): bool
+    {
+        foreach ($this->settings->groupPaths as $pattern) {
+            if ($pattern === $path || (str_ends_with($pattern, '/*') && str_starts_with($path, substr($pattern, 0, -1)))) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    /** @return array[] all rows of a paged list endpoint */
+    private function paged(string $path, array $query): array
+    {
+        $rows = [];
+        for ($first = 0; ; $first += self::PAGE) {
+            $page = array_values($this->client->get($path, $query + ['first' => $first, 'max' => self::PAGE]));
+            $rows = array_merge($rows, $page);
+            if (count($page) < self::PAGE) {
+                return $rows;
+            }
+        }
+    }
+}

data/web/inc/lib/mailcow/Identity/Directory/LdapDirectory.php

@@ -0,0 +1,240 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Mailcow\Identity\Directory;
+
+use LdapRecord\Connection;
+use Mailcow\Identity\Model\DirectoryGroup;
+use Mailcow\Identity\Model\DirectoryUser;
+use Mailcow\Identity\Model\Listing;
+use Mailcow\Identity\Model\Settings;
+
+/**
+ * LDAP / Active Directory users and the groups matching the group filter.
+ *
+ * Searches run on the raw connection with paged results and check the result code of every page, because
+ * LdapRecord's paginator stops silently on size limits. Group members come from memberOf (default), from the
+ * member attribute of the groups, or from the AD in-chain rule (nested groups).
+ */
+class LdapDirectory implements Directory
+{
+    private const PAGE = 500;
+    private const ID_ATTRIBUTES = ['objectguid', 'entryuuid', 'nsuniqueid', 'ipauniqueid'];
+    private const AD_IN_CHAIN = '1.2.840.113556.1.4.1941';
+    /** userAccountControl: ACCOUNTDISABLE */
+    private const UAC_DISABLED = 0x2;
+
+    public function __construct(private ?Connection $connection, private Settings $settings)
+    {
+    }
+
+    public function listAll(bool $withGroups): Listing
+    {
+        $s = $this->settings;
+        $userFilter = $this->userFilter();
+        $disabled = [];
+        if ($s->disabledFilter !== '') {
+            foreach ($this->search($s->basedn, '(&' . $userFilter . self::wrap($s->disabledFilter) . ')', ['dn']) as $entry) {
+                $disabled[strtolower((string)$entry['dn'])] = true;
+            }
+        }
+        $attributes = array_merge([$s->usernameField, 'displayname', 'cn', 'useraccountcontrol'],
+            ($s->attributeField !== '') ? [$s->attributeField] : [],
+            self::idAttributes($s->idAttribute),
+            ($withGroups && $s->groupMemberMode === 'memberof') ? ['memberof'] : []);
+        $users = [];
+        $memberOf = [];
+        foreach ($this->search($s->basedn, $userFilter, array_values(array_unique($attributes))) as $entry) {
+            $dn = strtolower((string)$entry['dn']);
+            $email = self::first($entry, $s->usernameField);
+            $uac = self::first($entry, 'useraccountcontrol');
+            $user = new DirectoryUser(self::entryId($entry, $s->idAttribute),
+                ($email === null) ? null : strtolower($email),
+                self::first($entry, 'displayname') ?? self::first($entry, 'cn') ?? '',
+                !isset($disabled[$dn]) && !($uac !== null && ((int)$uac & self::UAC_DISABLED)),
+                ($s->attributeField !== '') ? self::values($entry, $s->attributeField) : [],
+                $dn);
+            $users[$user->id] = $user;
+            $memberOf[$user->id] = array_map('strtolower', self::values($entry, 'memberof'));
+        }
+        return new Listing($users, $withGroups ? $this->groups($users, $memberOf, $userFilter) : null);
+    }
+
+    /** Attributes entryId() reads */
+    public static function idAttributes(string $configured): array
+    {
+        return ($configured !== '') ? [$configured] : self::ID_ATTRIBUTES;
+    }
+
+    /**
+     * Stable id of an entry: the configured attribute, else objectGUID (as GUID string), entryUUID, nsUniqueId,
+     * ipaUniqueID, else the DN. Also used at login, with an entry of an LdapRecord raw query.
+     */
+    public static function entryId(array $entry, string $configured = ''): string
+    {
+        foreach (self::idAttributes($configured) as $attribute) {
+            $value = self::first($entry, $attribute);
+            if ($value !== null && $value !== '') {
+                return ($attribute === 'objectguid' && strlen($value) === 16) ? self::guid($value) : strtolower($value);
+            }
+        }
+        return 'dn:' . strtolower((string)(self::first($entry, 'dn') ?? ''));
+    }
+
+    /**
+     * @param array<string, DirectoryUser> $users
+     * @param array<string, string[]> $memberOf user id => lowercase group DNs
+     * @return array<string, DirectoryGroup>
+     */
+    private function groups(array $users, array $memberOf, string $userFilter): array
+    {
+        $s = $this->settings;
+        if ($s->groupFilter === '') {
+            throw new DirectoryException('The LDAP group filter is empty');
+        }
+        $userIds = [];
+        foreach ($users as $user) {
+            $userIds[$user->dn] = $user->id;
+        }
+        $attributes = array_merge([$s->groupNameAttribute, 'mail'], self::ID_ATTRIBUTES,
+            ($s->groupMemberMode === 'member') ? [$s->groupMemberAttribute] : []);
+        $groups = [];
+        $groupIds = [];
+        foreach ($this->search(($s->groupBasedn !== '') ? $s->groupBasedn : $s->basedn, self::wrap($s->groupFilter),
+            array_values(array_unique($attributes))) as $entry) {
+            $dn = strtolower((string)$entry['dn']);
+            $mail = self::first($entry, 'mail');
+            $group = new DirectoryGroup(self::entryId($entry), self::first($entry, $s->groupNameAttribute) ?? $dn,
+                ($mail === null) ? null : strtolower($mail));
+            if ($s->groupMemberMode === 'member') {
+                foreach (array_keys($entry) as $key) {
+                    // AD returns large member lists in ranges; a partial list would remove members
+                    if (is_string($key) && str_starts_with($key, $s->groupMemberAttribute . ';range=')) {
+                        throw new DirectoryException('LDAP returned a ranged member list for ' . $dn . ', use the memberOf or AD mode');
+                    }
+                }
+                foreach (self::values($entry, $s->groupMemberAttribute) as $memberDn) {
+                    if (isset($userIds[strtolower($memberDn)])) {
+                        $group->memberIds[] = $userIds[strtolower($memberDn)];
+                    }
+                }
+            }
+            $groups[$group->id] = $group;
+            $groupIds[$dn] = $group->id;
+        }
+        if ($s->groupMemberMode === 'memberof') {
+            foreach ($memberOf as $userId => $dns) {
+                foreach ($dns as $dn) {
+                    if (isset($groupIds[$dn])) {
+                        $groups[$groupIds[$dn]]->memberIds[] = (string)$userId;
+                    }
+                }
+            }
+        } elseif ($s->groupMemberMode === 'ad_chain') {
+            foreach ($groupIds as $dn => $groupId) {
+                $filter = '(&' . $userFilter . '(memberOf:' . self::AD_IN_CHAIN . ':=' . self::escape($dn) . '))';
+                foreach ($this->search($s->basedn, $filter, ['dn']) as $entry) {
+                    $userDn = strtolower((string)$entry['dn']);
+                    if (isset($userIds[$userDn])) {
+                        $groups[$groupId]->memberIds[] = $userIds[$userDn];
+                    }
+                }
+            }
+        }
+        foreach ($groups as $group) {
+            $group->memberIds = array_values(array_unique($group->memberIds));
+        }
+        return $groups;
+    }
+
+    /** Users of the configured filter that have the username attribute */
+    private function userFilter(): string
+    {
+        $filter = ($this->settings->filter !== '') ? self::wrap($this->settings->filter) : '(objectClass=*)';
+        return '(&' . $filter . '(' . $this->settings->usernameField . '=*))';
+    }
+
+    /**
+     * Paged search that fails instead of returning a partial result.
+     *
+     * @return array[] entries as returned by ldap_get_entries()
+     * @throws DirectoryException
+     */
+    protected function search(string $base, string $filter, array $attributes): array
+    {
+        if ($this->connection === null) {
+            throw new DirectoryException('No connection to the LDAP server');
+        }
+        $link = $this->connection->getLdapConnection()->getConnection();
+        $entries = [];
+        $cookie = '';
+        $paged = true;
+        while (true) {
+            $controls = $paged ? [['oid' => LDAP_CONTROL_PAGEDRESULTS, 'iscritical' => true,
+                'value' => ['size' => self::PAGE, 'cookie' => $cookie]]] : [];
+            $result = @ldap_search($link, $base, $filter, $attributes, 0, 0, 0, LDAP_DEREF_NEVER, $controls);
+            if ($result === false) {
+                throw new DirectoryException('LDAP search failed: ' . ldap_error($link));
+            }
+            $responseControls = [];
+            if (!ldap_parse_result($link, $result, $code, $matched, $message, $referrals, $responseControls)) {
+                throw new DirectoryException('LDAP result could not be read: ' . ldap_error($link));
+            }
+            // 12 = unavailableCriticalExtension: no paging on this server, search once without it
+            if ($code === 12 && $paged && $cookie === '') {
+                $paged = false;
+                continue;
+            }
+            if ($code !== 0) {
+                throw new DirectoryException('LDAP search incomplete (code ' . $code . '): ' . (($message !== '') ? $message : ldap_err2str($code)));
+            }
+            $page = ldap_get_entries($link, $result);
+            for ($i = 0; $i < (int)($page['count'] ?? 0); $i++) {
+                $entries[] = $page[$i];
+            }
+            $cookie = $paged ? (string)($responseControls[LDAP_CONTROL_PAGEDRESULTS]['value']['cookie'] ?? '') : '';
+            if ($cookie === '') {
+                return $entries;
+            }
+        }
+    }
+
+    /** First value of an attribute: ldap_get_entries() format or LdapRecord attributes */
+    private static function first(array $entry, string $attribute): ?string
+    {
+        $values = self::values($entry, $attribute);
+        return $values[0] ?? null;
+    }
+
+    /** @return string[] */
+    private static function values(array $entry, string $attribute): array
+    {
+        $raw = $entry[$attribute] ?? $entry[strtolower($attribute)] ?? null;
+        if (!is_array($raw)) {
+            return is_scalar($raw) ? [(string)$raw] : [];
+        }
+        unset($raw['count']);
+        return array_values(array_map('strval', array_filter($raw, 'is_scalar')));
+    }
+
+    private static function wrap(string $filter): string
+    {
+        return str_starts_with($filter, '(') ? $filter : '(' . $filter . ')';
+    }
+
+    /** RFC 4515 value escaping */
+    private static function escape(string $value): string
+    {
+        return str_replace(['\\', '*', '(', ')', "\0"], ['\\5c', '\\2a', '\\28', '\\29', '\\00'], $value);
+    }
+
+    /** Binary objectGUID as the usual GUID string */
+    private static function guid(string $binary): string
+    {
+        $hex = bin2hex($binary);
+        return substr($hex, 6, 2) . substr($hex, 4, 2) . substr($hex, 2, 2) . substr($hex, 0, 2) . '-'
+            . substr($hex, 10, 2) . substr($hex, 8, 2) . '-' . substr($hex, 14, 2) . substr($hex, 12, 2) . '-'
+            . substr($hex, 16, 4) . '-' . substr($hex, 20, 12);
+    }
+}

data/web/inc/lib/mailcow/Identity/Http/KeycloakClient.php

@@ -0,0 +1,92 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Mailcow\Identity\Http;
+
+use Mailcow\Identity\Directory\DirectoryException;
+
+/**
+ * Admin REST API of a Keycloak realm with the client_credentials token of the mailcow client
+ * (service account roles: view-users, query-groups). The HTTP call sits in send() so tests can replace it.
+ */
+class KeycloakClient
+{
+    private ?string $token = null;
+
+    public function __construct(private string $serverUrl, private string $realm, private string $clientId,
+        private string $clientSecret, private bool $ignoreSslError = false)
+    {
+    }
+
+    /**
+     * GET below /admin/realms/<realm>, decoded JSON. A rejected token is renewed once.
+     *
+     * @throws DirectoryException
+     */
+    public function get(string $path, array $query = []): array
+    {
+        $url = $this->serverUrl . '/admin/realms/' . rawurlencode($this->realm) . $path . (empty($query) ? '' : '?' . http_build_query($query));
+        for ($attempt = 0; $attempt < 2; $attempt++) {
+            $this->token ??= $this->fetchToken();
+            [$code, $body] = $this->send('GET', $url, ['Authorization: Bearer ' . $this->token, 'Accept: application/json'], null);
+            if ($code === 401 && $attempt === 0) {
+                $this->token = null;
+                continue;
+            }
+            if ($code !== 200) {
+                throw new DirectoryException('Keycloak returned HTTP ' . $code . ' for ' . $path);
+            }
+            $data = json_decode($body, true);
+            if (!is_array($data)) {
+                throw new DirectoryException('Keycloak returned invalid JSON for ' . $path);
+            }
+            return $data;
+        }
+        throw new DirectoryException('Keycloak rejected the access token of the mailcow client');
+    }
+
+    /** @throws DirectoryException */
+    private function fetchToken(): string
+    {
+        [$code, $body] = $this->send('POST', $this->serverUrl . '/realms/' . rawurlencode($this->realm) . '/protocol/openid-connect/token',
+            ['Content-Type: application/x-www-form-urlencoded'],
+            http_build_query(['grant_type' => 'client_credentials', 'client_id' => $this->clientId, 'client_secret' => $this->clientSecret]));
+        $data = json_decode($body, true);
+        if ($code !== 200 || !is_array($data) || empty($data['access_token'])) {
+            throw new DirectoryException('Keycloak token request failed (HTTP ' . $code . ')');
+        }
+        return (string)$data['access_token'];
+    }
+
+    /**
+     * @return array{0: int, 1: string} HTTP status and body
+     * @throws DirectoryException on transport errors
+     */
+    protected function send(string $method, string $url, array $headers, ?string $body): array
+    {
+        $curl = curl_init($url);
+        curl_setopt_array($curl, [
+            CURLOPT_RETURNTRANSFER => true,
+            CURLOPT_CONNECTTIMEOUT => 5,
+            CURLOPT_TIMEOUT => 30,
+            CURLOPT_HTTPHEADER => $headers,
+        ]);
+        if ($method === 'POST') {
+            curl_setopt($curl, CURLOPT_POST, true);
+            curl_setopt($curl, CURLOPT_POSTFIELDS, (string)$body);
+        }
+        if ($this->ignoreSslError) {
+            curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, false);
+            curl_setopt($curl, CURLOPT_SSL_VERIFYHOST, 0);
+        }
+        $response = curl_exec($curl);
+        $code = (int)curl_getinfo($curl, CURLINFO_HTTP_CODE);
+        $error = curl_error($curl);
+        curl_close($curl);
+        if ($response === false) {
+            throw new DirectoryException('Keycloak request failed: ' . $error);
+        }
+        return [$code, (string)$response];
+    }
+}

data/web/inc/lib/mailcow/Identity/IdentityModule.php

@@ -0,0 +1,85 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Mailcow\Identity;
+
+use Closure;
+use LdapRecord\Connection;
+use Mailcow\Core\ApiResponse;
+use Mailcow\Core\Context;
+use Mailcow\Identity\Controller\IdentityApiController;
+use Mailcow\Identity\Directory\Directory;
+use Mailcow\Identity\Directory\KeycloakDirectory;
+use Mailcow\Identity\Directory\LdapDirectory;
+use Mailcow\Identity\Http\KeycloakClient;
+use Mailcow\Identity\Legacy\LegacyAccounts;
+use Mailcow\Identity\Model\Settings;
+use Mailcow\Identity\Repository\IdentityRepository;
+use Mailcow\Identity\Repository\RunRepository;
+use Mailcow\Identity\Service\LinkService;
+use Mailcow\Identity\Service\StatusService;
+use Mailcow\Identity\Service\SyncPlanner;
+use Mailcow\Identity\Service\SyncService;
+use Mailcow\MailboxGroup\MailboxGroupModule;
+use Mailcow\Sogo\SogoModule;
+use PDO;
+
+/**
+ * Composition root of the identity module (IdP links, sync, offboarding).
+ *
+ *   IdentityModule::create($pdo, Context::system(), identity_provider('get'), fn() => identity_provider('init'))->sync->runDue();  // cron
+ *   IdentityModule::fromGlobals()->api->getLink($username);  // edit page
+ *
+ * Logins use the links through Mailcow\Auth (AuthModule::fromGlobals()->idp).
+ */
+class IdentityModule
+{
+    public function __construct(
+        public readonly Settings $settings,
+        public readonly SyncService $sync,
+        public readonly LinkService $links,
+        public readonly StatusService $status,
+        public readonly IdentityApiController $api
+    ) {
+    }
+
+    /**
+     * @param array $settings identity_provider('get')
+     * @param ?Closure $ldap returns the bound LDAP connection (identity_provider('init')), called when a run starts
+     */
+    public static function create(PDO $pdo, Context $context, array $settings, ?Closure $ldap = null): self
+    {
+        $config = Settings::fromArray($settings);
+        $repo = new IdentityRepository($pdo);
+        $runs = new RunRepository($pdo);
+        $groups = MailboxGroupModule::create($pdo, Context::system());
+        $status = new StatusService($config, $repo, $runs, $context);
+        $directory = fn(): ?Directory => self::directory($config, $ldap);
+        return new self($config,
+            new SyncService($config, $directory, $repo, $runs, new SyncPlanner(), $groups->idp, $groups->templates, new LegacyAccounts(),
+                SogoModule::create()->sogo),
+            new LinkService($repo), $status, new IdentityApiController($status, new ApiResponse()));
+    }
+
+    /** Legacy entry point for procedural callers: reads $pdo, $iam_settings and $_SESSION; $context overrides the session caller */
+    public static function fromGlobals(?Context $context = null): self
+    {
+        $settings = $GLOBALS['iam_settings'] ?? null;
+        return self::create($GLOBALS['pdo'], $context ?? Context::fromSession($_SESSION ?? []),
+            is_array($settings) ? $settings : identity_provider('get'), fn(): mixed => $GLOBALS['iam_provider'] ?? null);
+    }
+
+    private static function directory(Settings $settings, ?Closure $ldap): ?Directory
+    {
+        if ($settings->provider === Settings::KEYCLOAK) {
+            return new KeycloakDirectory(new KeycloakClient($settings->serverUrl, $settings->realm, $settings->clientId,
+                $settings->clientSecret, $settings->ignoreSslError), $settings);
+        }
+        if ($settings->provider === Settings::LDAP) {
+            $connection = ($ldap === null) ? null : $ldap();
+            return new LdapDirectory(($connection instanceof Connection) ? $connection : null, $settings);
+        }
+        return null;
+    }
+}

data/web/inc/lib/mailcow/Identity/Legacy/LegacyAccounts.php

@@ -0,0 +1,30 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Mailcow\Identity\Legacy;
+
+use Mailcow\MailboxGroup\Legacy\LegacyMailbox;
+
+/**
+ * Bridge to the procedural mailbox code for the IdP sync: creating mailboxes, applying templates.
+ */
+class LegacyAccounts extends LegacyMailbox
+{
+    /**
+     * Creates a mailbox of the IdP from a template, like the IdP login does.
+     *
+     * @return ?string null on success, else the message key of the legacy error
+     */
+    public function createMailbox(string $email, string $name, string $authsource, string $template): ?string
+    {
+        return $this->asSystem(fn(): mixed => $this->callCreate($email, $name, $authsource, $template));
+    }
+
+    protected function callCreate(string $email, string $name, string $authsource, string $template): mixed
+    {
+        [$local, $domain] = explode('@', $email, 2);
+        return mailbox('add', 'mailbox_from_template', ['domain' => $domain, 'local_part' => $local, 'name' => $name,
+            'authsource' => $authsource, 'template' => $template]);
+    }
+}

data/web/inc/lib/mailcow/Identity/Model/Account.php

@@ -0,0 +1,27 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Mailcow\Identity\Model;
+
+/**
+ * A mailbox with the authsource of the configured IdP and its link (table `identity_link`).
+ */
+class Account
+{
+    /**
+     * @param int $active       mailbox.active: 1 active, 2 login disabled (still receives mail), 0 inactive
+     * @param bool $idpDisabled the sync set active = 2, so it may undo it
+     * @param ?string $missingSince first complete run that did not list the user
+     */
+    public function __construct(
+        public readonly string $username,
+        public readonly string $name,
+        public readonly int $active,
+        public readonly ?string $externalId = null,
+        public readonly bool $idpDisabled = false,
+        public readonly ?string $missingSince = null,
+        public readonly string $attributeHash = ''
+    ) {
+    }
+}

data/web/inc/lib/mailcow/Identity/Model/DirectoryGroup.php

@@ -0,0 +1,23 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Mailcow\Identity\Model;
+
+/**
+ * A selected IdP group with the ids of its member users.
+ */
+class DirectoryGroup
+{
+    /**
+     * @param ?string $mail      group address in the IdP, decides the domain of an auto-created group
+     * @param string[] $memberIds ids of the member users (DirectoryUser::$id)
+     */
+    public function __construct(
+        public readonly string $id,
+        public readonly string $name,
+        public readonly ?string $mail = null,
+        public array $memberIds = []
+    ) {
+    }
+}

data/web/inc/lib/mailcow/Identity/Model/DirectoryUser.php

@@ -0,0 +1,26 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Mailcow\Identity\Model;
+
+/**
+ * A user as listed by the IdP. `id` is stable across renames (Keycloak user id, LDAP objectGUID/entryUUID/...).
+ */
+class DirectoryUser
+{
+    /**
+     * @param ?string $email   lowercase, null if the user has none
+     * @param string[] $templateValues values of the template attribute (legacy mapping)
+     * @param string $dn       LDAP only, lowercase, used to resolve group members
+     */
+    public function __construct(
+        public readonly string $id,
+        public readonly ?string $email,
+        public readonly string $name,
+        public readonly bool $enabled,
+        public readonly array $templateValues = [],
+        public readonly string $dn = ''
+    ) {
+    }
+}

data/web/inc/lib/mailcow/Identity/Model/Listing.php

@@ -0,0 +1,20 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Mailcow\Identity\Model;
+
+/**
+ * A complete listing of the IdP. Directories never return partial listings, they throw DirectoryException,
+ * so a user missing here is really gone (or out of the filter).
+ */
+class Listing
+{
+    /**
+     * @param array<string, DirectoryUser> $users by id
+     * @param ?array<string, DirectoryGroup> $groups by id, null when groups were not listed
+     */
+    public function __construct(public readonly array $users, public readonly ?array $groups = null)
+    {
+    }
+}

data/web/inc/lib/mailcow/Identity/Model/Settings.php

@@ -0,0 +1,118 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Mailcow\Identity\Model;
+
+/**
+ * Identity provider settings (table `identity_provider`, key/value, see identity_provider('get')) with defaults.
+ */
+class Settings
+{
+    public const KEYCLOAK = 'keycloak';
+    public const LDAP = 'ldap';
+    public const GENERIC_OIDC = 'generic-oidc';
+    public const MEMBER_MODES = ['memberof', 'member', 'ad_chain'];
+
+    public string $provider = '';
+    public bool $periodicSync = false;
+    public bool $importUsers = false;
+    /** Minutes between scheduled runs */
+    public int $syncInterval = 15;
+    /** Users disabled or removed in the IdP get login disabled (mailbox.active = 2) */
+    public bool $offboarding = false;
+    /** Max. share (percent) of active IdP mailboxes one run may deactivate, at least 5 mailboxes */
+    public int $offboardingLimit = 10;
+    public bool $groupSync = false;
+    public bool $groupAutocreate = true;
+    public string $groupDefaultDomain = '';
+    public string $defaultTemplate = '';
+    /** @var string[] attribute value per mapping, keys aligned with $templates */
+    public array $mappers = [];
+    /** @var string[] */
+    public array $templates = [];
+    public string $serverUrl = '';
+    public string $realm = '';
+    public string $clientId = '';
+    public string $clientSecret = '';
+    public bool $ignoreSslError = false;
+    /** @var string[] Keycloak group paths: '/path', '/path/*' (subtree) or '/*' (all) */
+    public array $groupPaths = [];
+    public string $basedn = '';
+    public string $filter = '';
+    public string $usernameField = 'mail';
+    public string $attributeField = '';
+    /** LDAP attribute with the stable user id, '' = objectGUID, entryUUID, nsUniqueId, ipaUniqueID, else the DN */
+    public string $idAttribute = '';
+    /** LDAP filter matching disabled users (besides AD userAccountControl) */
+    public string $disabledFilter = '';
+    public string $groupBasedn = '';
+    public string $groupFilter = '';
+    public string $groupNameAttribute = 'cn';
+    public string $groupMemberMode = 'memberof';
+    public string $groupMemberAttribute = 'member';
+
+    public static function fromArray(array $s): self
+    {
+        $settings = new self();
+        $settings->provider = (string)($s['authsource'] ?? '');
+        $settings->periodicSync = self::flag($s['periodic_sync'] ?? 0);
+        $settings->importUsers = self::flag($s['import_users'] ?? 0);
+        $settings->syncInterval = max(1, (int)($s['sync_interval'] ?? 15));
+        $settings->offboarding = self::flag($s['offboarding'] ?? 0);
+        $settings->offboardingLimit = min(100, max(0, (int)($s['offboarding_limit'] ?? 10)));
+        $settings->groupSync = self::flag($s['group_sync'] ?? 0);
+        $settings->groupAutocreate = self::flag($s['group_autocreate'] ?? 1);
+        $settings->groupDefaultDomain = strtolower(trim((string)($s['group_default_domain'] ?? '')));
+        $settings->defaultTemplate = (string)($s['default_template'] ?? '');
+        $settings->mappers = array_map('strval', (array)($s['mappers'] ?? []));
+        $settings->templates = array_map('strval', (array)($s['templates'] ?? []));
+        $settings->serverUrl = rtrim((string)($s['server_url'] ?? ''), '/');
+        $settings->realm = (string)($s['realm'] ?? '');
+        $settings->clientId = (string)($s['client_id'] ?? '');
+        $settings->clientSecret = (string)($s['client_secret'] ?? '');
+        $settings->ignoreSslError = self::flag($s['ignore_ssl_error'] ?? 0);
+        $settings->groupPaths = array_values(array_filter(array_map('trim', explode(',', (string)($s['group_paths'] ?? ''))), 'strlen'));
+        $settings->basedn = (string)($s['basedn'] ?? '');
+        $settings->filter = trim((string)($s['filter'] ?? ''));
+        $settings->usernameField = strtolower((string)(($s['username_field'] ?? '') ?: 'mail'));
+        $settings->attributeField = strtolower(trim((string)($s['attribute_field'] ?? '')));
+        $settings->idAttribute = strtolower(trim((string)($s['id_attribute'] ?? '')));
+        $settings->disabledFilter = trim((string)($s['disabled_filter'] ?? ''));
+        $settings->groupBasedn = trim((string)($s['group_basedn'] ?? ''));
+        $settings->groupFilter = trim((string)($s['group_filter'] ?? ''));
+        $settings->groupNameAttribute = strtolower((string)(($s['group_name_attribute'] ?? '') ?: 'cn'));
+        $mode = (string)($s['group_member_mode'] ?? 'memberof');
+        $settings->groupMemberMode = in_array($mode, self::MEMBER_MODES, true) ? $mode : 'memberof';
+        $settings->groupMemberAttribute = strtolower((string)(($s['group_member_attribute'] ?? '') ?: 'member'));
+        return $settings;
+    }
+
+    /** Only Keycloak and LDAP can be listed by the sync */
+    public function canSync(): bool
+    {
+        return in_array($this->provider, [self::KEYCLOAK, self::LDAP], true);
+    }
+
+    public function syncEnabled(): bool
+    {
+        return $this->canSync() && ($this->periodicSync || $this->importUsers || $this->offboarding || $this->groupSync);
+    }
+
+    /** Template of the first mapping (in configured order) matching one of the values, null if none */
+    public function mappedTemplate(array $values): ?string
+    {
+        $values = array_map('strval', array_filter($values, 'is_scalar'));
+        foreach ($this->mappers as $key => $mapper) {
+            if (in_array($mapper, $values, true) && ($this->templates[$key] ?? '') !== '') {
+                return $this->templates[$key];
+            }
+        }
+        return null;
+    }
+
+    private static function flag(mixed $value): bool
+    {
+        return filter_var($value, FILTER_VALIDATE_BOOLEAN);
+    }
+}

data/web/inc/lib/mailcow/Identity/Model/State.php

@@ -0,0 +1,30 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Mailcow\Identity\Model;
+
+/**
+ * What mailcow knows before a sync run, read by SyncService and planned against by SyncPlanner.
+ */
+class State
+{
+    /**
+     * @param array<string, Account> $accounts           mailboxes with the provider as authsource, by username
+     * @param array<string, string> $mailboxes           username => authsource of every mailbox
+     * @param string[] $domains                          mailcow domains
+     * @param array[] $groups                            mailbox groups {id, domain, name, idp_ref, template, priority,
+     *                                                   active, members: username => source}
+     * @param array<string, ?string> $effectiveTemplates username => effective group template
+     * @param array<string, string> $templateHashes      template name => attribute hash
+     */
+    public function __construct(
+        public readonly array $accounts,
+        public readonly array $mailboxes = [],
+        public readonly array $domains = [],
+        public readonly array $groups = [],
+        public readonly array $effectiveTemplates = [],
+        public readonly array $templateHashes = []
+    ) {
+    }
+}

data/web/inc/lib/mailcow/Identity/Model/SyncPlan.php

@@ -0,0 +1,73 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Mailcow\Identity\Model;
+
+/**
+ * What one sync run changes. Built by SyncPlanner from a listing and the current state, applied by SyncService.
+ */
+class SyncPlan
+{
+    /** Details per kind kept in the stored summary */
+    private const DETAILS = 50;
+
+    /** @var array<string, string> username => external id (adopted by email or relinked) */
+    public array $links = [];
+    /** @var array[] {email, name, template, id}: mailboxes to create */
+    public array $creates = [];
+    /** @var string[] usernames set to login disabled (active = 2) */
+    public array $deactivate = [];
+    /** @var string[] usernames the sync had disabled and the IdP enabled again (active = 1) */
+    public array $restore = [];
+    /** @var string[] usernames whose idp_disabled marker is dropped, active stays (an admin changed it) */
+    public array $release = [];
+    /** @var string[] usernames not listed for the first time (missing_since is set) */
+    public array $missing = [];
+    /** @var string[] usernames listed again (missing_since is cleared) */
+    public array $found = [];
+    /** @var array[] {username, name, template}: existing mailboxes whose name/template is synced; template = legacy mapping */
+    public array $updates = [];
+    /** @var array<string, array> username => {name, template}: IdP name and legacy mapping of every listed mailbox */
+    public array $profiles = [];
+    /** @var array[] {ref, name, domain, mail}: groups to create for IdP groups */
+    public array $groupCreates = [];
+    /** @var array<int, string> group id => new name */
+    public array $groupRenames = [];
+    /** @var array<string, string[]> group ref => usernames of its IdP members */
+    public array $memberships = [];
+    /** @var int[] linked groups no longer listed; their IdP members are removed */
+    public array $orphanedGroups = [];
+    /** Number of IdP memberships the plan removes (for the guard) */
+    public int $membershipRemovals = 0;
+    /** @var string[] situations an admin has to resolve */
+    public array $conflicts = [];
+    /** Users without email, not in a mailcow domain or without template (not created) */
+    public int $skipped = 0;
+    /** The guard stopped deactivations and membership removals */
+    public bool $blocked = false;
+
+    /** Stored with the run and shown in the UI */
+    public function summary(): array
+    {
+        $summary = ['counts' => [], 'details' => []];
+        foreach (['links' => 'links', 'creates' => 'creates', 'deactivate' => 'deactivate', 'restore' => 'restore',
+            'release' => 'release', 'missing' => 'missing', 'found' => 'found', 'updates' => 'updates', 'group_creates' => 'groupCreates',
+            'group_renames' => 'groupRenames', 'memberships' => 'memberships', 'orphaned_groups' => 'orphanedGroups',
+            'conflicts' => 'conflicts'] as $key => $kind) {
+            $summary['counts'][$key] = count($this->$kind);
+        }
+        $summary['counts']['membership_removals'] = $this->membershipRemovals;
+        $summary['counts']['skipped'] = $this->skipped;
+        $summary['details'] = [
+            'creates' => array_slice(array_column($this->creates, 'email'), 0, self::DETAILS),
+            'deactivate' => array_slice($this->deactivate, 0, self::DETAILS),
+            'restore' => array_slice($this->restore, 0, self::DETAILS),
+            'missing' => array_slice($this->missing, 0, self::DETAILS),
+            'group_creates' => array_slice(array_column($this->groupCreates, 'name'), 0, self::DETAILS),
+            'conflicts' => array_slice($this->conflicts, 0, self::DETAILS),
+        ];
+        $summary['blocked'] = $this->blocked;
+        return $summary;
+    }
+}

data/web/inc/lib/mailcow/Identity/Repository/IdentityRepository.php

@@ -0,0 +1,130 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Mailcow\Identity\Repository;
+
+use Mailcow\Core\Repository;
+use Mailcow\Identity\Model\Account;
+use PDO;
+
+/**
+ * SQL for IdP mailboxes and their links (table `identity_link`).
+ */
+class IdentityRepository extends Repository
+{
+    /** @return array<string, Account> mailboxes with the provider as authsource, by username */
+    public function accounts(string $provider): array
+    {
+        $rows = $this->query("SELECT m.`username`, m.`name`, m.`active`,
+            JSON_UNQUOTE(JSON_EXTRACT(m.`attributes`, '$.attribute_hash')) AS `attribute_hash`,
+            l.`external_id`, l.`idp_disabled`, l.`missing_since`
+          FROM `mailbox` m
+            LEFT JOIN `identity_link` l ON l.`username` = m.`username` AND l.`provider` = :p1
+          WHERE m.`authsource` = :p2 AND m.`kind` = ''", ['p1' => $provider, 'p2' => $provider])->fetchAll(PDO::FETCH_ASSOC);
+        $accounts = [];
+        foreach ($rows as $row) {
+            $accounts[(string)$row['username']] = new Account((string)$row['username'], (string)$row['name'], (int)$row['active'],
+                isset($row['external_id']) ? (string)$row['external_id'] : null, (int)($row['idp_disabled'] ?? 0) === 1,
+                isset($row['missing_since']) ? (string)$row['missing_since'] : null, (string)($row['attribute_hash'] ?? ''));
+        }
+        return $accounts;
+    }
+
+    /** @return array{accounts: int, linked: int, idp_disabled: int, missing: int} mailboxes of the provider */
+    public function stats(string $provider): array
+    {
+        $row = $this->query("SELECT COUNT(*) AS `accounts`, COUNT(l.`external_id`) AS `linked`,
+            COALESCE(SUM(l.`idp_disabled`), 0) AS `idp_disabled`, COUNT(l.`missing_since`) AS `missing`
+          FROM `mailbox` m LEFT JOIN `identity_link` l ON l.`username` = m.`username` AND l.`provider` = :p1
+          WHERE m.`authsource` = :p2 AND m.`kind` = ''", ['p1' => $provider, 'p2' => $provider])->fetch(PDO::FETCH_ASSOC);
+        return array_map('intval', $row);
+    }
+
+    /** @return array<string, string> username => authsource of every mailbox (incl. resources) */
+    public function mailboxes(): array
+    {
+        return $this->query("SELECT `username`, `authsource` FROM `mailbox`")->fetchAll(PDO::FETCH_KEY_PAIR);
+    }
+
+    /** @return string[] mailcow domains (no alias domains) */
+    public function domains(): array
+    {
+        return $this->query("SELECT `domain` FROM `domain`")->fetchAll(PDO::FETCH_COLUMN);
+    }
+
+    /** @return array<string, string> template name => hash as stored by mailbox_from_template in attributes.attribute_hash */
+    public function templateHashes(): array
+    {
+        $hashes = [];
+        foreach ($this->query("SELECT `template`, `attributes` FROM `templates` WHERE `type` = 'mailbox'")->fetchAll(PDO::FETCH_ASSOC) as $row) {
+            $hashes[(string)$row['template']] = sha1(json_encode($row['attributes']));
+        }
+        return $hashes;
+    }
+
+    /** @return ?array{provider: string, external_id: string, idp_disabled: int, missing_since: ?string} */
+    public function findLink(string $username): ?array
+    {
+        $row = $this->query("SELECT `provider`, `external_id`, `idp_disabled`, `missing_since` FROM `identity_link` WHERE `username` = :username",
+            ['username' => $username])->fetch(PDO::FETCH_ASSOC);
+        return $row ?: null;
+    }
+
+    /** Mailbox linked to the IdP user; links of mailboxes that no longer use the provider do not count */
+    public function usernameOf(string $provider, string $externalId): ?string
+    {
+        $username = $this->query("SELECT l.`username` FROM `identity_link` l
+            JOIN `mailbox` m ON m.`username` = l.`username` AND m.`authsource` = l.`provider`
+          WHERE l.`provider` = :provider AND l.`external_id` = :id", ['provider' => $provider, 'id' => $externalId])->fetchColumn();
+        return ($username === false) ? null : (string)$username;
+    }
+
+    /**
+     * Links the mailbox to the IdP user; an older link of the mailbox is replaced. Callers make sure the IdP user
+     * is not linked to another mailbox of the provider (usernameOf()); stale links of the id are dropped.
+     */
+    public function link(string $username, string $provider, string $externalId): void
+    {
+        $this->transaction(function () use ($username, $provider, $externalId): void {
+            $this->query("DELETE FROM `identity_link` WHERE `provider` = :provider AND `external_id` = :id AND `username` != :username",
+                ['provider' => $provider, 'id' => $externalId, 'username' => $username]);
+            $this->query("INSERT INTO `identity_link` (`username`, `provider`, `external_id`) VALUES (:username, :provider, :id)
+              ON DUPLICATE KEY UPDATE `provider` = VALUES(`provider`), `external_id` = VALUES(`external_id`), `missing_since` = NULL",
+                ['username' => $username, 'provider' => $provider, 'id' => $externalId]);
+        });
+    }
+
+    public function unlink(string $username): void
+    {
+        $this->query("DELETE FROM `identity_link` WHERE `username` = :username", ['username' => $username]);
+    }
+
+    /** Marks the IdP mailbox as not listed (now) or listed again; unlinked mailboxes get a link row without id */
+    public function setMissing(string $username, string $provider, bool $missing): void
+    {
+        $this->query("INSERT INTO `identity_link` (`username`, `provider`, `missing_since`) VALUES (:username, :provider, "
+            . ($missing ? "NOW()" : "NULL") . ") ON DUPLICATE KEY UPDATE `missing_since` = VALUES(`missing_since`)",
+            ['username' => $username, 'provider' => $provider]);
+    }
+
+    /**
+     * Sets mailbox.active like the mailbox edit does (incl. the mailbox's own alias row) and records whether the
+     * IdP sync caused it.
+     */
+    public function setActive(string $username, string $provider, int $active, bool $idpDisabled): void
+    {
+        $this->transaction(function () use ($username, $provider, $active, $idpDisabled): void {
+            $this->query("UPDATE `mailbox` SET `active` = :active WHERE `username` = :username", ['active' => $active, 'username' => $username]);
+            $this->query("UPDATE `alias` SET `active` = :active WHERE `address` = :username", ['active' => $active, 'username' => $username]);
+            $this->setIdpDisabled($username, $provider, $idpDisabled);
+        });
+    }
+
+    public function setIdpDisabled(string $username, string $provider, bool $idpDisabled): void
+    {
+        $this->query("INSERT INTO `identity_link` (`username`, `provider`, `idp_disabled`) VALUES (:username, :provider, :flag)
+          ON DUPLICATE KEY UPDATE `idp_disabled` = VALUES(`idp_disabled`)",
+            ['username' => $username, 'provider' => $provider, 'flag' => $idpDisabled ? 1 : 0]);
+    }
+}

data/web/inc/lib/mailcow/Identity/Repository/RunRepository.php

@@ -0,0 +1,81 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Mailcow\Identity\Repository;
+
+use Mailcow\Core\Repository;
+use PDO;
+
+/**
+ * Sync runs (table `identity_sync_run`): requests from the UI (status pending), the run itself and its summary.
+ */
+class RunRepository extends Repository
+{
+    private const KEEP = 30;
+
+    /** Queues a run for the cron; an identical pending request is reused */
+    public function request(string $provider, string $mode, string $requestedBy): int
+    {
+        $id = $this->query("SELECT `id` FROM `identity_sync_run` WHERE `status` = 'pending' AND `mode` = :mode",
+            ['mode' => $mode])->fetchColumn();
+        if ($id !== false) {
+            return (int)$id;
+        }
+        return $this->insertRow('identity_sync_run', ['provider' => $provider, 'mode' => $mode, 'status' => 'pending',
+            'requested_by' => $requestedBy]);
+    }
+
+    /** @return ?array oldest pending request */
+    public function nextPending(): ?array
+    {
+        $row = $this->query("SELECT * FROM `identity_sync_run` WHERE `status` = 'pending' ORDER BY `id` LIMIT 1")->fetch(PDO::FETCH_ASSOC);
+        return $row ?: null;
+    }
+
+    /** A scheduled run (not requested by anyone) */
+    public function create(string $provider, string $mode): int
+    {
+        return $this->insertRow('identity_sync_run', ['provider' => $provider, 'mode' => $mode, 'status' => 'pending', 'requested_by' => '']);
+    }
+
+    public function start(int $id): void
+    {
+        $this->query("UPDATE `identity_sync_run` SET `status` = 'running', `started` = NOW() WHERE `id` = :id", ['id' => $id]);
+    }
+
+    public function finish(int $id, string $status, array $summary): void
+    {
+        $this->query("UPDATE `identity_sync_run` SET `status` = :status, `finished` = NOW(), `summary` = :summary WHERE `id` = :id",
+            ['status' => $status, 'summary' => json_encode($summary), 'id' => $id]);
+        $this->query("DELETE FROM `identity_sync_run` WHERE `id` NOT IN (SELECT `id` FROM (SELECT `id` FROM `identity_sync_run`
+          ORDER BY `id` DESC LIMIT " . self::KEEP . ") AS `keep`)");
+    }
+
+    /** Seconds since the last scheduled run started, null if there was none */
+    public function secondsSinceScheduled(): ?int
+    {
+        $seconds = $this->query("SELECT TIMESTAMPDIFF(SECOND, MAX(`started`), NOW()) FROM `identity_sync_run`
+          WHERE `requested_by` = '' AND `mode` = 'run'")->fetchColumn();
+        return ($seconds === false || $seconds === null) ? null : (int)$seconds;
+    }
+
+    /** Runs left in status running by a crashed cron are closed, so they do not hide new runs */
+    public function failStale(int $minutes): void
+    {
+        $this->query("UPDATE `identity_sync_run` SET `status` = 'error', `finished` = NOW(),
+            `summary` = JSON_OBJECT('error', 'The sync run did not finish')
+          WHERE `status` = 'running' AND `started` < NOW() - INTERVAL :minutes MINUTE", ['minutes' => $minutes]);
+    }
+
+    /** @return array[] newest first, summary decoded */
+    public function recent(int $limit = 10): array
+    {
+        $rows = $this->query("SELECT * FROM `identity_sync_run` ORDER BY `id` DESC LIMIT " . max(1, $limit))->fetchAll(PDO::FETCH_ASSOC);
+        foreach ($rows as &$row) {
+            $row['id'] = (int)$row['id'];
+            $row['summary'] = ($row['summary'] === null) ? null : json_decode((string)$row['summary'], true);
+        }
+        return $rows;
+    }
+}

data/web/inc/lib/mailcow/Identity/Service/LinkService.php

@@ -0,0 +1,51 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Mailcow\Identity\Service;
+
+use Mailcow\Identity\Repository\IdentityRepository;
+
+/**
+ * Links of mailboxes to IdP users, checked at IdP logins (REST, LDAP bind, OIDC). Mailboxes are found by email,
+ * so the IdP user id has to match the link: an address taken over by another IdP user must not open the old
+ * mailbox. Unlinked mailboxes are linked on their first login.
+ */
+class LinkService
+{
+    public function __construct(private IdentityRepository $repo)
+    {
+    }
+
+    /** The IdP user may log in to the mailbox; links the mailbox when it has no link yet */
+    public function verify(string $provider, string $username, string $externalId): bool
+    {
+        if ($externalId === '') {
+            return false;
+        }
+        $link = $this->repo->findLink($username);
+        if ($link !== null && $link['provider'] === $provider && $link['external_id'] !== null) {
+            return hash_equals((string)$link['external_id'], $externalId);
+        }
+        if (!$this->mayCreate($provider, $username, $externalId)) {
+            return false;
+        }
+        $this->repo->link($username, $provider, $externalId);
+        return true;
+    }
+
+    /** The IdP user owns no other mailbox (checked before a mailbox is created on login) */
+    public function mayCreate(string $provider, string $username, string $externalId): bool
+    {
+        $owner = ($externalId === '') ? null : $this->repo->usernameOf($provider, $externalId);
+        return $externalId !== '' && ($owner === null || $owner === $username);
+    }
+
+    /** Links a mailbox created on login */
+    public function link(string $provider, string $username, string $externalId): void
+    {
+        if ($externalId !== '') {
+            $this->repo->link($username, $provider, $externalId);
+        }
+    }
+}

data/web/inc/lib/mailcow/Identity/Service/StatusService.php

@@ -0,0 +1,80 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Mailcow\Identity\Service;
+
+use Mailcow\Core\AccessDenied;
+use Mailcow\Core\Context;
+use Mailcow\Core\Input;
+use Mailcow\Core\UserError;
+use Mailcow\Identity\Model\Settings;
+use Mailcow\Identity\Repository\IdentityRepository;
+use Mailcow\Identity\Repository\RunRepository;
+
+/**
+ * Admin use cases of the sync: status, run requests (executed by the cron) and links of mailboxes.
+ * Admins only, read-only API keys may read. Domain admins may read the link of mailboxes they manage.
+ */
+class StatusService
+{
+    public const MODES = ['preview', 'run', 'force'];
+
+    public function __construct(private Settings $settings, private IdentityRepository $repo, private RunRepository $runs,
+        private Context $context)
+    {
+    }
+
+    /** @throws AccessDenied */
+    public function status(): array
+    {
+        $this->context->requireAdmin(false);
+        return [
+            'provider' => $this->settings->provider,
+            'can_sync' => $this->settings->canSync(),
+            'sync_enabled' => $this->settings->syncEnabled(),
+            'counts' => $this->repo->stats($this->settings->provider),
+            'runs' => $this->runs->recent(),
+        ];
+    }
+
+    /**
+     * Queues a run for the cron: preview (dry run), run, or force (run without the change limit).
+     *
+     * @throws UserError
+     */
+    public function requestRun(mixed $mode): int
+    {
+        $this->context->requireAdmin();
+        $mode = Input::text($mode);
+        if (!in_array($mode, self::MODES, true)) {
+            throw new UserError('iam_sync_mode_invalid');
+        }
+        if (!$this->settings->canSync()) {
+            throw new UserError('iam_sync_unavailable');
+        }
+        return $this->runs->request($this->settings->provider, $mode, (string)$this->context->username);
+    }
+
+    /** Link of a mailbox for the mailbox edit page, null if none or not allowed */
+    public function link(string $username): ?array
+    {
+        $username = strtolower(trim($username));
+        if (!($this->context->hasAdminRights() || ($this->context->isDomainAdmin() && $this->context->canAccessMailbox($username)))) {
+            return null;
+        }
+        return $this->repo->findLink($username);
+    }
+
+    /**
+     * Drops the link, the mailbox is linked again by email (next run or login). Resolves conflicts, e.g. when an
+     * address was given to another IdP user.
+     *
+     * @throws AccessDenied
+     */
+    public function unlink(string $username): void
+    {
+        $this->context->requireAdmin();
+        $this->repo->unlink(strtolower(trim($username)));
+    }
+}

data/web/inc/lib/mailcow/Identity/Service/SyncPlanner.php

@@ -0,0 +1,311 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Mailcow\Identity\Service;
+
+use Mailcow\Identity\Model\Account;
+use Mailcow\Identity\Model\DirectoryGroup;
+use Mailcow\Identity\Model\DirectoryUser;
+use Mailcow\Identity\Model\Listing;
+use Mailcow\Identity\Model\Settings;
+use Mailcow\Identity\Model\State;
+use Mailcow\Identity\Model\SyncPlan;
+
+/**
+ * Decides what a sync run changes, without side effects.
+ *
+ * Users: linked mailboxes are found by IdP user id, unlinked ones are adopted by email. A mailbox linked to
+ *        another IdP user, or an IdP user whose email moved away from its mailbox, is a conflict; nothing is
+ *        relinked or created for it.
+ * Offboarding: a user disabled in the IdP, or not listed by two consecutive complete runs, gets login disabled
+ *        (active = 2), once per IdP disable. Only those mailboxes are activated again when the IdP enables
+ *        the user; manual changes of active always win.
+ * Groups: IdP groups map to mailbox groups by idp_ref; unknown ones are created in the domain of their mail,
+ *        else in the default group domain. Linked users that are not listed keep their IdP memberships.
+ * Guard: more deactivations or membership removals than max(5, limit % of active IdP mailboxes resp. IdP
+ *        memberships) block the run unless forced.
+ */
+class SyncPlanner
+{
+    private const GUARD_MIN = 5;
+
+    public function plan(Settings $settings, Listing $listing, State $state, bool $force = false): SyncPlan
+    {
+        $plan = new SyncPlan();
+        $owners = [];
+        foreach ($state->accounts as $username => $account) {
+            if ($account->externalId !== null) {
+                $owners[$account->externalId] = (string)$username;
+            }
+        }
+        /** @var array<string, DirectoryUser> $matched username => listed user */
+        $matched = [];
+        /** @var array<string, DirectoryUser> $candidates email => user to create, template still open */
+        $candidates = [];
+        $duplicates = [];
+        foreach ($listing->users as $user) {
+            if (isset($owners[$user->id])) {
+                $username = $owners[$user->id];
+                if ($user->email !== null && $user->email !== $username) {
+                    self::conflict($plan, $username . ' is linked to an IdP user whose email is now ' . $user->email);
+                }
+                $matched[$username] = $user;
+            } elseif ($user->email === null) {
+                $plan->skipped++;
+            } elseif (isset($state->accounts[$user->email])) {
+                $account = $state->accounts[$user->email];
+                if ($account->externalId !== null || isset($plan->links[$user->email])) {
+                    self::conflict($plan, $user->email . ' is linked to another IdP user');
+                    continue;
+                }
+                $plan->links[$user->email] = $user->id;
+                $matched[$user->email] = $user;
+            } elseif (isset($state->mailboxes[$user->email]) || !$settings->importUsers || !$user->enabled
+                || !in_array(substr((string)strrchr($user->email, '@'), 1), $state->domains, true)) {
+                // other authsource, import off, disabled or no mailcow domain
+                $plan->skipped++;
+            } elseif (isset($candidates[$user->email]) || isset($duplicates[$user->email])) {
+                self::conflict($plan, 'Several IdP users have the email ' . $user->email);
+                unset($candidates[$user->email]);
+                $duplicates[$user->email] = true;
+            } else {
+                $candidates[$user->email] = $user;
+            }
+        }
+        $groups = ($settings->groupSync && $listing->groups !== null) ? $listing->groups : null;
+        $this->planCreates($settings, $candidates, $groups ?? [], $state, $plan);
+        $usernames = [];
+        foreach ($matched as $username => $user) {
+            $usernames[$user->id] = (string)$username;
+        }
+        foreach ($plan->creates as $create) {
+            $usernames[$create['id']] = $create['email'];
+        }
+        if ($groups !== null) {
+            $this->planGroups($settings, $groups, $state, $usernames, $matched, $plan);
+        }
+        $this->planStates($settings, $state, $matched, $plan);
+        if ($settings->periodicSync) {
+            $this->planUpdates($settings, $state, $matched, $plan);
+        }
+        $active = count(array_filter($state->accounts, fn(Account $a): bool => $a->active === 1));
+        $memberships = array_sum(array_map(fn(array $g): int => count(self::idpMembers($g)), $state->groups));
+        if (!$force && (count($plan->deactivate) > self::limit($active, $settings->offboardingLimit)
+            || $plan->membershipRemovals > self::limit($memberships, $settings->offboardingLimit))) {
+            $plan->blocked = true;
+        }
+        return $plan;
+    }
+
+    /**
+     * @param array<string, DirectoryGroup> $groups
+     * @param array<string, string> $usernames user id => username of matched and new users
+     */
+    private function planGroups(Settings $settings, array $groups, State $state, array $usernames, array $matched, SyncPlan $plan): void
+    {
+        $linked = [];
+        $names = [];
+        foreach ($state->groups as $group) {
+            if ($group['idp_ref'] !== null) {
+                $linked[(string)$group['idp_ref']] = $group;
+            }
+            $names[$group['domain']][mb_strtolower($group['name'])] = (int)$group['id'];
+        }
+        foreach ($groups as $ref => $directoryGroup) {
+            $ref = (string)$ref;
+            $members = [];
+            foreach ($directoryGroup->memberIds as $id) {
+                if (isset($usernames[$id])) {
+                    $members[] = $usernames[$id];
+                }
+            }
+            $current = $linked[$ref] ?? null;
+            if ($current === null) {
+                if (!$settings->groupAutocreate) {
+                    continue;
+                }
+                $domain = self::groupDomain($settings, $directoryGroup, $state->domains);
+                if ($domain === null) {
+                    self::conflict($plan, 'IdP group ' . $directoryGroup->name . ' has no mailcow domain');
+                    continue;
+                }
+                if (isset($names[$domain][mb_strtolower($directoryGroup->name)])) {
+                    self::conflict($plan, 'A group ' . $directoryGroup->name . ' exists in ' . $domain . ' and is not linked to the IdP group');
+                    continue;
+                }
+                $names[$domain][mb_strtolower($directoryGroup->name)] = 0;
+                $plan->groupCreates[] = ['ref' => $ref, 'name' => $directoryGroup->name, 'domain' => $domain, 'mail' => $directoryGroup->mail];
+                $plan->memberships[$ref] = self::sorted($members);
+                continue;
+            }
+            $idpMembers = self::idpMembers($current);
+            // Linked users missing in the listing keep their memberships until they are listed again
+            foreach ($idpMembers as $username) {
+                if (isset($state->accounts[$username]) && !isset($matched[$username])) {
+                    $members[] = $username;
+                }
+            }
+            $members = self::sorted($members);
+            $removed = array_diff($idpMembers, $members);
+            if (!empty($removed) || !empty(array_diff($members, array_map('strval', array_keys($current['members']))))) {
+                $plan->memberships[$ref] = $members;
+                $plan->membershipRemovals += count($removed);
+            }
+            if ($directoryGroup->name !== $current['name']) {
+                $taken = $names[$current['domain']][mb_strtolower($directoryGroup->name)] ?? null;
+                if ($taken !== null && $taken !== (int)$current['id']) {
+                    self::conflict($plan, 'IdP group ' . $current['name'] . ' was renamed to ' . $directoryGroup->name . ', which exists in ' . $current['domain']);
+                } else {
+                    $plan->groupRenames[(int)$current['id']] = $directoryGroup->name;
+                    $names[$current['domain']][mb_strtolower($directoryGroup->name)] = (int)$current['id'];
+                }
+            }
+        }
+        foreach ($linked as $ref => $group) {
+            if (!isset($groups[$ref])) {
+                $plan->orphanedGroups[] = (int)$group['id'];
+                $plan->membershipRemovals += count(self::idpMembers($group));
+            }
+        }
+    }
+
+    /**
+     * Template of a new mailbox: the template of its highest-priority linked group (as in TemplateService), else
+     * the attribute mapping, else the default template.
+     *
+     * @param array<string, DirectoryUser> $candidates
+     * @param array<string, DirectoryGroup> $groups listed groups, [] without group sync
+     */
+    private function planCreates(Settings $settings, array $candidates, array $groups, State $state, SyncPlan $plan): void
+    {
+        $linked = [];
+        foreach ($state->groups as $group) {
+            if ($group['idp_ref'] !== null && $group['template'] !== null && $group['active'] === 1) {
+                $linked[(string)$group['idp_ref']] = $group;
+            }
+        }
+        $groupsOf = [];
+        foreach ($groups as $ref => $directoryGroup) {
+            if (isset($linked[(string)$ref])) {
+                foreach ($directoryGroup->memberIds as $id) {
+                    $groupsOf[$id][] = $linked[(string)$ref];
+                }
+            }
+        }
+        foreach ($candidates as $email => $user) {
+            $best = null;
+            foreach ($groupsOf[$user->id] ?? [] as $group) {
+                if ($best === null || $group['priority'] > $best['priority'] || ($group['priority'] === $best['priority'] && $group['id'] < $best['id'])) {
+                    $best = $group;
+                }
+            }
+            $template = $best['template'] ?? $settings->mappedTemplate($user->templateValues)
+                ?? (($settings->defaultTemplate !== '') ? $settings->defaultTemplate : null);
+            if ($template === null) {
+                self::conflict($plan, 'No template matches ' . $email);
+                continue;
+            }
+            $plan->creates[] = ['email' => (string)$email, 'name' => self::name($user->name, ''), 'template' => $template, 'id' => $user->id];
+        }
+    }
+
+    /** @param array<string, DirectoryUser> $matched */
+    private function planStates(Settings $settings, State $state, array $matched, SyncPlan $plan): void
+    {
+        foreach ($state->accounts as $username => $account) {
+            $username = (string)$username;
+            $user = $matched[$username] ?? null;
+            if ($user === null && $account->missingSince === null) {
+                $plan->missing[] = $username;
+                continue;
+            }
+            if ($user !== null && $account->missingSince !== null) {
+                $plan->found[] = $username;
+            }
+            if (!$settings->offboarding) {
+                continue;
+            }
+            // Second complete run without the user counts as removed from the IdP
+            $disabled = ($user === null) || !$user->enabled;
+            if ($disabled && !$account->idpDisabled && $account->active === 1) {
+                $plan->deactivate[] = $username;
+            } elseif (!$disabled && $account->idpDisabled) {
+                if ($account->active === 2) {
+                    $plan->restore[] = $username;
+                } else {
+                    $plan->release[] = $username;
+                }
+            }
+        }
+    }
+
+    /**
+     * Name and template of linked mailboxes, like the IdP login does. The planned template is the legacy mapping;
+     * SyncService applies the effective template again after the group changes of the run.
+     *
+     * @param array<string, DirectoryUser> $matched
+     */
+    private function planUpdates(Settings $settings, State $state, array $matched, SyncPlan $plan): void
+    {
+        foreach ($matched as $username => $user) {
+            $account = $state->accounts[$username];
+            $legacy = $settings->mappedTemplate($user->templateValues);
+            $plan->profiles[$username] = ['name' => self::name($user->name, $account->name), 'template' => $legacy];
+            $template = $state->effectiveTemplates[$username] ?? $legacy;
+            if ($template === null) {
+                continue;
+            }
+            if (!isset($state->templateHashes[$template])) {
+                self::conflict($plan, 'Template ' . $template . ' does not exist');
+                continue;
+            }
+            $name = self::name($user->name, $account->name);
+            if ($name !== $account->name || $state->templateHashes[$template] !== $account->attributeHash) {
+                $plan->updates[] = ['username' => (string)$username, 'name' => $name, 'template' => $legacy];
+            }
+        }
+    }
+
+    /** Domain for a new group: the domain of its mail if it is a mailcow domain, else the default group domain */
+    private static function groupDomain(Settings $settings, DirectoryGroup $group, array $domains): ?string
+    {
+        $domain = ($group->mail !== null) ? substr((string)strrchr($group->mail, '@'), 1) : '';
+        if (in_array($domain, $domains, true)) {
+            return $domain;
+        }
+        return in_array($settings->groupDefaultDomain, $domains, true) ? $settings->groupDefaultDomain : null;
+    }
+
+    /** Mailbox name as mailbox_from_template stores it; an empty IdP name keeps the current one */
+    private static function name(string $name, string $current): string
+    {
+        $name = ltrim(rtrim(trim($name), '>'), '<');
+        return ($name === '') ? $current : $name;
+    }
+
+    private static function limit(int $base, int $percent): int
+    {
+        return max(self::GUARD_MIN, (int)ceil($base * $percent / 100));
+    }
+
+    /** @return string[] members of a state group with source idp */
+    private static function idpMembers(array $group): array
+    {
+        return array_map('strval', array_keys(array_filter($group['members'], fn(string $source): bool => $source === 'idp')));
+    }
+
+    private static function sorted(array $usernames): array
+    {
+        $usernames = array_values(array_unique(array_map('strval', $usernames)));
+        sort($usernames);
+        return $usernames;
+    }
+
+    private static function conflict(SyncPlan $plan, string $message): void
+    {
+        if (!in_array($message, $plan->conflicts, true)) {
+            $plan->conflicts[] = $message;
+        }
+    }
+}

data/web/inc/lib/mailcow/Identity/Service/SyncService.php

@@ -0,0 +1,231 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Mailcow\Identity\Service;
+
+use Closure;
+use Mailcow\Core\UserError;
+use Mailcow\Identity\Directory\Directory;
+use Mailcow\Identity\Directory\DirectoryException;
+use Mailcow\Identity\Legacy\LegacyAccounts;
+use Mailcow\Identity\Model\Settings;
+use Mailcow\Identity\Model\State;
+use Mailcow\Identity\Model\SyncPlan;
+use Mailcow\Identity\Repository\IdentityRepository;
+use Mailcow\Identity\Repository\RunRepository;
+use Mailcow\MailboxGroup\Service\IdpSyncService;
+use Mailcow\MailboxGroup\Service\TemplateService;
+use Mailcow\Sogo\Service\SogoService;
+use Throwable;
+
+/**
+ * Sync runs of the IdP (cron only): list the directory, plan, apply. A listing error aborts the run before
+ * anything is written; a blocked or preview run writes nothing but the run summary.
+ * The directory is created only when a run is due, so idle cron calls never connect to the IdP.
+ */
+class SyncService
+{
+    /** A run still `running` after this many minutes crashed */
+    private const STALE_MINUTES = 60;
+    /** Errors kept in the run summary */
+    private const DETAILS = 50;
+
+    public function __construct(
+        private Settings $settings,
+        /** @var Closure(): ?Directory */
+        private Closure $directory,
+        private IdentityRepository $repo,
+        private RunRepository $runs,
+        private SyncPlanner $planner,
+        private IdpSyncService $groups,
+        private TemplateService $templates,
+        private LegacyAccounts $legacy,
+        private SogoService $sogo
+    ) {
+    }
+
+    /**
+     * Runs the oldest requested run, else a scheduled run when the sync interval is over.
+     *
+     * @return ?array the finished run (id, mode, status, summary), null if nothing was due
+     */
+    public function runDue(): ?array
+    {
+        $this->runs->failStale(self::STALE_MINUTES);
+        $run = $this->runs->nextPending();
+        if ($run === null) {
+            if (!$this->settings->syncEnabled()) {
+                return null;
+            }
+            $since = $this->runs->secondsSinceScheduled();
+            if ($since !== null && $since < $this->settings->syncInterval * 60) {
+                return null;
+            }
+            $run = ['id' => $this->runs->create($this->settings->provider, 'run'), 'mode' => 'run'];
+        }
+        return $this->execute((int)$run['id'], (string)$run['mode']);
+    }
+
+    /** @return array{id: int, mode: string, status: string, summary: array} */
+    public function execute(int $id, string $mode): array
+    {
+        $this->runs->start($id);
+        try {
+            $directory = $this->settings->canSync() ? ($this->directory)() : null;
+            if ($directory === null) {
+                throw new DirectoryException('The identity provider cannot be synced');
+            }
+            $listing = $directory->listAll($this->settings->groupSync);
+            $plan = $this->planner->plan($this->settings, $listing, $this->state(), $mode === 'force');
+            $summary = $plan->summary();
+            if ($mode === 'preview') {
+                $status = 'ok';
+            } elseif ($plan->blocked) {
+                $status = 'blocked';
+            } else {
+                [$errors, $updated] = $this->apply($plan);
+                $summary['counts']['updates'] = $updated;
+                $summary['counts']['errors'] = count($errors);
+                $summary['errors'] = array_slice($errors, 0, self::DETAILS);
+                $status = 'ok';
+            }
+        } catch (DirectoryException $e) {
+            $status = 'error';
+            $summary = ['error' => $e->getMessage()];
+        } catch (Throwable $e) {
+            $this->runs->finish($id, 'error', ['error' => 'The sync run failed: ' . $e->getMessage(), 'mode' => $mode]);
+            throw $e;
+        }
+        $summary['mode'] = $mode;
+        $this->runs->finish($id, $status, $summary);
+        return ['id' => $id, 'mode' => $mode, 'status' => $status, 'summary' => $summary];
+    }
+
+    private function state(): State
+    {
+        $accounts = $this->repo->accounts($this->settings->provider);
+        return new State($accounts, $this->repo->mailboxes(), $this->repo->domains(),
+            $this->settings->groupSync ? $this->groups->groups() : [],
+            $this->settings->periodicSync ? $this->templates->effective(array_keys($accounts)) : [],
+            $this->repo->templateHashes());
+    }
+
+    /** @return array{0: string[], 1: int} errors of single changes (the rest is still applied), updated mailboxes */
+    private function apply(SyncPlan $plan): array
+    {
+        $provider = $this->settings->provider;
+        $errors = [];
+        foreach ($plan->links as $username => $externalId) {
+            $this->repo->link((string)$username, $provider, $externalId);
+        }
+        foreach ($plan->found as $username) {
+            $this->repo->setMissing($username, $provider, false);
+        }
+        foreach ($plan->missing as $username) {
+            $this->repo->setMissing($username, $provider, true);
+        }
+        foreach ($plan->creates as $create) {
+            $error = $this->legacy->createMailbox($create['email'], $create['name'], $provider, $create['template']);
+            if ($error !== null) {
+                $errors[] = $create['email'] . ': ' . $error;
+                continue;
+            }
+            $this->repo->link($create['email'], $provider, $create['id']);
+        }
+        foreach ($plan->deactivate as $username) {
+            $this->repo->setActive($username, $provider, 2, true);
+        }
+        foreach ($plan->restore as $username) {
+            $this->repo->setActive($username, $provider, 1, false);
+        }
+        foreach ($plan->release as $username) {
+            $this->repo->setIdpDisabled($username, $provider, false);
+        }
+        $this->sogo->refreshStaticView(array_merge($plan->deactivate, $plan->restore));
+        $changed = [];
+        $errors = array_merge($errors, $this->applyGroups($plan, $changed));
+        [$updateErrors, $updated] = $this->applyUpdates($plan, $changed);
+        return [array_merge($errors, $updateErrors), $updated];
+    }
+
+    /**
+     * @param string[] $changed collects the members that joined or left a group
+     * @return string[]
+     */
+    private function applyGroups(SyncPlan $plan, array &$changed): array
+    {
+        $errors = [];
+        foreach ($plan->groupCreates as $create) {
+            try {
+                foreach ($this->groups->createFromIdp($create['ref'], $create['name'], $create['domain'], $create['mail']) as $warning) {
+                    $errors[] = $create['name'] . ': ' . $warning[0];
+                }
+            } catch (UserError $e) {
+                $errors[] = $create['name'] . ': ' . $e->key;
+            }
+        }
+        foreach ($plan->groupRenames as $id => $name) {
+            try {
+                $this->groups->renameFromIdp((int)$id, $name);
+            } catch (UserError $e) {
+                $errors[] = $name . ': ' . $e->key;
+            }
+        }
+        foreach ($plan->memberships as $ref => $usernames) {
+            $group = $this->groups->findByIdpRef((string)$ref);
+            if ($group !== null) {
+                $this->groupResult($group->name, $this->groups->syncGroupMembers((int)$group->id, $usernames), $errors, $changed);
+            }
+        }
+        foreach ($plan->orphanedGroups as $id) {
+            $this->groupResult((string)$id, $this->groups->syncGroupMembers($id, []), $errors, $changed);
+        }
+        return $errors;
+    }
+
+    /**
+     * Name and template updates after the group changes: planned updates and members that joined or left a group
+     * in this run (e.g. the legacy mapping applies again after leaving a template group). The effective template
+     * is resolved and compared again.
+     *
+     * @return array{0: string[], 1: int} errors, updated mailboxes
+     */
+    private function applyUpdates(SyncPlan $plan, array $changed): array
+    {
+        $candidates = array_values(array_unique(array_merge(array_column($plan->updates, 'username'),
+            array_intersect($changed, array_keys($plan->profiles)))));
+        if (empty($candidates)) {
+            return [[], 0];
+        }
+        $errors = [];
+        $updated = 0;
+        $accounts = $this->repo->accounts($this->settings->provider);
+        $hashes = $this->repo->templateHashes();
+        $effective = $this->templates->effective($candidates);
+        foreach ($candidates as $username) {
+            $profile = $plan->profiles[$username] ?? null;
+            $account = $accounts[$username] ?? null;
+            $template = $effective[$username] ?? $profile['template'] ?? null;
+            if ($profile === null || $account === null || $template === null
+                || ($profile['name'] === $account->name && ($hashes[$template] ?? null) === $account->attributeHash)) {
+                continue;
+            }
+            $error = $this->legacy->applyTemplate($username, $profile['name'], $template);
+            if ($error !== null) {
+                $errors[] = $username . ': ' . $error;
+            } else {
+                $updated++;
+            }
+        }
+        return [$errors, $updated];
+    }
+
+    private function groupResult(string $group, array $result, array &$errors, array &$changed): void
+    {
+        foreach ($result['warnings'] as $warning) {
+            $errors[] = $group . ': ' . $warning[0];
+        }
+        array_push($changed, ...$result['added'], ...$result['removed']);
+    }
+}

data/web/inc/lib/mailcow/Imapsync/Service/SourceService.php

@@ -66,7 +66,7 @@ class SourceService
 
     public function canEdit(Source $source): bool
     {
-        if ($this->context->accessAll || $this->context->isAdmin() || $source->createdBy === $this->context->username) {
+        if ($this->context->hasAdminRights() || $source->createdBy === $this->context->username) {
             return true;
         }
         // A domain admin may manage sources created by mailboxes of his domains

data/web/inc/lib/mailcow/MailboxGroup/Controller/MailboxGroupApiController.php

@@ -0,0 +1,173 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Mailcow\MailboxGroup\Controller;
+
+use Mailcow\Core\AccessDenied;
+use Mailcow\Core\ApiResponse;
+use Mailcow\Core\UserError;
+use Mailcow\MailboxGroup\Model\Group;
+use Mailcow\MailboxGroup\Service\AccountHooks;
+use Mailcow\MailboxGroup\Service\GroupService;
+use Mailcow\MailboxGroup\Service\TemplateService;
+use PDOException;
+
+/**
+ * HTTP API adapter for json_api.php and edit.php (routes `mailbox-group`), plus the hook adapters the legacy
+ * code calls outside a transaction (a database error becomes a `mysql_error` message).
+ * Messages are logged as ['mailbox_group', action, 'group', data].
+ */
+class MailboxGroupApiController
+{
+    public function __construct(private GroupService $groups, private AccountHooks $hooks, private TemplateService $templates,
+        private ApiResponse $response)
+    {
+    }
+
+    /** POST add/mailbox-group */
+    public function addGroup(array $attr): bool
+    {
+        return $this->handle('add', $attr, function (array $log) use ($attr): bool {
+            $group = $this->groups->create($attr);
+            $this->warnings($group->warnings, $log);
+            return $this->response->success(['group_added', htmlspecialchars($group->name)], $log);
+        });
+    }
+
+    /** POST edit/mailbox-group: one message per id */
+    public function editGroups(?array $items, array $attr): bool
+    {
+        $data = array_merge(['id' => $items], $attr);
+        return $this->handle('edit', $data, function (array $log) use ($data, $attr): bool {
+            $this->groups->requireEditor();
+            return $this->batch((array)($data['id'] ?? []), $log, function (int $id) use ($attr, $log): array {
+                $group = $this->groups->update($id, $attr);
+                $this->warnings($group->warnings, $log);
+                return ['group_modified', htmlspecialchars($group->name)];
+            });
+        });
+    }
+
+    /** POST delete/mailbox-group: one message per id */
+    public function deleteGroups(array $items): bool
+    {
+        return $this->handle('delete', ['id' => $items], function (array $log) use ($items): bool {
+            $this->groups->requireEditor();
+            return $this->batch($items, $log, function (int $id) use ($log): array {
+                $group = $this->groups->delete($id);
+                $this->warnings($group->warnings, $log);
+                return ['group_removed', htmlspecialchars($group->name)];
+            });
+        });
+    }
+
+    /** GET mailbox-group/all[/<domain,domain>] */
+    public function getGroups(?string $domains = null): array
+    {
+        $list = array_values(array_filter(array_map('trim', explode(',', (string)$domains)), 'strlen'));
+        return array_values(array_filter(array_map(fn(int $id): array => $this->getGroup($id), $this->groups->visibleIds($list))));
+    }
+
+    /** GET mailbox-group/<id>, also edit.php */
+    public function getGroup(mixed $id): array
+    {
+        $id = $this->toId($id);
+        $group = ($id === null) ? null : $this->groups->get($id);
+        return ($group === null) ? [] : $this->groups->toArray($group);
+    }
+
+    /** GET mailbox-group/member/<username>: groups of a mailbox (mailbox edit page, user page) */
+    public function getMemberships(string $username): array
+    {
+        return $this->groups->membershipsOf($username);
+    }
+
+    public function mailboxDeleted(string $username): void
+    {
+        $this->hook('mailbox_deleted', $username, fn() => $this->hooks->onMailboxDeleted($username));
+    }
+
+    public function domainDeleted(string $domain): void
+    {
+        $this->hook('domain_deleted', $domain, fn() => $this->hooks->onDomainDeleted($domain));
+    }
+
+    public function addressDeleted(string $address): void
+    {
+        $this->hook('address_deleted', $address, fn() => $this->hooks->onAddressDeleted($address));
+    }
+
+    public function addressRenamed(string $old, string $new): void
+    {
+        $this->hook('address_renamed', [$old, $new], fn() => $this->hooks->onAddressRenamed($old, $new));
+    }
+
+    /** A mailbox template was edited: apply it where it is the effective group template */
+    public function templateChanged(int $templateId): void
+    {
+        $this->hook('template_changed', $templateId, function () use ($templateId): void {
+            $this->warnings($this->templates->onTemplateChanged($templateId), ['mailbox_group', 'edit', 'template', $templateId]);
+        });
+    }
+
+    private function warnings(array $warnings, array $log): void
+    {
+        foreach ($warnings as $msg) {
+            $this->response->warning($msg, $log);
+        }
+    }
+
+    /**
+     * Runs one write call: $work gets the log entry and returns the result for process_*_return().
+     * A UserError becomes a danger message, a database error stops the call with one `mysql_error` message.
+     */
+    private function handle(string $action, mixed $data, callable $work): bool
+    {
+        $log = ['mailbox_group', $action, 'group', $data];
+        try {
+            $result = $work($log);
+        } catch (UserError $e) {
+            $result = $this->response->error($e, $log);
+        } catch (PDOException $e) {
+            $result = $this->response->danger(['mysql_error', $e->getMessage()], $log);
+        }
+        $this->response->flush();
+        return $result;
+    }
+
+    private function hook(string $action, mixed $data, callable $work): void
+    {
+        try {
+            $work();
+        } catch (PDOException $e) {
+            $this->response->danger(['mysql_error', $e->getMessage()], ['mailbox_group', $action, 'hook', $data]);
+        }
+        $this->response->flush();
+    }
+
+    /** One message per id: the success message returned by $work(id), or the UserError */
+    private function batch(array $ids, array $log, callable $work): bool
+    {
+        foreach ($ids as $id) {
+            try {
+                $this->response->success($work($this->requireId($id)), $log);
+            } catch (UserError $e) {
+                $this->response->error($e, $log);
+            }
+        }
+        return true;
+    }
+
+    /** Integer id from request input ("12", 12); null for anything else */
+    private function toId(mixed $id): ?int
+    {
+        return (is_numeric($id) && (float)$id == (int)(float)$id) ? (int)(float)$id : null;
+    }
+
+    /** @throws AccessDenied for ids that cannot exist */
+    private function requireId(mixed $id): int
+    {
+        return $this->toId($id) ?? throw new AccessDenied();
+    }
+}

data/web/inc/lib/mailcow/MailboxGroup/Legacy/LegacyMailbox.php

@@ -0,0 +1,59 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Mailcow\MailboxGroup\Legacy;
+
+/**
+ * Bridge to the procedural mailbox code. The global calls sit in protected methods so tests can replace them.
+ */
+class LegacyMailbox
+{
+    /**
+     * Applies a mailbox template like the IdP code does: as system caller, with the current name, so only the
+     * template attributes change.
+     *
+     * @return ?string null on success, else the message key of the legacy error
+     */
+    public function applyTemplate(string $username, string $name, string $template): ?string
+    {
+        return $this->asSystem(fn(): mixed => $this->callTemplate($username, $name, $template));
+    }
+
+    /**
+     * Runs a legacy call as system caller (access_all_exception); the caller's session messages are kept.
+     *
+     * @return ?string null unless the call returned false, else the message key of the legacy error
+     */
+    protected function asSystem(callable $call): ?string
+    {
+        $hasReturn = array_key_exists('return', $_SESSION ?? []);
+        $return = $_SESSION['return'] ?? null;
+        $accessAll = $_SESSION['access_all_exception'] ?? null;
+        $_SESSION['return'] = [];
+        $_SESSION['access_all_exception'] = '1';
+        try {
+            if ($call() !== false) {
+                return null;
+            }
+            foreach ($_SESSION['return'] as $message) {
+                if (($message['type'] ?? '') === 'danger') {
+                    return (string)(is_array($message['msg']) ? $message['msg'][0] : $message['msg']);
+                }
+            }
+            return 'generic_server_error';
+        } finally {
+            if ($hasReturn) {
+                $_SESSION['return'] = $return;
+            } else {
+                unset($_SESSION['return']);
+            }
+            $_SESSION['access_all_exception'] = $accessAll ?? '0';
+        }
+    }
+
+    protected function callTemplate(string $username, string $name, string $template): mixed
+    {
+        return mailbox('edit', 'mailbox_from_template', ['username' => $username, 'name' => $name, 'template' => $template]);
+    }
+}

data/web/inc/lib/mailcow/MailboxGroup/MailboxGroupModule.php

@@ -0,0 +1,62 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Mailcow\MailboxGroup;
+
+use Mailcow\Core\ApiResponse;
+use Mailcow\Core\Context;
+use Mailcow\Dovecot\DovecotModule;
+use Mailcow\MailboxGroup\Controller\MailboxGroupApiController;
+use Mailcow\MailboxGroup\Legacy\LegacyMailbox;
+use Mailcow\MailboxGroup\Repository\GroupRepository;
+use Mailcow\MailboxGroup\Repository\LookupRepository;
+use Mailcow\MailboxGroup\Service\AccountHooks;
+use Mailcow\MailboxGroup\Service\ChangeEffects;
+use Mailcow\MailboxGroup\Service\GroupService;
+use Mailcow\MailboxGroup\Service\IdpSyncService;
+use Mailcow\MailboxGroup\Service\SharingService;
+use Mailcow\MailboxGroup\Service\TemplateService;
+use Mailcow\Sogo\SogoModule;
+use PDO;
+
+/**
+ * Composition root of the mailbox group module.
+ *
+ *   process_add_return(MailboxGroupModule::fromGlobals()->api->addGroup($attr));
+ *   MailboxGroupModule::fromGlobals(Context::system())->templates->templateForLogin($username, $legacyTemplate);
+ *   MailboxGroupModule::create($pdo, Context::system())->sharing->reconcile();  // cron
+ */
+class MailboxGroupModule
+{
+    public function __construct(
+        public readonly GroupService $groups,
+        public readonly TemplateService $templates,
+        public readonly AccountHooks $hooks,
+        public readonly IdpSyncService $idp,
+        public readonly SharingService $sharing,
+        public readonly MailboxGroupApiController $api
+    ) {
+    }
+
+    public static function create(PDO $pdo, Context $context): self
+    {
+        $repo = new GroupRepository($pdo);
+        $lookup = new LookupRepository($pdo);
+        $dovecot = DovecotModule::create()->dovecot;
+        $sogo = SogoModule::create()->sogo;
+        $templates = new TemplateService($lookup, new LegacyMailbox());
+        $effects = new ChangeEffects($templates, $sogo, $repo, $dovecot);
+        $sharing = new SharingService($repo, $dovecot, $sogo, $effects);
+        $groups = new GroupService($repo, $lookup, $templates, $effects, $sharing, $context);
+        $hooks = new AccountHooks($repo, $effects);
+        return new self($groups, $templates, $hooks, new IdpSyncService($repo, $lookup, $effects), $sharing,
+            new MailboxGroupApiController($groups, $hooks, $templates, new ApiResponse()));
+    }
+
+    /** Legacy entry point for procedural callers: reads $pdo and $_SESSION; $context overrides the session caller */
+    public static function fromGlobals(?Context $context = null): self
+    {
+        return self::create($GLOBALS['pdo'], $context ?? Context::fromSession($_SESSION ?? []));
+    }
+}

data/web/inc/lib/mailcow/MailboxGroup/Model/Group.php

@@ -0,0 +1,108 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Mailcow\MailboxGroup\Model;
+
+/**
+ * A mailbox group (table `mailbox_group`) with its members and send-as grants.
+ *
+ * The group tables are the source of truth. GroupRepository::rebuild() derives the rows other services read:
+ * the alias row of the distribution address and the sender_acl rows of the grants, both tagged with `group_id`.
+ * Not to be confused with SOGo resources of kind 'group' (`mailbox.kind`).
+ */
+class Group
+{
+    public const SOURCE_MANUAL = 'manual';
+    public const SOURCE_IDP = 'idp';
+
+    public ?int $id = null;
+    public string $domain = '';
+    public string $name = '';
+    public string $description = '';
+    /** Distribution address, null = group only used for grants and templates */
+    public ?string $address = null;
+    /** Members may send as the address */
+    public int $senderAllowed = 0;
+    public int $sogoVisible = 0;
+    /** Only senders of the domain may write to the address */
+    public int $internal = 0;
+    public ?int $templateId = null;
+    /** Template name, read only */
+    public ?string $template = null;
+    public int $priority = 0;
+    /** IdP group id, set = IdP memberships are synced */
+    public ?string $idpRef = null;
+    public int $active = 1;
+    public ?string $created = null;
+    public ?string $modified = null;
+    /** @var array<string, string> username => source */
+    public array $members = [];
+    /** @var string[] addresses or @domain */
+    public array $sendAs = [];
+    /** @var array[] {owner, rights, subscribe, state, last_error}: members may open these mailboxes (ACL group=mcg_<id>) */
+    public array $imapGrants = [];
+    /** @var array[] {owner, type, folder, access, subscribe, state, last_error}: SOGo folders shared with the members */
+    public array $sogoGrants = [];
+    /** @var array[] warnings of the last write (msg values), not stored */
+    public array $warnings = [];
+
+    /** Builds a group from a `mailbox_group` row (`template_name` optional) */
+    public static function fromRow(array $row): self
+    {
+        $group = new self();
+        $group->id = isset($row['id']) ? (int)$row['id'] : null;
+        $group->domain = (string)($row['domain'] ?? '');
+        $group->name = (string)($row['name'] ?? '');
+        $group->description = (string)($row['description'] ?? '');
+        $group->address = isset($row['address']) ? (string)$row['address'] : null;
+        $group->senderAllowed = (int)($row['sender_allowed'] ?? 0);
+        $group->sogoVisible = (int)($row['sogo_visible'] ?? 0);
+        $group->internal = (int)($row['internal'] ?? 0);
+        $group->templateId = isset($row['template_id']) ? (int)$row['template_id'] : null;
+        $group->template = isset($row['template_name']) ? (string)$row['template_name'] : null;
+        $group->priority = (int)($row['priority'] ?? 0);
+        $group->idpRef = isset($row['idp_ref']) ? (string)$row['idp_ref'] : null;
+        $group->active = (int)($row['active'] ?? 1);
+        $group->created = isset($row['created']) ? (string)$row['created'] : null;
+        $group->modified = isset($row['modified']) ? (string)$row['modified'] : null;
+        return $group;
+    }
+
+    /** @return string[] */
+    public function usernames(): array
+    {
+        return array_keys($this->members);
+    }
+
+    /** API representation (GET mailbox-group) */
+    public function toArray(bool $canEdit): array
+    {
+        $members = [];
+        foreach ($this->members as $username => $source) {
+            $members[] = ['username' => (string)$username, 'source' => $source];
+        }
+        return [
+            'id' => $this->id,
+            'domain' => $this->domain,
+            'name' => $this->name,
+            'description' => $this->description,
+            'address' => $this->address,
+            'sender_allowed' => $this->senderAllowed,
+            'sogo_visible' => $this->sogoVisible,
+            'internal' => $this->internal,
+            'template_id' => $this->templateId,
+            'template' => $this->template,
+            'priority' => $this->priority,
+            'idp_ref' => $this->idpRef,
+            'members' => $members,
+            'send_as' => $this->sendAs,
+            'imap_grants' => $this->imapGrants,
+            'sogo_grants' => $this->sogoGrants,
+            'active' => $this->active,
+            'created' => $this->created,
+            'modified' => $this->modified,
+            'can_edit' => $canEdit,
+        ];
+    }
+}

data/web/inc/lib/mailcow/MailboxGroup/Repository/GroupRepository.php

@@ -0,0 +1,649 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Mailcow\MailboxGroup\Repository;
+
+use Mailcow\Core\Context;
+use Mailcow\Core\Repository;
+use Mailcow\MailboxGroup\Model\Group;
+use PDO;
+
+/**
+ * SQL for `mailbox_group`, its members and send-as grants, and the rows derived from them (rebuild()).
+ * Every write rebuilds the derived rows in the same transaction, so readers never see a half-applied group.
+ */
+class GroupRepository extends Repository
+{
+    /** SOGo roles per folder type and access of a SOGo grant */
+    public const SOGO_ROLES = [
+        'Calendar' => [
+            'read' => ['PublicViewer', 'ConfidentialViewer', 'PrivateDAndTViewer'],
+            'write' => ['PublicModifier', 'ConfidentialModifier', 'PrivateDAndTViewer', 'ObjectCreator', 'ObjectEraser'],
+        ],
+        'Contacts' => [
+            'read' => ['ObjectViewer'],
+            'write' => ['ObjectViewer', 'ObjectCreator', 'ObjectEditor', 'ObjectEraser'],
+        ],
+    ];
+
+    /** Grant table, folder and extra "access gone" condition of the subscriptions per kind */
+    private const SUBSCRIPTION_GRANTS = [
+        'imap' => ['table' => 'mailbox_group_imap_grant', 'folder' => "''", 'gone' => " OR g.`state` = 'removing'", 'valid' => " AND g2.`state` != 'removing'"],
+        'sogo' => ['table' => 'mailbox_group_sogo_grant', 'folder' => "CONCAT(g.`folder_type`, '/', g.`folder`)", 'gone' => '', 'valid' => ''],
+    ];
+
+    /** Side effects of the writes since the last takeEffects(): members whose acl_groups changed, sogo_acl changed */
+    private array $effects = ['members' => [], 'sogo_acl' => false];
+    /** Members removed by writeMembers(), rebuild() decides whether Dovecot needs to know */
+    private array $removedMembers = [];
+
+    public function find(int $id): ?Group
+    {
+        return $this->fetch('1=1', ['id' => $id]);
+    }
+
+    /** Like find(), but only when the group is visible to the caller */
+    public function findVisible(int $id, Context $context): ?Group
+    {
+        [$visible, $params] = $this->visibility($context);
+        return $this->fetch($visible, $params + ['id' => $id]);
+    }
+
+    public function findByIdpRef(string $ref): ?Group
+    {
+        $id = $this->query("SELECT `id` FROM `mailbox_group` WHERE `idp_ref` = :ref", ['ref' => $ref])->fetchColumn();
+        return ($id === false) ? null : $this->find((int)$id);
+    }
+
+    /**
+     * @param string[] $domains limit to these domains, [] = all visible
+     * @return int[] ids of the groups visible to the caller, ordered by domain and name
+     */
+    public function visibleIds(Context $context, array $domains = []): array
+    {
+        [$visible, $params] = $this->visibility($context);
+        $sql = "SELECT g.`id` FROM `mailbox_group` g WHERE $visible";
+        if (!empty($domains)) {
+            $names = [];
+            foreach (array_values($domains) as $i => $domain) {
+                $names[] = ':dom' . $i;
+                $params['dom' . $i] = $domain;
+            }
+            $sql .= " AND g.`domain` IN (" . implode(', ', $names) . ")";
+        }
+        return array_map('intval', $this->query($sql . " ORDER BY g.`domain`, g.`name`", $params)->fetchAll(PDO::FETCH_COLUMN));
+    }
+
+    public function nameExists(string $domain, string $name, ?int $exceptId = null): bool
+    {
+        return (bool)$this->query("SELECT 1 FROM `mailbox_group` WHERE `domain` = :domain AND `name` = :name AND `id` != :id",
+            ['domain' => $domain, 'name' => $name, 'id' => $exceptId ?? 0])->fetchColumn();
+    }
+
+    /** @return string[] usernames whose SOGo identities changed */
+    public function insert(Group $group): array
+    {
+        return $this->transaction(function () use ($group): array {
+            $group->id = $this->insertRow('mailbox_group', $this->values($group));
+            $this->writeMembers($group);
+            $this->writeSendAs($group);
+            $this->writeGrants($group);
+            return $this->rebuild((int)$group->id);
+        });
+    }
+
+    /** @return string[] usernames whose SOGo identities changed */
+    public function update(Group $group): array
+    {
+        return $this->transaction(function () use ($group): array {
+            $this->updateRow('mailbox_group', (int)$group->id, $this->values($group));
+            $this->writeMembers($group);
+            $this->writeSendAs($group);
+            $this->writeGrants($group);
+            return $this->rebuild((int)$group->id);
+        });
+    }
+
+    /**
+     * Deletes the group; members, grants and the derived alias/sender_acl rows go via FK cascade.
+     *
+     * @return string[] usernames whose SOGo identities changed
+     */
+    public function delete(int $id): array
+    {
+        return $this->transaction(function () use ($id): array {
+            $before = $this->aliasState($id);
+            $this->query("DELETE FROM `mailbox_group` WHERE `id` = :id", ['id' => $id]);
+            $this->cleanupSogoAcl();
+            return $before['members'];
+        });
+    }
+
+    /**
+     * Rewrites the rows derived from the group: the alias row of its address (goto = members, inactive while the
+     * group is inactive or empty, so the address bounces but stays reserved) and one sender_acl row per member
+     * and send-as grant, and the sogo_acl rows of its SOGo grants. Idempotent, joins the caller's transaction.
+     * $sogo = false keeps the sogo_acl rows (mailbox rename: sogo-tool rename-user updates them afterwards).
+     *
+     * @return string[] usernames whose SOGo identities changed
+     */
+    public function rebuild(int $id, bool $sogo = true): array
+    {
+        return $this->transaction(function () use ($id, $sogo): array {
+            $group = $this->query("SELECT * FROM `mailbox_group` WHERE `id` = :id FOR UPDATE", ['id' => $id])->fetch(PDO::FETCH_ASSOC);
+            if (!$group) {
+                return [];
+            }
+            $before = $this->aliasState($id);
+            $members = $this->query("SELECT `username` FROM `mailbox_group_member` WHERE `group_id` = :id ORDER BY `username`",
+                ['id' => $id])->fetchAll(PDO::FETCH_COLUMN);
+            $visible = false;
+            if ($group['address'] === null) {
+                $this->query("DELETE FROM `alias` WHERE `group_id` = :id", ['id' => $id]);
+            } else {
+                $values = [
+                    'address' => $group['address'],
+                    'goto' => empty($members) ? 'null@localhost' : implode(',', $members),
+                    'domain' => $group['domain'],
+                    'public_comment' => $group['description'],
+                    'sender_allowed' => (int)$group['sender_allowed'],
+                    // SOGo identities only make sense when the members may send as the address
+                    'sogo_visible' => ($group['sogo_visible'] == 1 && $group['sender_allowed'] == 1) ? 1 : 0,
+                    'internal' => (int)$group['internal'],
+                    'active' => ($group['active'] == 1 && !empty($members)) ? 1 : 0,
+                ];
+                // Never insert by address: an existing foreign row must not be taken over
+                $aliasId = $this->query("SELECT `id` FROM `alias` WHERE `group_id` = :id", ['id' => $id])->fetchColumn();
+                if ($aliasId === false) {
+                    $this->insertRow('alias', $values + ['group_id' => $id]);
+                } else {
+                    $this->updateRow('alias', (int)$aliasId, $values);
+                }
+                $visible = ($values['active'] === 1 && $values['sogo_visible'] === 1);
+            }
+            $this->query("DELETE FROM `sender_acl` WHERE `group_id` = :id", ['id' => $id]);
+            if ($group['active'] == 1) {
+                $this->query("INSERT INTO `sender_acl` (`logged_in_as`, `send_as`, `external`, `group_id`)
+                  SELECT m.`username`, s.`address`, 0, m.`group_id` FROM `mailbox_group_member` m
+                    JOIN `mailbox_group_send_as` s ON s.`group_id` = m.`group_id`
+                  WHERE m.`group_id` = :id AND m.`username` != s.`address`", ['id' => $id]);
+            }
+            if ($sogo) {
+                $this->rebuildSogoAcl($id, $group['active'] == 1, $members);
+            }
+            // Dovecot caches acl_groups (userdb) of the members, incl. the ones that just left
+            if ($this->query("SELECT 1 FROM `mailbox_group_imap_grant` WHERE `group_id` = :id LIMIT 1", ['id' => $id])->fetchColumn()) {
+                $this->effects['members'] = array_merge($this->effects['members'], $members, $this->removedMembers);
+            }
+            $this->removedMembers = [];
+            $after = $visible ? $members : [];
+            // Same visible address: only joined and left members are affected
+            if ($before['members'] !== [] && $visible && $before['address'] === $group['address']) {
+                return array_values(array_merge(array_diff($before['members'], $after), array_diff($after, $before['members'])));
+            }
+            return array_values(array_unique(array_merge($before['members'], $after)));
+        });
+    }
+
+    /**
+     * Every group as the IdP sync plans with it: {id, domain, name, idp_ref, template, priority, active,
+     * members: username => source}
+     *
+     * @return array[]
+     */
+    public function syncState(): array
+    {
+        $members = [];
+        foreach ($this->query("SELECT `group_id`, `username`, `source` FROM `mailbox_group_member`")->fetchAll(PDO::FETCH_ASSOC) as $row) {
+            $members[(int)$row['group_id']][(string)$row['username']] = (string)$row['source'];
+        }
+        $groups = [];
+        foreach ($this->query("SELECT g.`id`, g.`domain`, g.`name`, g.`idp_ref`, t.`template`, g.`priority`, g.`active`
+          FROM `mailbox_group` g LEFT JOIN `templates` t ON t.`id` = g.`template_id` ORDER BY g.`id`")->fetchAll(PDO::FETCH_ASSOC) as $row) {
+            $groups[] = [
+                'id' => (int)$row['id'],
+                'domain' => (string)$row['domain'],
+                'name' => (string)$row['name'],
+                'idp_ref' => isset($row['idp_ref']) ? (string)$row['idp_ref'] : null,
+                'template' => isset($row['template']) ? (string)$row['template'] : null,
+                'priority' => (int)$row['priority'],
+                'active' => (int)$row['active'],
+                'members' => $members[(int)$row['id']] ?? [],
+            ];
+        }
+        return $groups;
+    }
+
+    /** @return int[] groups with this member, a send-as grant on this address or a SOGo grant on this mailbox */
+    public function groupIdsOfAccount(string $address): array
+    {
+        return array_map('intval', $this->query("SELECT `group_id` FROM `mailbox_group_member` WHERE `username` = :a1
+          UNION SELECT `group_id` FROM `mailbox_group_send_as` WHERE `address` = :a2
+          UNION SELECT `group_id` FROM `mailbox_group_sogo_grant` WHERE `owner` = :a3",
+            ['a1' => $address, 'a2' => $address, 'a3' => $address])->fetchAll(PDO::FETCH_COLUMN));
+    }
+
+    /** @return int[] groups with send-as grants on addresses of the domain (incl. @domain) */
+    public function groupIdsWithSendAsIn(string $domain): array
+    {
+        return array_map('intval', $this->query("SELECT DISTINCT `group_id` FROM `mailbox_group_send_as`
+          WHERE SUBSTRING_INDEX(`address`, '@', -1) = :domain", ['domain' => $domain])->fetchAll(PDO::FETCH_COLUMN));
+    }
+
+    /**
+     * A mailbox is deleted: its memberships and the grants on its address go, the groups are rebuilt.
+     *
+     * @param int[] $ids groups of the account (groupIdsOfAccount())
+     * @return string[] usernames whose SOGo identities changed
+     */
+    public function removeAccount(string $username, array $ids): array
+    {
+        return $this->transaction(function () use ($username, $ids): array {
+            $this->query("DELETE FROM `mailbox_group_member` WHERE `username` = :username", ['username' => $username]);
+            $this->query("DELETE FROM `mailbox_group_send_as` WHERE `address` = :username", ['username' => $username]);
+            return $this->rebuildAll($ids);
+        });
+    }
+
+    /** An alias was deleted: grants on its address go */
+    public function removeSendAs(string $address, array $ids): array
+    {
+        return $this->transaction(function () use ($address, $ids): array {
+            $this->query("DELETE FROM `mailbox_group_send_as` WHERE `address` = :address", ['address' => $address]);
+            return $this->rebuildAll($ids);
+        });
+    }
+
+    /** A domain or alias domain is deleted: grants on its addresses go */
+    public function removeSendAsIn(string $domain, array $ids): array
+    {
+        return $this->transaction(function () use ($domain, $ids): array {
+            $this->query("DELETE FROM `mailbox_group_send_as` WHERE SUBSTRING_INDEX(`address`, '@', -1) = :domain", ['domain' => $domain]);
+            return $this->rebuildAll($ids);
+        });
+    }
+
+    /**
+     * Account or alias address renamed: members and grants follow. Explicit updates, because the mailbox rename
+     * runs with FOREIGN_KEY_CHECKS = 0; joins the caller's transaction.
+     */
+    public function renameAccount(string $old, string $new, array $ids): array
+    {
+        return $this->transaction(function () use ($old, $new, $ids): array {
+            $this->query("UPDATE `mailbox_group_member` SET `username` = :new WHERE `username` = :old", ['new' => $new, 'old' => $old]);
+            $this->query("UPDATE `mailbox_group_send_as` SET `address` = :new WHERE `address` = :old", ['new' => $new, 'old' => $old]);
+            return $this->rebuildAll($ids, false);
+        });
+    }
+
+    /** @return int[] groups with SOGo grants */
+    public function groupIdsWithSogoGrants(): array
+    {
+        return array_map('intval', $this->query("SELECT DISTINCT `group_id` FROM `mailbox_group_sogo_grant`")->fetchAll(PDO::FETCH_COLUMN));
+    }
+
+    /**
+     * IMAP grants Dovecot has to apply: pending, failed and removing ones, with $all also applied ones (new
+     * top-level folders); of one group or all.
+     *
+     * @return array[] rows of mailbox_group_imap_grant
+     */
+    public function imapGrantsToApply(?int $groupId, bool $all): array
+    {
+        $where = $all ? '1=1' : "`state` != 'applied'";
+        $params = [];
+        if ($groupId !== null) {
+            $where .= " AND `group_id` = :id";
+            $params['id'] = $groupId;
+        }
+        return $this->query("SELECT * FROM `mailbox_group_imap_grant` WHERE $where ORDER BY `id`", $params)->fetchAll(PDO::FETCH_ASSOC);
+    }
+
+    public function setImapState(int $grantId, string $state, ?string $error): void
+    {
+        $this->query("UPDATE `mailbox_group_imap_grant` SET `state` = :state, `last_error` = :error WHERE `id` = :id",
+            ['state' => $state, 'error' => $error, 'id' => $grantId]);
+    }
+
+    public function deleteImapGrant(int $grantId): void
+    {
+        $this->query("DELETE FROM `mailbox_group_imap_grant` WHERE `id` = :id", ['id' => $grantId]);
+    }
+
+    /**
+     * Deletes the sogo_acl rows of grants that are gone, e.g. by FK cascades of groups, owners and domains.
+     * Joins the caller's transaction.
+     */
+    public function cleanupSogoAcl(): void
+    {
+        $this->transaction(function (): void {
+            $orphans = $this->query("SELECT l.`acl_id` FROM `mailbox_group_sogo_acl` l
+                LEFT JOIN `mailbox_group_sogo_grant` g ON g.`id` = l.`grant_id`
+              WHERE g.`id` IS NULL")->fetchAll(PDO::FETCH_COLUMN);
+            foreach ($orphans as $aclId) {
+                $this->deleteSogoAcl((int)$aclId);
+            }
+        });
+    }
+
+    /**
+     * Members to subscribe to grants with `subscribe` (kind imap or sogo): applied grants of active groups, members
+     * without a subscription by mailcow yet (a member that removes it keeps it removed).
+     *
+     * @return array[] {grant_id, owner, folder, usernames}
+     */
+    public function missingSubscriptions(string $kind): array
+    {
+        $config = self::SUBSCRIPTION_GRANTS[$kind];
+        $grants = [];
+        foreach ($this->query("SELECT g.`id`, g.`owner`, {$config['folder']} AS `folder`, m.`username`
+            FROM `{$config['table']}` g
+              JOIN `mailbox_group` mg ON mg.`id` = g.`group_id` AND mg.`active` = 1
+              JOIN `mailbox_group_member` m ON m.`group_id` = g.`group_id` AND m.`username` != g.`owner`
+              LEFT JOIN `mailbox_group_subscription` s ON s.`kind` = :kind AND s.`grant_id` = g.`id` AND s.`username` = m.`username`
+            WHERE g.`subscribe` = 1 AND g.`state` = 'applied' AND s.`id` IS NULL
+            ORDER BY g.`id`, m.`username`", ['kind' => $kind])->fetchAll(PDO::FETCH_ASSOC) as $row) {
+            $grants[$row['id']] ??= ['grant_id' => (int)$row['id'], 'owner' => (string)$row['owner'], 'folder' => (string)$row['folder'], 'usernames' => []];
+            $grants[$row['id']]['usernames'][] = (string)$row['username'];
+        }
+        return array_values($grants);
+    }
+
+    /**
+     * Subscriptions by mailcow whose member lost the access: grant, membership or group gone or inactive.
+     * `covered`: another group still grants the member the same folder, so the subscription stays.
+     *
+     * @return array[] rows of mailbox_group_subscription with member_exists, owner_exists, covered
+     */
+    public function staleSubscriptions(string $kind): array
+    {
+        $config = self::SUBSCRIPTION_GRANTS[$kind];
+        return $this->query("SELECT s.`id`, s.`username`, s.`owner`, s.`folder`,
+            EXISTS(SELECT 1 FROM `mailbox` WHERE `username` = s.`username`) AS `member_exists`,
+            EXISTS(SELECT 1 FROM `mailbox` WHERE `username` = s.`owner`) AS `owner_exists`,
+            EXISTS(SELECT 1 FROM `mailbox_group_subscription` s2
+                JOIN `{$config['table']}` g2 ON g2.`id` = s2.`grant_id`{$config['valid']}
+                JOIN `mailbox_group` mg2 ON mg2.`id` = g2.`group_id` AND mg2.`active` = 1
+                JOIN `mailbox_group_member` m2 ON m2.`group_id` = g2.`group_id` AND m2.`username` = s2.`username`
+              WHERE s2.`kind` = s.`kind` AND s2.`id` != s.`id` AND s2.`username` = s.`username` AND s2.`owner` = s.`owner`
+                AND s2.`folder` = s.`folder`) AS `covered`
+          FROM `mailbox_group_subscription` s
+            LEFT JOIN `{$config['table']}` g ON g.`id` = s.`grant_id`
+            LEFT JOIN `mailbox_group` mg ON mg.`id` = g.`group_id` AND mg.`active` = 1
+            LEFT JOIN `mailbox_group_member` m ON m.`group_id` = g.`group_id` AND m.`username` = s.`username`
+          WHERE s.`kind` = :kind AND (g.`id` IS NULL OR mg.`id` IS NULL OR m.`username` IS NULL{$config['gone']})
+          ORDER BY s.`id`", ['kind' => $kind])->fetchAll(PDO::FETCH_ASSOC);
+    }
+
+    public function addSubscriptions(string $kind, int $grantId, string $owner, string $folder, array $usernames): void
+    {
+        foreach ($usernames as $username) {
+            $this->query("INSERT IGNORE INTO `mailbox_group_subscription` (`kind`, `grant_id`, `username`, `owner`, `folder`)
+              VALUES (:kind, :grant, :username, :owner, :folder)",
+                ['kind' => $kind, 'grant' => $grantId, 'username' => $username, 'owner' => $owner, 'folder' => $folder]);
+        }
+    }
+
+    public function deleteSubscription(int $id): void
+    {
+        $this->query("DELETE FROM `mailbox_group_subscription` WHERE `id` = :id", ['id' => $id]);
+    }
+
+    /**
+     * Owners of pending SOGo grants on their personal folder that SOGo knows (active mailboxes), of one group or all.
+     * Their folders do not exist because they never logged in to SOGo, e.g. shared mailboxes.
+     *
+     * @return string[]
+     */
+    public function pendingSogoOwners(?int $groupId): array
+    {
+        $params = [];
+        $where = '';
+        if ($groupId !== null) {
+            $where = " AND g.`group_id` = :id";
+            $params['id'] = $groupId;
+        }
+        return $this->query("SELECT DISTINCT g.`owner` FROM `mailbox_group_sogo_grant` g
+            JOIN `mailbox` mb ON mb.`username` = g.`owner` AND mb.`active` = '1' AND mb.`kind` = ''
+          WHERE g.`state` = 'pending' AND g.`folder` = 'personal'$where ORDER BY g.`owner`", $params)->fetchAll(PDO::FETCH_COLUMN);
+    }
+
+    /**
+     * Side effects of the writes since the last call, for ChangeEffects after the commit.
+     *
+     * @return array{members: string[], sogo_acl: bool}
+     */
+    public function takeEffects(): array
+    {
+        $effects = $this->effects;
+        $effects['members'] = array_values(array_unique($effects['members']));
+        $this->effects = ['members' => [], 'sogo_acl' => false];
+        return $effects;
+    }
+
+    /** @return string[] */
+    private function rebuildAll(array $ids, bool $sogo = true): array
+    {
+        $users = [];
+        foreach (array_unique($ids) as $id) {
+            $users = array_merge($users, $this->rebuild((int)$id, $sogo));
+        }
+        return array_values(array_unique($users));
+    }
+
+    /**
+     * sogo_acl rows of the group's SOGo grants: one row per member (except the owner) and role while the group is
+     * active. Only rows of the ledger are ever deleted, so shares made in SOGo stay. A grant on a folder that does
+     * not exist yet (the owner never opened SOGo) stays pending.
+     */
+    private function rebuildSogoAcl(int $id, bool $active, array $members): void
+    {
+        $this->cleanupSogoAcl();
+        foreach ($this->query("SELECT * FROM `mailbox_group_sogo_grant` WHERE `group_id` = :id", ['id' => $id])->fetchAll(PDO::FETCH_ASSOC) as $grant) {
+            $object = '/' . $grant['owner'] . '/' . $grant['folder_type'] . '/' . $grant['folder'];
+            $folderId = $this->query("SELECT `c_folder_id` FROM `sogo_folder_info` WHERE `c_path` = :path",
+                ['path' => '/Users' . $object])->fetchColumn();
+            $wanted = [];
+            if ($folderId !== false && $active) {
+                foreach ($members as $username) {
+                    foreach (($username === $grant['owner']) ? [] : self::SOGO_ROLES[$grant['folder_type']][$grant['access']] as $role) {
+                        $wanted[$username . '|' . $role] = [$username, $role];
+                    }
+                }
+            }
+            $rows = $this->query("SELECT l.`acl_id`, l.`c_uid`, l.`c_role`, a.`c_folder_id`, a.`c_object` FROM `mailbox_group_sogo_acl` l
+                LEFT JOIN `sogo_acl` a ON a.`id` = l.`acl_id`
+              WHERE l.`grant_id` = :id", ['id' => $grant['id']])->fetchAll(PDO::FETCH_ASSOC);
+            foreach ($rows as $row) {
+                $key = $row['c_uid'] . '|' . $row['c_role'];
+                if (isset($wanted[$key]) && (string)$row['c_folder_id'] === (string)$folderId && $row['c_object'] === $object) {
+                    unset($wanted[$key]);
+                    continue;
+                }
+                $this->deleteSogoAcl((int)$row['acl_id']);
+            }
+            foreach ($wanted as [$username, $role]) {
+                $aclId = $this->insertRow('sogo_acl', ['c_folder_id' => $folderId, 'c_object' => $object, 'c_uid' => $username, 'c_role' => $role]);
+                $this->query("INSERT INTO `mailbox_group_sogo_acl` (`acl_id`, `grant_id`, `c_uid`, `c_role`) VALUES (:acl, :grant, :uid, :role)",
+                    ['acl' => $aclId, 'grant' => $grant['id'], 'uid' => $username, 'role' => $role]);
+                $this->effects['sogo_acl'] = true;
+            }
+            $state = ($folderId === false) ? 'pending' : 'applied';
+            if ($grant['state'] !== $state) {
+                $this->query("UPDATE `mailbox_group_sogo_grant` SET `state` = :state, `last_error` = :error WHERE `id` = :id",
+                    ['state' => $state, 'error' => ($folderId === false) ? 'folder_missing' : null, 'id' => $grant['id']]);
+            }
+        }
+    }
+
+    private function deleteSogoAcl(int $aclId): void
+    {
+        $this->query("DELETE FROM `sogo_acl` WHERE `id` = :id", ['id' => $aclId]);
+        $this->query("DELETE FROM `mailbox_group_sogo_acl` WHERE `acl_id` = :id", ['id' => $aclId]);
+        $this->effects['sogo_acl'] = true;
+    }
+
+    private function fetch(string $where, array $params): ?Group
+    {
+        $row = $this->query("SELECT g.*, t.`template` AS `template_name` FROM `mailbox_group` g
+          LEFT JOIN `templates` t ON t.`id` = g.`template_id`
+          WHERE g.`id` = :id AND $where", $params)->fetch(PDO::FETCH_ASSOC);
+        if (!$row) {
+            return null;
+        }
+        $group = Group::fromRow($row);
+        $id = ['id' => $group->id];
+        $group->members = $this->query("SELECT `username`, `source` FROM `mailbox_group_member` WHERE `group_id` = :id ORDER BY `username`",
+            $id)->fetchAll(PDO::FETCH_KEY_PAIR);
+        $group->sendAs = $this->query("SELECT `address` FROM `mailbox_group_send_as` WHERE `group_id` = :id ORDER BY `address`",
+            $id)->fetchAll(PDO::FETCH_COLUMN);
+        $group->imapGrants = array_map(fn(array $grant): array => array_merge($grant, ['subscribe' => (int)$grant['subscribe']]),
+            $this->query("SELECT `owner`, `rights`, `subscribe`, `state`, `last_error` FROM `mailbox_group_imap_grant`
+              WHERE `group_id` = :id AND `state` != 'removing' ORDER BY `owner`", $id)->fetchAll(PDO::FETCH_ASSOC));
+        $group->sogoGrants = array_map(fn(array $grant): array => array_merge($grant, ['subscribe' => (int)$grant['subscribe']]),
+            $this->query("SELECT `owner`, `folder_type` AS `type`, `folder`, `access`, `subscribe`, `state`, `last_error`
+              FROM `mailbox_group_sogo_grant` WHERE `group_id` = :id ORDER BY `owner`, `folder_type`, `folder`", $id)->fetchAll(PDO::FETCH_ASSOC));
+        return $group;
+    }
+
+    /** Members (username => source) as in the model; changed sources are updated, created stays */
+    private function writeMembers(Group $group): void
+    {
+        $id = (int)$group->id;
+        $stored = $this->query("SELECT `username`, `source` FROM `mailbox_group_member` WHERE `group_id` = :id", ['id' => $id])
+            ->fetchAll(PDO::FETCH_KEY_PAIR);
+        foreach (array_diff_key($stored, $group->members) as $username => $source) {
+            $this->query("DELETE FROM `mailbox_group_member` WHERE `group_id` = :id AND `username` = :username",
+                ['id' => $id, 'username' => $username]);
+            $this->removedMembers[] = (string)$username;
+        }
+        foreach ($group->members as $username => $source) {
+            if (!isset($stored[$username])) {
+                $this->query("INSERT INTO `mailbox_group_member` (`group_id`, `username`, `source`) VALUES (:id, :username, :source)",
+                    ['id' => $id, 'username' => $username, 'source' => $source]);
+            } elseif ($stored[$username] !== $source) {
+                $this->query("UPDATE `mailbox_group_member` SET `source` = :source WHERE `group_id` = :id AND `username` = :username",
+                    ['source' => $source, 'id' => $id, 'username' => $username]);
+            }
+        }
+    }
+
+    /**
+     * IMAP grants: new ones are pending, removed ones are set to removing until Dovecot dropped the ACL
+     * (SharingService). SOGo grants are replaced; rebuild() maintains their sogo_acl rows.
+     */
+    private function writeGrants(Group $group): void
+    {
+        $id = (int)$group->id;
+        $stored = [];
+        foreach ($this->query("SELECT `id`, `owner`, `rights`, `subscribe`, `state` FROM `mailbox_group_imap_grant` WHERE `group_id` = :id",
+            ['id' => $id])->fetchAll(PDO::FETCH_ASSOC) as $row) {
+            $stored[(string)$row['owner']] = $row;
+        }
+        $wanted = [];
+        foreach ($group->imapGrants as $grant) {
+            $wanted[(string)$grant['owner']] = $grant;
+        }
+        foreach ($stored as $owner => $row) {
+            if (!isset($wanted[$owner]) && $row['state'] !== 'removing') {
+                $this->setImapState((int)$row['id'], 'removing', null);
+            }
+        }
+        foreach ($wanted as $owner => $grant) {
+            $row = $stored[$owner] ?? null;
+            $subscribe = (int)($grant['subscribe'] ?? 0);
+            if ($row === null) {
+                $this->insertRow('mailbox_group_imap_grant', ['group_id' => $id, 'owner' => $owner, 'rights' => $grant['rights'],
+                    'subscribe' => $subscribe, 'state' => 'pending']);
+                continue;
+            }
+            if ($row['rights'] !== $grant['rights'] || $row['state'] === 'removing') {
+                $this->query("UPDATE `mailbox_group_imap_grant` SET `rights` = :rights, `state` = 'pending', `last_error` = NULL WHERE `id` = :id",
+                    ['rights' => $grant['rights'], 'id' => $row['id']]);
+            }
+            if ((int)$row['subscribe'] !== $subscribe) {
+                $this->query("UPDATE `mailbox_group_imap_grant` SET `subscribe` = :subscribe WHERE `id` = :id",
+                    ['subscribe' => $subscribe, 'id' => $row['id']]);
+            }
+        }
+        $stored = [];
+        foreach ($this->query("SELECT `id`, `owner`, `folder_type`, `folder`, `access`, `subscribe` FROM `mailbox_group_sogo_grant` WHERE `group_id` = :id",
+            ['id' => $id])->fetchAll(PDO::FETCH_ASSOC) as $row) {
+            $stored[$row['owner'] . '|' . $row['folder_type'] . '|' . $row['folder']] = $row;
+        }
+        $wanted = [];
+        foreach ($group->sogoGrants as $grant) {
+            $wanted[$grant['owner'] . '|' . $grant['type'] . '|' . $grant['folder']] = $grant;
+        }
+        foreach (array_diff_key($stored, $wanted) as $row) {
+            $this->query("DELETE FROM `mailbox_group_sogo_grant` WHERE `id` = :id", ['id' => $row['id']]);
+        }
+        foreach ($wanted as $key => $grant) {
+            $subscribe = (int)($grant['subscribe'] ?? 0);
+            if (!isset($stored[$key])) {
+                $this->insertRow('mailbox_group_sogo_grant', ['group_id' => $id, 'owner' => $grant['owner'], 'folder_type' => $grant['type'],
+                    'folder' => $grant['folder'], 'access' => $grant['access'], 'subscribe' => $subscribe, 'state' => 'pending']);
+            } elseif ($stored[$key]['access'] !== $grant['access'] || (int)$stored[$key]['subscribe'] !== $subscribe) {
+                $this->query("UPDATE `mailbox_group_sogo_grant` SET `access` = :access, `subscribe` = :subscribe WHERE `id` = :id",
+                    ['access' => $grant['access'], 'subscribe' => $subscribe, 'id' => $stored[$key]['id']]);
+            }
+        }
+    }
+
+    private function writeSendAs(Group $group): void
+    {
+        $id = ['id' => $group->id];
+        $this->query("DELETE FROM `mailbox_group_send_as` WHERE `group_id` = :id", $id);
+        foreach ($group->sendAs as $address) {
+            $this->query("INSERT INTO `mailbox_group_send_as` (`group_id`, `address`) VALUES (:id, :address)", $id + ['address' => $address]);
+        }
+    }
+
+    /**
+     * The group's alias row as SOGo sees it: visible = active and sogo_visible (see the grouped_mail_aliases view).
+     *
+     * @return array{address: ?string, members: string[]} members only when visible
+     */
+    private function aliasState(int $id): array
+    {
+        $row = $this->query("SELECT `address`, `goto`, `active`, `sogo_visible` FROM `alias` WHERE `group_id` = :id",
+            ['id' => $id])->fetch(PDO::FETCH_ASSOC);
+        $visible = $row && $row['active'] == 1 && $row['sogo_visible'] == 1;
+        return ['address' => $row['address'] ?? null, 'members' => $visible ? explode(',', (string)$row['goto']) : []];
+    }
+
+    /**
+     * WHERE fragment over `mailbox_group g` that limits rows to what the caller may see, and its parameters.
+     *
+     * @return array{0: string, 1: array}
+     */
+    private function visibility(Context $context): array
+    {
+        if ($context->hasAdminRights()) {
+            return ['1=1', []];
+        }
+        if ($context->isDomainAdmin()) {
+            return ["g.`domain` IN (SELECT `domain` FROM `domain_admins` WHERE `active` = '1' AND `username` = :vis_da)",
+                ['vis_da' => $context->username]];
+        }
+        return ['0=1', []];
+    }
+
+    private function values(Group $group): array
+    {
+        return [
+            'domain' => $group->domain,
+            'name' => $group->name,
+            'description' => $group->description,
+            'address' => $group->address,
+            'sender_allowed' => $group->senderAllowed,
+            'sogo_visible' => $group->sogoVisible,
+            'internal' => $group->internal,
+            'template_id' => $group->templateId,
+            'priority' => $group->priority,
+            'idp_ref' => $group->idpRef,
+            'active' => $group->active,
+        ];
+    }
+}

data/web/inc/lib/mailcow/MailboxGroup/Repository/LookupRepository.php

@@ -0,0 +1,148 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Mailcow\MailboxGroup\Repository;
+
+use Mailcow\Core\Repository;
+use PDO;
+
+/**
+ * Read-only queries on tables of the legacy code (domains, mailboxes, aliases, templates) and the group
+ * memberships the template logic needs.
+ */
+class LookupRepository extends Repository
+{
+    /** A primary domain (groups never belong to alias domains) */
+    public function isDomain(string $domain): bool
+    {
+        return (bool)$this->query("SELECT 1 FROM `domain` WHERE `domain` = :domain", ['domain' => $domain])->fetchColumn();
+    }
+
+    public function isDomainOrAliasDomain(string $domain): bool
+    {
+        return (bool)$this->query("SELECT 1 FROM `domain` WHERE `domain` = :d1 UNION SELECT 1 FROM `alias_domain` WHERE `alias_domain` = :d2",
+            ['d1' => $domain, 'd2' => $domain])->fetchColumn();
+    }
+
+    /** An alias or mailbox address (mailboxes have an alias row of their own) */
+    public function aliasExists(string $address): bool
+    {
+        return (bool)$this->query("SELECT 1 FROM `alias` WHERE `address` = :address", ['address' => $address])->fetchColumn();
+    }
+
+    /** Used by an alias other than the group's own row, by a mailbox or resource, or as spam alias */
+    public function addressTaken(string $address, ?int $groupId): bool
+    {
+        return (bool)$this->query("SELECT 1 FROM `alias` WHERE `address` = :a1 AND (`group_id` IS NULL OR `group_id` != :id)
+          UNION SELECT 1 FROM `mailbox` WHERE `username` = :a2
+          UNION SELECT 1 FROM `spamalias` WHERE `address` = :a3",
+            ['a1' => $address, 'id' => $groupId ?? 0, 'a2' => $address, 'a3' => $address])->fetchColumn();
+    }
+
+    /** Aliases the domain may still create (same count as mailbox('get', 'domain_details')) */
+    public function aliasesLeft(string $domain): int
+    {
+        $max = $this->query("SELECT `aliases` FROM `domain` WHERE `domain` = :domain", ['domain' => $domain])->fetchColumn();
+        $used = $this->query("SELECT COUNT(`address`) FROM `alias`
+          WHERE (`domain` = :d1 OR `domain` IN (SELECT `alias_domain` FROM `alias_domain` WHERE `target_domain` = :d2))
+            AND `address` NOT IN (SELECT `username` FROM `mailbox`)", ['d1' => $domain, 'd2' => $domain])->fetchColumn();
+        return (int)$max - (int)$used;
+    }
+
+    /**
+     * @param string[] $usernames
+     * @return string[] the given usernames that are regular mailboxes (no resources)
+     */
+    public function regularMailboxes(array $usernames): array
+    {
+        if (empty($usernames)) {
+            return [];
+        }
+        [$in, $params] = self::in('u', $usernames);
+        return $this->query("SELECT `username` FROM `mailbox` WHERE `kind` = '' AND `username` IN ($in)", $params)->fetchAll(PDO::FETCH_COLUMN);
+    }
+
+    /** Name of a mailbox template, null if there is none with this id */
+    public function templateName(int $id): ?string
+    {
+        $name = $this->query("SELECT `template` FROM `templates` WHERE `id` = :id AND `type` = 'mailbox'", ['id' => $id])->fetchColumn();
+        return ($name === false) ? null : (string)$name;
+    }
+
+    /** @return array<string, string> username => full name */
+    public function mailboxNames(array $usernames): array
+    {
+        if (empty($usernames)) {
+            return [];
+        }
+        [$in, $params] = self::in('u', $usernames);
+        return $this->query("SELECT `username`, `name` FROM `mailbox` WHERE `username` IN ($in)", $params)->fetchAll(PDO::FETCH_KEY_PAIR);
+    }
+
+    /**
+     * Template of the active group with the highest priority (lowest id on ties) per member.
+     *
+     * @return array<string, ?string> username => template name, null without group template
+     */
+    public function effectiveTemplates(array $usernames): array
+    {
+        $result = array_fill_keys(array_map('strval', $usernames), null);
+        if (empty($usernames)) {
+            return $result;
+        }
+        [$in, $params] = self::in('u', $usernames);
+        $rows = $this->query("SELECT m.`username`, t.`template` FROM `mailbox_group_member` m
+          JOIN `mailbox_group` g ON g.`id` = m.`group_id` AND g.`active` = '1'
+          JOIN `templates` t ON t.`id` = g.`template_id` AND t.`type` = 'mailbox'
+          WHERE m.`username` IN ($in)
+          ORDER BY m.`username`, g.`priority` DESC, g.`id`", $params)->fetchAll(PDO::FETCH_ASSOC);
+        foreach ($rows as $row) {
+            $result[$row['username']] ??= $row['template'];
+        }
+        return $result;
+    }
+
+    /** @return string[] members of active groups bound to the template */
+    public function membersWithTemplate(int $templateId): array
+    {
+        return $this->query("SELECT DISTINCT m.`username` FROM `mailbox_group_member` m
+          JOIN `mailbox_group` g ON g.`id` = m.`group_id` AND g.`active` = '1'
+          WHERE g.`template_id` = :id", ['id' => $templateId])->fetchAll(PDO::FETCH_COLUMN);
+    }
+
+    /** Groups of a mailbox with its membership source */
+    public function membershipsOf(string $username): array
+    {
+        return $this->query("SELECT g.`id`, g.`domain`, g.`name`, g.`address`, g.`sender_allowed`, g.`active`, g.`priority`,
+            t.`template`, m.`source` FROM `mailbox_group_member` m
+          JOIN `mailbox_group` g ON g.`id` = m.`group_id`
+          LEFT JOIN `templates` t ON t.`id` = g.`template_id`
+          WHERE m.`username` = :username ORDER BY g.`domain`, g.`name`", ['username' => $username])->fetchAll(PDO::FETCH_ASSOC);
+    }
+
+    /** @return string[] addresses a mailbox may send as through its active groups */
+    public function sendAsOf(string $username): array
+    {
+        return $this->query("SELECT `send_as` FROM `sender_acl` WHERE `logged_in_as` = :u1 AND `group_id` IS NOT NULL
+          UNION SELECT g.`address` FROM `mailbox_group_member` m JOIN `mailbox_group` g ON g.`id` = m.`group_id`
+          WHERE m.`username` = :u2 AND g.`active` = '1' AND g.`sender_allowed` = '1' AND g.`address` IS NOT NULL
+          ORDER BY 1", ['u1' => $username, 'u2' => $username])->fetchAll(PDO::FETCH_COLUMN);
+    }
+
+    /**
+     * IN list with one placeholder per value (native prepares allow a placeholder only once).
+     *
+     * @return array{0: string, 1: array}
+     */
+    private static function in(string $prefix, array $values): array
+    {
+        $names = [];
+        $params = [];
+        foreach (array_values($values) as $i => $value) {
+            $names[] = ':' . $prefix . $i;
+            $params[$prefix . $i] = (string)$value;
+        }
+        return [implode(', ', $names), $params];
+    }
+}

data/web/inc/lib/mailcow/MailboxGroup/Service/AccountHooks.php

@@ -0,0 +1,70 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Mailcow\MailboxGroup\Service;
+
+use Mailcow\MailboxGroup\Repository\GroupRepository;
+
+/**
+ * Keeps groups consistent with account changes made by the legacy code (functions.mailbox.inc.php).
+ * No permission checks: the legacy caller already checked them.
+ */
+class AccountHooks
+{
+    public function __construct(private GroupRepository $repo, private ChangeEffects $effects)
+    {
+    }
+
+    /** Before a mailbox is deleted: its memberships and the grants on its address go */
+    public function onMailboxDeleted(string $username): void
+    {
+        $ids = $this->repo->groupIdsOfAccount($username);
+        if (!empty($ids)) {
+            // The deleted mailbox itself needs no SOGo refresh
+            $this->effects->apply(array_diff($this->repo->removeAccount($username, $ids), [$username]), []);
+        }
+    }
+
+    /**
+     * Inside the legacy mailbox rename transaction (FOREIGN_KEY_CHECKS = 0): members and grants follow.
+     * Must not catch, so the caller can roll back. The legacy rename refreshes SOGo itself.
+     */
+    public function onMailboxRenamed(string $old, string $new): void
+    {
+        $ids = $this->repo->groupIdsOfAccount($old);
+        if (!empty($ids)) {
+            $this->repo->renameAccount($old, $new, $ids);
+        }
+    }
+
+    /**
+     * After a domain or alias domain was deleted: grants on its addresses go. Its groups went via FK cascade,
+     * the sogo_acl rows of their SOGo grants go here.
+     */
+    public function onDomainDeleted(string $domain): void
+    {
+        $ids = $this->repo->groupIdsWithSendAsIn($domain);
+        $users = empty($ids) ? [] : $this->repo->removeSendAsIn($domain, $ids);
+        $this->repo->cleanupSogoAcl();
+        $this->effects->apply($users, []);
+    }
+
+    /** An alias was deleted: grants on its address go */
+    public function onAddressDeleted(string $address): void
+    {
+        $ids = $this->repo->groupIdsOfAccount($address);
+        if (!empty($ids)) {
+            $this->effects->apply($this->repo->removeSendAs($address, $ids), []);
+        }
+    }
+
+    /** An alias address changed: grants follow */
+    public function onAddressRenamed(string $old, string $new): void
+    {
+        $ids = $this->repo->groupIdsOfAccount($old);
+        if (!empty($ids) && $old !== $new) {
+            $this->effects->apply($this->repo->renameAccount($old, $new, $ids), []);
+        }
+    }
+}

data/web/inc/lib/mailcow/MailboxGroup/Service/ChangeEffects.php

@@ -0,0 +1,40 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Mailcow\MailboxGroup\Service;
+
+use Mailcow\Dovecot\Service\DovecotService;
+use Mailcow\MailboxGroup\Repository\GroupRepository;
+use Mailcow\Sogo\Service\SogoService;
+
+/**
+ * What follows a committed group write: SOGo identities of the affected members, group templates and the caches
+ * of SOGo (ACLs) and Dovecot (acl_groups). Runs after the commit; failures become warnings and never roll the
+ * write back.
+ */
+class ChangeEffects
+{
+    public function __construct(private TemplateService $templates, private SogoService $sogo, private GroupRepository $repo,
+        private DovecotService $dovecot)
+    {
+    }
+
+    /** Effective templates of the mailboxes a write may touch, taken before the write */
+    public function snapshot(array $usernames): array
+    {
+        return $this->templates->effective($usernames);
+    }
+
+    /** @return array[] warnings (msg values) */
+    public function apply(array $sogoUsers, array $snapshot): array
+    {
+        $this->sogo->refreshStaticView($sogoUsers);
+        $effects = $this->repo->takeEffects();
+        if ($effects['sogo_acl']) {
+            $this->sogo->flushCache();
+        }
+        $this->dovecot->flushAuthCache($effects['members']);
+        return $this->templates->applyChanged($snapshot);
+    }
+}

data/web/inc/lib/mailcow/MailboxGroup/Service/GroupService.php

@@ -0,0 +1,485 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Mailcow\MailboxGroup\Service;
+
+use Mailcow\Core\AccessDenied;
+use Mailcow\Core\Context;
+use Mailcow\Core\Input;
+use Mailcow\Core\UserError;
+use Mailcow\MailboxGroup\Model\Group;
+use Mailcow\MailboxGroup\Repository\GroupRepository;
+use Mailcow\MailboxGroup\Repository\LookupRepository;
+
+/**
+ * Use cases and rules for mailbox groups.
+ *
+ * Read: admins all groups (also read-only API keys); domain admins with the `mailbox_groups` ACL the groups of
+ *       their domains; users only their own memberships (membershipsOf()).
+ * Edit: admins; domain admins with the ACL for groups of their domains, as long as every send-as grant of the
+ *       group is inside their domains. Template, priority and IdP link are set by admins only.
+ * Members: regular mailboxes the editor may access. IdP members and members outside the editor's scope are kept
+ *       when the member list is replaced; IdP members can only be removed by the IdP sync.
+ */
+class GroupService
+{
+    /** Postfix expands at most this many recipients per address (virtual_alias_expansion_limit) */
+    private const MAX_RECIPIENTS = 1000;
+
+    public function __construct(private GroupRepository $repo, private LookupRepository $lookup, private TemplateService $templates,
+        private ChangeEffects $effects, private SharingService $sharing, private Context $context)
+    {
+    }
+
+    public function canRead(): bool
+    {
+        return $this->context->hasAdminRights()
+            || ($this->context->isDomainAdmin() && $this->context->hasAcl('mailbox_groups'));
+    }
+
+    /** @throws AccessDenied unless the caller may edit groups at all */
+    public function requireEditor(): void
+    {
+        if (!$this->canRead() || $this->context->isReadOnlyApi()) {
+            throw new AccessDenied();
+        }
+    }
+
+    public function get(int $id): ?Group
+    {
+        return $this->canRead() ? $this->repo->findVisible($id, $this->context) : null;
+    }
+
+    /** @return int[] */
+    public function visibleIds(array $domains = []): array
+    {
+        return $this->canRead() ? $this->repo->visibleIds($this->context, $domains) : [];
+    }
+
+    public function canEdit(Group $group): bool
+    {
+        if ($this->context->isReadOnlyApi() || !$this->canRead()) {
+            return false;
+        }
+        if ($this->context->hasAdminRights()) {
+            return true;
+        }
+        if (!$this->context->canAccessDomain($group->domain)) {
+            return false;
+        }
+        // Grants on foreign domains or mailboxes make the group read-only for a domain admin
+        foreach ($group->sendAs as $address) {
+            if (!$this->context->canAccessDomain(self::domainOf($address))) {
+                return false;
+            }
+        }
+        foreach (array_merge($group->imapGrants, $group->sogoGrants) as $grant) {
+            if (!$this->context->canAccessMailbox((string)$grant['owner'])) {
+                return false;
+            }
+        }
+        return true;
+    }
+
+    public function toArray(Group $group): array
+    {
+        return $group->toArray($this->canEdit($group));
+    }
+
+    /** @throws UserError */
+    public function create(array $input): Group
+    {
+        $this->requireEditor();
+        $group = new Group();
+        $group->domain = $this->domainFor($input['domain'] ?? null);
+        $this->apply($group, $input, null);
+        $snapshot = $this->effects->snapshot($group->usernames());
+        $sogo = $this->repo->insert($group);
+        $group->warnings = array_merge($this->sizeWarnings($group), $this->effects->apply($sogo, $snapshot),
+            $this->sharing->applyImap((int)$group->id), $this->sharing->applySogo((int)$group->id));
+        return $group;
+    }
+
+    /**
+     * Updates a group; attributes missing in $input keep their value. `reapply_template` (admin) applies the
+     * effective templates to all members again.
+     *
+     * @throws UserError
+     */
+    public function update(int $id, array $input): Group
+    {
+        $this->requireEditor();
+        $current = $this->editable($id);
+        $group = clone $current;
+        $this->apply($group, $input, $current);
+        $snapshot = $this->effects->snapshot(array_merge($current->usernames(), $group->usernames()));
+        $sogo = $this->repo->update($group);
+        $group->warnings = array_merge($this->sizeWarnings($group), $this->effects->apply($sogo, $snapshot),
+            $this->sharing->applyImap((int)$group->id), $this->sharing->applySogo((int)$group->id));
+        if ($this->context->hasAdminRights() && self::flag($input['reapply_template'] ?? 0) === 1) {
+            $group->warnings = array_merge($group->warnings, $this->templates->applyTo($group->usernames()));
+        }
+        return $group;
+    }
+
+    /**
+     * Deletes a group and returns it. Members keep their settings; another group's template may now apply.
+     *
+     * @throws UserError
+     */
+    public function delete(int $id): Group
+    {
+        $this->requireEditor();
+        $group = $this->editable($id);
+        $snapshot = $this->effects->snapshot($group->usernames());
+        $this->sharing->removeImap($group);
+        $sogo = $this->repo->delete($id);
+        $group->warnings = $this->effects->apply($sogo, $snapshot);
+        return $group;
+    }
+
+    /**
+     * Groups of a mailbox, its effective group template and the addresses it may send as through groups.
+     * For the mailbox itself and for admins/domain admins with access to it.
+     */
+    public function membershipsOf(string $username): array
+    {
+        $username = strtolower(trim($username));
+        $own = ($this->context->isUser() && $this->context->username === $username);
+        if (!$own && !($this->canRead() && $this->context->canAccessMailbox($username))) {
+            return [];
+        }
+        return [
+            'groups' => $this->lookup->membershipsOf($username),
+            'template' => $this->templates->effective([$username])[$username] ?? null,
+            'send_as' => $this->lookup->sendAsOf($username),
+        ];
+    }
+
+    /** @throws AccessDenied when the caller cannot see or edit the group */
+    private function editable(int $id): Group
+    {
+        $group = $this->get($id);
+        if ($group === null || !$this->canEdit($group)) {
+            throw new AccessDenied();
+        }
+        return $group;
+    }
+
+    /** @throws UserError domain_not_found, access_denied */
+    private function domainFor(mixed $value): string
+    {
+        $domain = Input::text($value);
+        $domain = ($domain === null || $domain === '') ? '' : (string)idn_to_ascii(strtolower($domain), 0, INTL_IDNA_VARIANT_UTS46);
+        if ($domain === '' || !$this->lookup->isDomain($domain)) {
+            throw new UserError('domain_not_found', [htmlspecialchars((string)Input::text($value))]);
+        }
+        if (!$this->context->hasAdminRights() && !$this->context->canAccessDomain($domain)) {
+            throw new AccessDenied();
+        }
+        return $domain;
+    }
+
+    /**
+     * Add/edit rules shared by create() and update(): attributes missing in $input keep the value of $group,
+     * a new group starts with the model defaults. Everything is validated before anything is written.
+     *
+     * @throws UserError
+     */
+    private function apply(Group $group, array $input, ?Group $current): void
+    {
+        $name = isset($input['name']) ? Input::text($input['name']) : $group->name;
+        if ($name === null || $name === '' || mb_strlen($name) > 100) {
+            throw new UserError('group_name_invalid');
+        }
+        $description = isset($input['description']) ? Input::text($input['description']) : $group->description;
+        if ($description === null || mb_strlen($description) > 255) {
+            throw new UserError('group_description_invalid');
+        }
+        if ($this->repo->nameExists($group->domain, $name, $group->id)) {
+            throw new UserError('object_exists', [htmlspecialchars($name)]);
+        }
+        $group->name = $name;
+        $group->description = $description;
+        foreach (['sender_allowed' => 'senderAllowed', 'sogo_visible' => 'sogoVisible', 'internal' => 'internal', 'active' => 'active'] as $key => $property) {
+            if (isset($input[$key])) {
+                $group->$property = self::flag($input[$key]);
+            }
+        }
+        $this->applyAddress($group, $input, $current);
+        $this->applyMembers($group, $input);
+        $this->applySendAs($group, $input);
+        $this->applyGrants($group, $input);
+        if ($this->context->hasAdminRights()) {
+            $this->applyAdminFields($group, $input);
+        }
+    }
+
+    /** @throws UserError */
+    private function applyAddress(Group $group, array $input, ?Group $current): void
+    {
+        if (array_key_exists('address', $input)) {
+            $value = Input::text($input['address']);
+        } elseif (array_key_exists('local_part', $input)) {
+            $local = Input::text($input['local_part']);
+            $value = ($local === null || $local === '') ? $local : $local . '@' . $group->domain;
+        } else {
+            return;
+        }
+        if ($value === '') {
+            $group->address = null;
+            return;
+        }
+        $address = ($value === null) ? null : self::normalizeAddress($value);
+        if ($address === null || self::domainOf($address) !== $group->domain) {
+            throw new UserError('group_address_invalid', [htmlspecialchars((string)$value)]);
+        }
+        $group->address = $address;
+        if ($address === $current?->address) {
+            return;
+        }
+        if ($this->lookup->addressTaken($address, $group->id)) {
+            throw new UserError('is_alias_or_mailbox', [htmlspecialchars($address)]);
+        }
+        // A group with an address counts like an alias of the domain
+        if ($current?->address === null && $this->lookup->aliasesLeft($group->domain) < 1) {
+            throw new UserError('max_alias_exceeded');
+        }
+    }
+
+    /**
+     * `members` replaces the manual members the caller may access, `add_members` / `remove_members` change them.
+     *
+     * @throws UserError group_member_invalid, group_member_idp, access_denied
+     */
+    private function applyMembers(Group $group, array $input): void
+    {
+        $members = $group->members;
+        $add = [];
+        if (array_key_exists('members', $input)) {
+            $add = self::cleanList($input['members']);
+            foreach ($members as $username => $source) {
+                if ($source === Group::SOURCE_MANUAL && !in_array((string)$username, $add, true) && $this->context->canAccessMailbox((string)$username)) {
+                    unset($members[$username]);
+                }
+            }
+        }
+        $add = array_merge($add, self::cleanList($input['add_members'] ?? []));
+        foreach (self::cleanList($input['remove_members'] ?? []) as $username) {
+            if (!isset($members[$username])) {
+                continue;
+            }
+            if ($members[$username] === Group::SOURCE_IDP) {
+                throw new UserError('group_member_idp', [htmlspecialchars($username)]);
+            }
+            if (!$this->context->canAccessMailbox($username)) {
+                throw new AccessDenied();
+            }
+            unset($members[$username]);
+        }
+        $new = array_values(array_diff(array_unique($add), array_map('strval', array_keys($members))));
+        $regular = $this->lookup->regularMailboxes($new);
+        foreach ($new as $username) {
+            if (!in_array($username, $regular, true)) {
+                throw new UserError('group_member_invalid', [htmlspecialchars($username)]);
+            }
+            if (!$this->context->canAccessMailbox($username)) {
+                throw new AccessDenied();
+            }
+            $members[$username] = Group::SOURCE_MANUAL;
+        }
+        ksort($members);
+        $group->members = $members;
+    }
+
+    /**
+     * Addresses (mailboxes or aliases) and @domain the members may send as; the editor needs access to their domains.
+     *
+     * @throws UserError group_send_as_invalid, access_denied
+     */
+    private function applySendAs(Group $group, array $input): void
+    {
+        if (!array_key_exists('send_as', $input)) {
+            return;
+        }
+        $sendAs = [];
+        foreach (self::cleanList($input['send_as']) as $value) {
+            if (str_starts_with($value, '@')) {
+                $domain = (string)idn_to_ascii(substr($value, 1), 0, INTL_IDNA_VARIANT_UTS46);
+                $address = '@' . $domain;
+                $valid = ($domain !== '' && $this->lookup->isDomainOrAliasDomain($domain));
+            } else {
+                $address = self::normalizeAddress($value);
+                // The group's own address is covered by sender_allowed
+                $valid = ($address !== null && $address !== $group->address && $this->lookup->aliasExists($address));
+            }
+            if (!$valid) {
+                throw new UserError('group_send_as_invalid', [htmlspecialchars($value)]);
+            }
+            if (!$this->context->hasAdminRights() && !$this->context->canAccessDomain(self::domainOf((string)$address))) {
+                throw new AccessDenied();
+            }
+            $sendAs[] = (string)$address;
+        }
+        $sendAs = array_values(array_unique($sendAs));
+        sort($sendAs);
+        $group->sendAs = $sendAs;
+    }
+
+    /**
+     * `imap_grants` [{owner, rights, subscribe}] and `sogo_grants` [{owner, type, folder, access, subscribe}] replace
+     * the grants; the editor needs access to every owner mailbox.
+     *
+     * @throws UserError group_grant_invalid, access_denied
+     */
+    private function applyGrants(Group $group, array $input): void
+    {
+        if (array_key_exists('imap_grants', $input)) {
+            $grants = [];
+            foreach (self::grantList($input['imap_grants']) as $grant) {
+                $owner = $this->grantOwner($grant);
+                $rights = Input::text($grant['rights'] ?? 'read');
+                if (!isset(SharingService::IMAP_RIGHTS[$rights])) {
+                    throw new UserError('group_grant_invalid', [htmlspecialchars($owner)]);
+                }
+                $grants[$owner] = ['owner' => $owner, 'rights' => $rights, 'subscribe' => self::flag($grant['subscribe'] ?? 0)];
+            }
+            ksort($grants);
+            $group->imapGrants = array_values($grants);
+        }
+        if (array_key_exists('sogo_grants', $input)) {
+            $grants = [];
+            foreach (self::grantList($input['sogo_grants']) as $grant) {
+                $owner = $this->grantOwner($grant);
+                $type = Input::text($grant['type'] ?? 'Calendar');
+                $folder = Input::text($grant['folder'] ?? '') ?: 'personal';
+                $access = Input::text($grant['access'] ?? 'read');
+                if (!isset(GroupRepository::SOGO_ROLES[$type][$access]) || !preg_match('/^[A-Za-z0-9._-]{1,100}$/', $folder)) {
+                    throw new UserError('group_grant_invalid', [htmlspecialchars($owner)]);
+                }
+                $grants[$owner . '|' . $type . '|' . $folder] = ['owner' => $owner, 'type' => $type, 'folder' => $folder, 'access' => $access,
+                    'subscribe' => self::flag($grant['subscribe'] ?? 0)];
+            }
+            ksort($grants);
+            $group->sogoGrants = array_values($grants);
+        }
+    }
+
+    /** @throws UserError group_grant_invalid, access_denied */
+    private function grantOwner(array $grant): string
+    {
+        $owner = strtolower((string)Input::text($grant['owner'] ?? ''));
+        if ($owner === '' || empty($this->lookup->regularMailboxes([$owner]))) {
+            throw new UserError('group_grant_invalid', [htmlspecialchars($owner)]);
+        }
+        if (!$this->context->canAccessMailbox($owner)) {
+            throw new AccessDenied();
+        }
+        return $owner;
+    }
+
+    /**
+     * Grant objects of a JSON body or of a form field (JSON string)
+     *
+     * @throws UserError group_grant_invalid
+     */
+    private static function grantList(mixed $value): array
+    {
+        if (is_string($value)) {
+            $value = ($value === '') ? [] : json_decode($value, true);
+        }
+        if (!is_array($value)) {
+            throw new UserError('group_grant_invalid', ['']);
+        }
+        foreach ($value as $grant) {
+            if (!is_array($grant)) {
+                throw new UserError('group_grant_invalid', ['']);
+            }
+        }
+        return array_values($value);
+    }
+
+    /** @throws UserError template_id_invalid, group_priority_invalid */
+    private function applyAdminFields(Group $group, array $input): void
+    {
+        if (array_key_exists('template_id', $input)) {
+            $id = $input['template_id'];
+            if ($id === null || $id === '' || $id === '0' || $id === 0) {
+                $group->templateId = null;
+                $group->template = null;
+            } else {
+                $templateId = Input::intInRange($id, 1, PHP_INT_MAX);
+                $name = ($templateId === null) ? null : $this->lookup->templateName($templateId);
+                if ($name === null) {
+                    throw new UserError('template_id_invalid', [htmlspecialchars((string)Input::text($id))]);
+                }
+                $group->templateId = $templateId;
+                $group->template = $name;
+            }
+        }
+        if (isset($input['priority'])) {
+            $priority = Input::intInRange($input['priority'], -1000000, 1000000);
+            if ($priority === null) {
+                throw new UserError('group_priority_invalid');
+            }
+            $group->priority = $priority;
+        }
+        if (array_key_exists('idp_ref', $input)) {
+            $ref = Input::text($input['idp_ref']);
+            if ($ref === null || mb_strlen($ref) > 255) {
+                throw new AccessDenied();
+            }
+            $group->idpRef = ($ref === '') ? null : $ref;
+        }
+    }
+
+    /** @return array[] */
+    private function sizeWarnings(Group $group): array
+    {
+        if ($group->address !== null && count($group->members) > self::MAX_RECIPIENTS) {
+            return [['group_too_many_members', htmlspecialchars($group->name), self::MAX_RECIPIENTS]];
+        }
+        return [];
+    }
+
+    /** Checkbox or API flag; a hidden "0" + checkbox pair arrives as ["0", "1"] when checked */
+    private static function flag(mixed $value): int
+    {
+        if (is_array($value)) {
+            $value = end($value);
+        }
+        return filter_var($value, FILTER_VALIDATE_BOOLEAN) ? 1 : 0;
+    }
+
+    /** @return string[] trimmed, lowercase, unique entries of an array or of a string separated by spaces, commas, semicolons or newlines */
+    private static function cleanList(mixed $value): array
+    {
+        $values = is_array($value) ? $value : preg_split('/[\s,;]+/', is_scalar($value) ? (string)$value : '');
+        $clean = [];
+        foreach ($values as $item) {
+            if (is_scalar($item) && trim((string)$item) !== '') {
+                $clean[] = strtolower(trim((string)$item));
+            }
+        }
+        return array_values(array_unique($clean));
+    }
+
+    /** Lowercase address with ASCII (IDN) domain, null if invalid */
+    private static function normalizeAddress(string $value): ?string
+    {
+        $value = strtolower(trim($value));
+        $at = strrpos($value, '@');
+        if ($at === false || $at === 0) {
+            return null;
+        }
+        $domain = idn_to_ascii(substr($value, $at + 1), 0, INTL_IDNA_VARIANT_UTS46);
+        $address = substr($value, 0, $at) . '@' . $domain;
+        return ($domain !== false && filter_var($address, FILTER_VALIDATE_EMAIL)) ? $address : null;
+    }
+
+    private static function domainOf(string $address): string
+    {
+        return substr($address, strrpos($address, '@') + 1);
+    }
+}

data/web/inc/lib/mailcow/MailboxGroup/Service/IdpSyncService.php

@@ -0,0 +1,124 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Mailcow\MailboxGroup\Service;
+
+use Mailcow\Core\UserError;
+use Mailcow\MailboxGroup\Model\Group;
+use Mailcow\MailboxGroup\Repository\GroupRepository;
+use Mailcow\MailboxGroup\Repository\LookupRepository;
+
+/**
+ * Entry points for the IdP sync: system caller, no permission checks, never routed in json_api.
+ * Only memberships with source 'idp' are managed here; manual memberships stay.
+ */
+class IdpSyncService
+{
+    public function __construct(private GroupRepository $repo, private LookupRepository $lookup, private ChangeEffects $effects)
+    {
+    }
+
+    public function findByIdpRef(string $ref): ?Group
+    {
+        return $this->repo->findByIdpRef($ref);
+    }
+
+    /** @return array[] every group with its members, see GroupRepository::syncState() */
+    public function groups(): array
+    {
+        return $this->repo->syncState();
+    }
+
+    /**
+     * Creates the group of an IdP group, members follow with syncGroupMembers(). The group mail becomes the
+     * distribution address when it is in the group's domain and free.
+     *
+     * @return array[] warnings (msg values)
+     * @throws UserError
+     */
+    public function createFromIdp(string $ref, string $name, string $domain, ?string $mail): array
+    {
+        $name = $this->validName($domain, $name, null);
+        if (!$this->lookup->isDomain($domain)) {
+            throw new UserError('domain_not_found', [htmlspecialchars($domain)]);
+        }
+        $group = new Group();
+        $group->domain = $domain;
+        $group->name = $name;
+        $group->idpRef = $ref;
+        $warnings = [];
+        if ($mail !== null && filter_var($mail, FILTER_VALIDATE_EMAIL) && str_ends_with($mail, '@' . $domain)) {
+            if ($this->lookup->addressTaken($mail, null) || $this->lookup->aliasesLeft($domain) < 1) {
+                $warnings[] = ['group_idp_address_skipped', htmlspecialchars($mail), htmlspecialchars($name)];
+            } else {
+                $group->address = $mail;
+            }
+        }
+        $this->repo->insert($group);
+        return $warnings;
+    }
+
+    /** @throws UserError */
+    public function renameFromIdp(int $groupId, string $name): void
+    {
+        $group = $this->repo->find($groupId);
+        if ($group === null) {
+            return;
+        }
+        $group->name = $this->validName($group->domain, $name, $groupId);
+        $this->repo->update($group);
+    }
+
+    /**
+     * Sets the IdP members of a group. Usernames that are no regular mailbox are skipped; a manual member that
+     * the IdP also lists stays manual.
+     *
+     * @return array{added: string[], removed: string[], skipped: string[], warnings: array[]}
+     */
+    public function syncGroupMembers(int $groupId, array $usernames): array
+    {
+        $result = ['added' => [], 'removed' => [], 'skipped' => [], 'warnings' => []];
+        $group = $this->repo->find($groupId);
+        if ($group === null) {
+            return $result;
+        }
+        $wanted = array_values(array_unique(array_map(fn(mixed $u): string => strtolower(trim((string)$u)), $usernames)));
+        $regular = $this->lookup->regularMailboxes($wanted);
+        $result['skipped'] = array_values(array_diff($wanted, $regular));
+        $members = $group->members;
+        foreach ($members as $username => $source) {
+            if ($source === Group::SOURCE_IDP && !in_array((string)$username, $regular, true)) {
+                unset($members[$username]);
+                $result['removed'][] = (string)$username;
+            }
+        }
+        foreach ($regular as $username) {
+            if (!isset($members[$username])) {
+                $members[$username] = Group::SOURCE_IDP;
+                $result['added'][] = $username;
+            }
+        }
+        if (empty($result['added']) && empty($result['removed'])) {
+            return $result;
+        }
+        ksort($members);
+        $snapshot = $this->effects->snapshot(array_merge($group->usernames(), array_keys($members)));
+        $group->members = $members;
+        $result['warnings'] = $this->effects->apply($this->repo->update($group), $snapshot);
+        return $result;
+    }
+
+    /** @throws UserError */
+    private function validName(string $domain, string $name, ?int $groupId): string
+    {
+        $name = trim($name);
+        if ($name === '' || mb_strlen($name) > 100) {
+            throw new UserError('group_name_invalid');
+        }
+        if ($this->repo->nameExists($domain, $name, $groupId)) {
+            throw new UserError('object_exists', [htmlspecialchars($name)]);
+        }
+        return $name;
+    }
+}

data/web/inc/lib/mailcow/MailboxGroup/Service/SharingService.php

@@ -0,0 +1,169 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Mailcow\MailboxGroup\Service;
+
+use Mailcow\Dovecot\Service\DovecotService;
+use Mailcow\MailboxGroup\Model\Group;
+use Mailcow\MailboxGroup\Repository\GroupRepository;
+use Mailcow\Sogo\Service\SogoService;
+
+/**
+ * Mailbox access of group members (shared mailboxes, calendars, address books).
+ *
+ * IMAP: a grant is the Dovecot ACL group=mcg_<id> on every folder of the owner; members get the group through
+ * the userdb field acl_groups, so membership changes need no ACL change. Dovecot is reached through dockerapi
+ * after the commit; subfolders created later inherit the ACL, new top-level folders and failed grants are
+ * handled by reconcile() (cron).
+ * SOGo: sogo_acl rows per member, maintained by GroupRepository::rebuild(); missing personal folders of owners that
+ * never logged in to SOGo (shared mailboxes) are created with sogo-tool init-user.
+ * Grants with `subscribe` are subscribed for each member once by syncSubscriptions(); a member that removes the
+ * subscription keeps it removed, members that lose the access are unsubscribed.
+ */
+class SharingService
+{
+    /** Dovecot rights per grant level */
+    public const IMAP_RIGHTS = [
+        'read' => ['lookup', 'read', 'write-seen'],
+        'write' => ['lookup', 'read', 'write-seen', 'write', 'write-deleted', 'insert', 'post', 'expunge', 'create'],
+        'full' => ['lookup', 'read', 'write-seen', 'write', 'write-deleted', 'insert', 'post', 'expunge', 'create', 'delete'],
+    ];
+
+    public function __construct(private GroupRepository $repo, private DovecotService $dovecot, private SogoService $sogo,
+        private ChangeEffects $effects)
+    {
+    }
+
+    /** Group name in the userdb field acl_groups (dovecot docker-entrypoint.sh) */
+    public static function aclGroup(int $groupId): string
+    {
+        return 'mcg_' . $groupId;
+    }
+
+    /**
+     * Applies the IMAP grants Dovecot does not have yet (pending, failed, removing); $all also applies the applied
+     * ones again. Of one group or all.
+     *
+     * @return array[] warnings (msg values)
+     */
+    public function applyImap(?int $groupId, bool $all = false): array
+    {
+        $warnings = [];
+        foreach ($this->repo->imapGrantsToApply($groupId, $all) as $grant) {
+            $removing = ($grant['state'] === 'removing');
+            $error = $this->dovecot->setAclAll((string)$grant['owner'], 'group=' . self::aclGroup((int)$grant['group_id']),
+                $removing ? [] : self::IMAP_RIGHTS[$grant['rights']]);
+            if ($error === null && $removing) {
+                $this->repo->deleteImapGrant((int)$grant['id']);
+                continue;
+            }
+            if ($error === null) {
+                if ($grant['state'] !== 'applied' || $grant['last_error'] !== null) {
+                    $this->repo->setImapState((int)$grant['id'], 'applied', null);
+                }
+                continue;
+            }
+            $this->repo->setImapState((int)$grant['id'], $removing ? 'removing' : 'failed', $error);
+            $warnings[] = ['group_imap_grant_failed', htmlspecialchars((string)$grant['owner'])];
+        }
+        return $warnings;
+    }
+
+    /** After a group write: creates missing SOGo folders of its grant owners and applies the pending grants to them */
+    public function applySogo(int $groupId): array
+    {
+        $warnings = $this->initSogoFolders($groupId);
+        // null: no grant waits for a folder, warnings: the folders could not be created
+        if ($warnings === null || $warnings !== []) {
+            return $warnings ?? [];
+        }
+        return $this->effects->apply($this->repo->rebuild($groupId), []);
+    }
+
+    /** Before a group is deleted: its Dovecot ACLs go (best effort, the ACL of a deleted group grants nothing) */
+    public function removeImap(Group $group): void
+    {
+        foreach ($group->imapGrants as $grant) {
+            $this->dovecot->setAclAll((string)$grant['owner'], 'group=' . self::aclGroup((int)$group->id), []);
+        }
+    }
+
+    /**
+     * Cron: applies all IMAP grants again (new top-level folders, failed grants), rebuilds the SOGo grants
+     * (owners that opened SOGo meanwhile, rows of removed grants) and syncs the SOGo subscriptions.
+     *
+     * @return array[] warnings (msg values)
+     */
+    public function reconcile(): array
+    {
+        $warnings = array_merge($this->applyImap(null, true), $this->initSogoFolders(null) ?? []);
+        $users = [];
+        foreach ($this->repo->groupIdsWithSogoGrants() as $id) {
+            $users = array_merge($users, $this->repo->rebuild($id));
+        }
+        $this->repo->cleanupSogoAcl();
+        $warnings = array_merge($warnings, $this->effects->apply(array_values(array_unique($users)), []));
+        return array_merge($warnings, $this->syncSubscriptions());
+    }
+
+    /**
+     * Unsubscribes members that lost the access to a folder mailcow subscribed them to, then subscribes the members
+     * of grants with `subscribe` that have no subscription by mailcow yet. Cheap without pending changes, the cron
+     * runs it every minute.
+     *
+     * @return array[] warnings (msg values)
+     */
+    public function syncSubscriptions(): array
+    {
+        $warnings = [];
+        $sogoChanged = false;
+        foreach (['imap', 'sogo'] as $kind) {
+            foreach ($this->repo->staleSubscriptions($kind) as $row) {
+                // A deleted member has no subscriptions left, a deleted owner no folders; another group may still grant it
+                if ($row['member_exists'] && $row['owner_exists'] && !$row['covered']) {
+                    if ($this->subscribe($kind, (string)$row['owner'], (string)$row['folder'], [(string)$row['username']], true) !== null) {
+                        $warnings[] = ['group_subscription_failed', htmlspecialchars((string)$row['username'])];
+                        continue;
+                    }
+                    $sogoChanged = $sogoChanged || ($kind === 'sogo');
+                }
+                $this->repo->deleteSubscription((int)$row['id']);
+            }
+            foreach ($this->repo->missingSubscriptions($kind) as $grant) {
+                if ($this->subscribe($kind, $grant['owner'], $grant['folder'], $grant['usernames']) !== null) {
+                    $warnings[] = ['group_subscription_failed', htmlspecialchars(implode(', ', $grant['usernames']))];
+                    continue;
+                }
+                $this->repo->addSubscriptions($kind, $grant['grant_id'], $grant['owner'], $grant['folder'], $grant['usernames']);
+                $sogoChanged = $sogoChanged || ($kind === 'sogo');
+            }
+        }
+        if ($sogoChanged) {
+            $this->sogo->flushCache();
+        }
+        return $warnings;
+    }
+
+    /** @return ?string null on success, else the error */
+    private function subscribe(string $kind, string $owner, string $folder, array $usernames, bool $unsubscribe = false): ?string
+    {
+        return ($kind === 'imap') ? $this->dovecot->subscribeShared($owner, $usernames, $unsubscribe)
+            : $this->sogo->subscribe($owner, $folder, $usernames, $unsubscribe);
+    }
+
+    /**
+     * Creates the personal SOGo folders of grant owners that never logged in to SOGo, so their pending grants can
+     * be applied.
+     *
+     * @return ?array[] warnings, null if no grant was waiting for a folder
+     */
+    private function initSogoFolders(?int $groupId): ?array
+    {
+        $owners = $this->repo->pendingSogoOwners($groupId);
+        if (empty($owners)) {
+            return null;
+        }
+        return ($this->sogo->initUsers($owners) === null) ? [] : [['group_sogo_init_failed', htmlspecialchars(implode(', ', $owners))]];
+    }
+}

data/web/inc/lib/mailcow/MailboxGroup/Service/TemplateService.php

@@ -0,0 +1,83 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Mailcow\MailboxGroup\Service;
+
+use Mailcow\MailboxGroup\Legacy\LegacyMailbox;
+use Mailcow\MailboxGroup\Repository\LookupRepository;
+
+/**
+ * Group templates: the effective template of a mailbox is the one of its active group with the highest
+ * priority. It is applied only when it changes, so manual settings of a mailbox stay until then.
+ * A mailbox that leaves all groups keeps its settings.
+ */
+class TemplateService
+{
+    public function __construct(private LookupRepository $lookup, private LegacyMailbox $legacy)
+    {
+    }
+
+    /** @return array<string, ?string> username => effective group template */
+    public function effective(array $usernames): array
+    {
+        return $this->lookup->effectiveTemplates(array_values(array_unique($usernames)));
+    }
+
+    /**
+     * Applies the effective template to the mailboxes whose effective template differs from $before
+     * (a snapshot of effective() taken before the change).
+     *
+     * @return array[] warnings (msg values)
+     */
+    public function applyChanged(array $before): array
+    {
+        $changed = [];
+        foreach ($this->effective(array_keys($before)) as $username => $template) {
+            if ($template !== null && $template !== $before[$username]) {
+                $changed[$username] = $template;
+            }
+        }
+        return $this->apply($changed);
+    }
+
+    /** Applies the effective templates again, e.g. after manual changes (admin action) */
+    public function applyTo(array $usernames): array
+    {
+        return $this->apply(array_filter($this->effective($usernames), fn(?string $template): bool => $template !== null));
+    }
+
+    /** A template was edited: apply it to the mailboxes it is the effective template of */
+    public function onTemplateChanged(int $templateId): array
+    {
+        $name = $this->lookup->templateName($templateId);
+        if ($name === null) {
+            return [];
+        }
+        return $this->apply(array_filter($this->effective($this->lookup->membersWithTemplate($templateId)),
+            fn(?string $template): bool => $template === $name));
+    }
+
+    /** Template for IdP logins and syncs: the effective group template, else the legacy attribute mapping */
+    public function templateForLogin(string $username, ?string $legacy): ?string
+    {
+        return $this->effective([$username])[$username] ?? $legacy;
+    }
+
+    /**
+     * @param array<string, string> $templates username => template
+     * @return array[] warnings (msg values)
+     */
+    private function apply(array $templates): array
+    {
+        $warnings = [];
+        $names = $this->lookup->mailboxNames(array_keys($templates));
+        foreach ($templates as $username => $template) {
+            $error = $this->legacy->applyTemplate((string)$username, (string)($names[$username] ?? ''), $template);
+            if ($error !== null) {
+                $warnings[] = ['group_template_failed', htmlspecialchars($template), htmlspecialchars((string)$username)];
+            }
+        }
+        return $warnings;
+    }
+}

data/web/inc/lib/mailcow/README.md

@@ -30,6 +30,15 @@ Core/                     shared by all modules
 
 Example: `Imapsync/` (sync jobs, sync sources, OAuth). Use it as the template for new modules.
 `ApiKey/` (API keys incl. the service keys of mailcow.conf) is a small module with the same layout.
+`MailboxGroup/` (mailbox groups) keeps its own tables as source of truth and maintains rows the legacy code and
+Postfix read (`alias`, `sender_acl`, tagged with `group_id`); calls into procedural code go through `Legacy/`.
+Shares become Dovecot ACLs on `group=mcg_<id>` (userdb `acl_groups`) and `sogo_acl` rows tracked in a ledger.
+`Dovecot/` (doveadm through dockerapi: ACLs, subscriptions, auth cache) and `Sogo/` (user view, cache, sogo-tool
+through dockerapi) are used by other modules instead of calling `docker()` or the SOGo functions themselves.
+`Identity/` (IdP links, sync runs, offboarding) lists Keycloak/LDAP through `Directory/` adapters, decides in the
+side-effect free `SyncPlanner` and is run by the `identity-sync.php` cron.
+`Auth/` (logins) holds for now the IdP login steps the legacy login flows call (link checks fail closed, group
+template before the attribute mapping); the auth logic of the function files moves here step by step.
 
 ## Layers and rules
 

data/web/inc/lib/mailcow/Sogo/Service/SogoService.php

@@ -0,0 +1,80 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Mailcow\Sogo\Service;
+
+/**
+ * SOGo: its user view, its cache and sogo-tool in the sogo container through dockerapi. The legacy calls sit in
+ * protected methods so tests can replace them.
+ */
+class SogoService
+{
+    /** More changed mailboxes than this: one full view rebuild instead of single updates */
+    private const SINGLE_UPDATES = 25;
+
+    /** Refreshes the SOGo identities (visible aliases, send-as addresses) of the given mailboxes */
+    public function refreshStaticView(array $usernames): void
+    {
+        $usernames = array_values(array_unique($usernames));
+        if (empty($usernames)) {
+            return;
+        }
+        if (count($usernames) > self::SINGLE_UPDATES) {
+            $this->updateStaticView(null);
+            return;
+        }
+        foreach ($usernames as $username) {
+            $this->updateStaticView($username);
+        }
+    }
+
+    /** SOGo caches ACLs and user settings in memcached */
+    public function flushCache(): void
+    {
+        $this->flushMemcached();
+    }
+
+    /**
+     * Subscribes the users to a folder of the owner (sogo-tool manage-acl), or unsubscribes them.
+     *
+     * @param string $folder Calendar/<id> or Contacts/<id>
+     * @return ?string null on success, else the error of dockerapi
+     */
+    public function subscribe(string $owner, string $folder, array $usernames, bool $unsubscribe = false): ?string
+    {
+        return self::error($this->exec(['cmd' => 'sogo', 'task' => 'subscribe', 'owner' => $owner, 'folder' => $folder,
+            'users' => array_values($usernames), 'unsubscribe' => $unsubscribe]));
+    }
+
+    /**
+     * Creates the personal folders of users that never logged in to SOGo (sogo-tool init-user).
+     *
+     * @return ?string null on success, else the error of dockerapi
+     */
+    public function initUsers(array $usernames): ?string
+    {
+        return self::error($this->exec(['cmd' => 'sogo', 'task' => 'init_user', 'users' => array_values($usernames)]));
+    }
+
+    protected function updateStaticView(?string $username): void
+    {
+        update_sogo_static_view($username);
+    }
+
+    protected function flushMemcached(): void
+    {
+        flush_memcached();
+    }
+
+    protected function exec(array $fields): mixed
+    {
+        return docker('post', 'sogo-mailcow', 'exec', $fields);
+    }
+
+    private static function error(mixed $response): ?string
+    {
+        $result = json_decode((string)$response, true);
+        return (($result['type'] ?? '') === 'success') ? null : (string)($result['msg'] ?? 'dockerapi did not answer');
+    }
+}

data/web/inc/lib/mailcow/Sogo/SogoModule.php

@@ -0,0 +1,22 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Mailcow\Sogo;
+
+use Mailcow\Sogo\Service\SogoService;
+
+/**
+ * SOGo (user view, cache, sogo-tool through dockerapi). Modules use it instead of the legacy SOGo functions.
+ */
+class SogoModule
+{
+    public function __construct(public readonly SogoService $sogo)
+    {
+    }
+
+    public static function create(): self
+    {
+        return new self(new SogoService());
+    }
+}

data/web/js/site/admin.js

@@ -934,6 +934,12 @@ jQuery(function($){
       $('#keycloak_settings').addClass('d-none');
     }
   });
+  // LDAP: one select for the excluding use_ssl and use_tls (select only, bootstrap-select copies the class to its wrapper)
+  $('select.iam_ldap_encryption').on('change', function() {
+    var $form = $(this).closest('form');
+    $form.find('input[name="use_ssl"]').val(this.value === 'ssl' ? 1 : 0);
+    $form.find('input[name="use_tls"]').val(this.value === 'tls' ? 1 : 0);
+  });
   function addAttributeMappingRow(list_id, del_class, e) {
     e.preventDefault();
 

data/web/js/site/groups.js

@@ -0,0 +1,152 @@
+// Mailbox groups (admin/domainadmin mailbox page, group edit page). Loaded via $js_minifier.
+var mailcowGroups = (function($) {
+  'use strict';
+
+  // Lang strings: lang.groups (mailbox page) or lang_groups (edit page), '' if missing
+  function L(key) {
+    var src = (typeof lang_groups !== 'undefined' && lang_groups) ? lang_groups :
+      ((typeof lang !== 'undefined' && lang && lang.groups) ? lang.groups : {});
+    return (src[key] !== undefined && src[key] !== null) ? src[key] : '';
+  }
+  function esc(s) {
+    return escapeHtml(s === null || s === undefined ? '' : s);
+  }
+
+  function membersCell(members) {
+    if (!Array.isArray(members) || members.length === 0) return '-';
+    var list = members.slice(0, 3).map(function(m) {
+      return (m.source === 'idp' ? '<i class="bi bi-cloud" title="' + esc(L('idp_member')) + '"></i> ' : '') + esc(m.username);
+    }).join('<br>');
+    if (members.length > 3) list += '<br><span class="text-muted">+' + (members.length - 3) + '</span>';
+    return '<span class="badge bg-info">' + members.length + '</span><br>' + list;
+  }
+
+  function addressCell(item) {
+    if (!item.address) return '-';
+    var flags = [];
+    if (item.sender_allowed == 1) flags.push('<i class="bi bi-send" title="' + esc(L('sender_allowed')) + '"></i>');
+    if (item.internal == 1) flags.push('<i class="bi bi-building-lock" title="' + esc(L('internal')) + '"></i>');
+    return esc(item.address) + (flags.length ? ' ' + flags.join(' ') : '');
+  }
+
+  function drawTable() {
+    if ($.fn.DataTable.isDataTable('#mailbox_group_table')) {
+      $('#mailbox_group_table').DataTable().columns.adjust().responsive.recalc();
+      return;
+    }
+    $('#mailbox_group_table').DataTable({
+      responsive: true,
+      processing: true,
+      serverSide: false,
+      stateSave: true,
+      pageLength: pagination_size,
+      dom: "<'row'<'col-sm-12 col-md-6'f><'col-sm-12 col-md-6'l>>" + "tr" +
+           "<'row'<'col-sm-12 col-md-5'i><'col-sm-12 col-md-7'p>>",
+      language: lang_datatables,
+      order: [[3, 'asc']],
+      ajax: {
+        type: "GET",
+        url: "/api/v1/get/mailbox-group/all",
+        dataSrc: function(json) {
+          if (!Array.isArray(json)) return [];
+          $.each(json, function(i, item) {
+            item.chkbox = item.can_edit ?
+              '<input type="checkbox" class="form-check-input" data-id="mailbox_group" name="multi_select" value="' + encodeURIComponent(item.id) + '" />' :
+              '<input type="checkbox" class="form-check-input" disabled />';
+            item.name_display = esc(item.name) + (item.idp_ref ? ' <span class="badge bg-info">' + esc(L('idp')) + '</span>' : '');
+            if (item.description) item.name_display += '<div class="small text-muted">' + esc(item.description) + '</div>';
+            item.address_display = addressCell(item);
+            item.members_display = membersCell(item.members);
+            item.send_as_display = (item.send_as || []).map(esc).join('<br>') || '-';
+            item.template_display = item.template ? esc(item.template) + ' <span class="text-muted">(' + esc(item.priority) + ')</span>' : '-';
+            item.action = '<div class="btn-group">' +
+              '<a href="/edit/mailbox-group/' + encodeURIComponent(item.id) + '" class="btn btn-sm btn-xs-lg btn-xs-half btn-secondary"><i class="bi bi-pencil-fill"></i> ' + esc(item.can_edit ? lang.edit : L('view')) + '</a>' +
+              (item.can_edit ? '<a href="#" data-action="delete_selected" data-id="single-mailbox_group" data-api-url="delete/mailbox-group" data-item="' + encodeURIComponent(item.id) + '" class="btn btn-sm btn-xs-lg btn-xs-half btn-danger"><i class="bi bi-trash"></i> ' + esc(lang.remove) + '</a>' : '') +
+              '</div>';
+          });
+          return json;
+        },
+        error: function() {
+          mailcow_alert_box(L('list_error'), 'danger');
+        }
+      },
+      columns: [
+        {
+          // placeholder, so checkbox will not block child row toggle
+          title: '',
+          data: null,
+          searchable: false,
+          orderable: false,
+          defaultContent: '',
+          responsivePriority: 1
+        },
+        { title: '', data: 'chkbox', searchable: false, orderable: false, defaultContent: '', responsivePriority: 2 },
+        { title: 'ID', data: 'id', defaultContent: '', responsivePriority: 6 },
+        { title: L('name'), data: 'name_display', defaultContent: '', responsivePriority: 2 },
+        { title: L('domain'), data: 'domain', defaultContent: '', responsivePriority: 5 },
+        { title: L('address'), data: 'address_display', defaultContent: '', responsivePriority: 3 },
+        { title: L('members'), data: 'members_display', defaultContent: '', responsivePriority: 4 },
+        { title: L('send_as'), data: 'send_as_display', defaultContent: '', responsivePriority: 7 },
+        { title: L('template'), data: 'template_display', defaultContent: '', responsivePriority: 8 },
+        {
+          title: lang.active,
+          data: 'active',
+          defaultContent: '',
+          responsivePriority: 6,
+          render: function(d) { return d == 1 ? '<i class="bi bi-check-lg"></i>' : '<i class="bi bi-x-lg"></i>'; }
+        },
+        {
+          title: lang.action,
+          data: 'action',
+          orderable: false,
+          className: 'dt-sm-head-hidden dt-data-w100 dtr-col-md dt-text-right',
+          responsivePriority: 3,
+          defaultContent: ''
+        }
+      ]
+    });
+  }
+
+  // Share rows (edit page, add modal) are kept as JSON in the hidden form field of their table (imap_grants, sogo_grants)
+  function syncGrants($table) {
+    var grants = [];
+    $table.find('tr.group-grant').each(function() {
+      var grant = {};
+      $(this).find('[data-grant]').each(function() {
+        grant[$(this).data('grant')] = $(this).is(':checkbox') ? ($(this).is(':checked') ? 1 : 0) : $(this).val();
+      });
+      if (grant.owner) grants.push(grant);
+    });
+    $table.closest('form').find('input[name="' + $table.data('field') + '"]').val(JSON.stringify(grants));
+  }
+
+  $(document).ready(function() {
+    // @domain suffix of the address in the add modal
+    $('.mailbox-group-domain-select').on('change', function() {
+      $(this).closest('form').find('.mailbox-group-domain').text($(this).val());
+    });
+    $(document).on('change', '.group-grants [data-grant]', function() {
+      syncGrants($(this).closest('.group-grants'));
+    });
+    $(document).on('click', '.group-grant-add', function(e) {
+      e.preventDefault();
+      var $table = $('#' + $(this).data('table'));
+      var $body = $table.children('tbody');
+      if (!$body.length) $body = $('<tbody>').appendTo($table);
+      var $row = $($('#' + $(this).data('table') + '_template').html()).appendTo($body);
+      $row.find('select').selectpicker({'styleBase': 'btn btn-xs-lg', 'noneSelectedText': lang_footer.nothing_selected});
+      syncGrants($table);
+    });
+    $(document).on('click', '.group-grant-del', function(e) {
+      e.preventDefault();
+      var $table = $(this).closest('.group-grants');
+      $(this).closest('tr').remove();
+      syncGrants($table);
+    });
+  });
+
+  return {
+    drawTable: drawTable,
+    L: L
+  };
+})(jQuery);

data/web/js/site/identity.js

@@ -0,0 +1,104 @@
+// Identity provider sync: status card and run requests (admin system page, identity provider tab).
+// Runs are executed by the identity-sync cron (every minute); the card polls until the requested run is done.
+var mailcowIdentity = (function($) {
+  'use strict';
+
+  var POLL_MS = 5000;
+  var POLL_MAX = 36;
+  var polls = 0;
+  var timer = null;
+  var STATUS_CLASS = {ok: 'bg-success', blocked: 'bg-warning text-dark', error: 'bg-danger', pending: 'bg-secondary', running: 'bg-info text-dark'};
+  // summary counts in display order
+  var COUNTS = ['creates', 'links', 'deactivate', 'restore', 'release', 'missing', 'found', 'updates', 'group_creates', 'group_renames',
+    'memberships', 'orphaned_groups', 'membership_removals', 'conflicts', 'errors', 'skipped'];
+  var DETAILS = ['conflicts', 'errors', 'deactivate', 'restore', 'missing', 'creates', 'group_creates'];
+
+  // admin.twig injects the admin lang section as `lang`
+  function L(key) {
+    var src = (typeof lang_admin !== 'undefined') ? lang_admin : ((typeof lang !== 'undefined') ? lang : {});
+    return (src[key] !== undefined) ? src[key] : key;
+  }
+  function esc(s) {
+    return escapeHtml(s === null || s === undefined ? '' : String(s));
+  }
+
+  function badge(label, value, cls) {
+    return '<span class="badge ' + (cls || 'bg-light text-dark border') + ' me-1 mb-1">' + esc(label) + ': ' + esc(value) + '</span>';
+  }
+
+  function changes(run) {
+    var s = run.summary;
+    if (!s) return '';
+    if (s.error) return '<span class="text-danger">' + esc(s.error) + '</span>';
+    var counts = s.counts || {};
+    var html = '';
+    $.each(COUNTS, function(i, key) {
+      if (counts[key] > 0) html += badge(L('iam_sync_count_' + key), counts[key], (key === 'errors' || key === 'conflicts') ? 'bg-danger' : null);
+    });
+    if (html === '') html = '<span class="text-muted">' + esc(L('iam_sync_no_changes')) + '</span>';
+    var details = $.extend({}, s.details || {}, {errors: s.errors || []});
+    var lists = '';
+    $.each(DETAILS, function(i, key) {
+      var items = details[key] || [];
+      if (!items.length) return;
+      lists += '<div class="mt-1"><b>' + esc(L('iam_sync_count_' + key)) + '</b><ul class="mb-1">' +
+        $.map(items, function(item) { return '<li>' + esc(item) + '</li>'; }).join('') + '</ul></div>';
+    });
+    if (lists !== '') html += '<details class="small mt-1"><summary>' + esc(L('iam_sync_details')) + '</summary>' + lists + '</details>';
+    return html;
+  }
+
+  function render(status) {
+    var c = status.counts || {};
+    var counts = badge(L('iam_sync_accounts'), c.accounts || 0) + badge(L('iam_sync_linked'), c.linked || 0) +
+      badge(L('iam_sync_idp_disabled'), c.idp_disabled || 0, c.idp_disabled ? 'bg-warning text-dark' : null) +
+      badge(L('iam_sync_missing'), c.missing || 0, c.missing ? 'bg-warning text-dark' : null);
+    if (!status.sync_enabled) counts += '<div class="text-muted small mt-1">' + esc(L('iam_sync_off')) + '</div>';
+    $('#iam_sync_counts').html(counts);
+    var rows = $.map(status.runs || [], function(run) {
+      var state = '<span class="badge ' + (STATUS_CLASS[run.status] || 'bg-secondary') + '">' + esc(L('iam_sync_status_' + run.status)) + '</span>';
+      return '<tr><td class="text-nowrap">' + esc(run.started || run.created) + '</td>' +
+        '<td>' + esc(L('iam_sync_mode_' + run.mode)) + (run.requested_by ? '<div class="small text-muted">' + esc(run.requested_by) + '</div>' : '') + '</td>' +
+        '<td>' + state + '</td><td>' + changes(run) + '</td></tr>';
+    });
+    $('#iam_sync_runs tbody').html(rows.length ? rows.join('') : '<tr><td colspan="4" class="text-muted">' + esc(L('iam_sync_none')) + '</td></tr>');
+    return status.runs && status.runs.length && (status.runs[0].status === 'pending' || status.runs[0].status === 'running');
+  }
+
+  function load() {
+    clearTimeout(timer);
+    $.get('/api/v1/get/identity-provider/sync-status', function(status) {
+      if (render(status || {}) && polls++ < POLL_MAX) timer = setTimeout(load, POLL_MS);
+    }, 'json');
+  }
+
+  function request(mode) {
+    $.ajax({
+      type: 'POST',
+      dataType: 'json',
+      url: '/api/v1/edit/identity-provider-sync',
+      data: {items: JSON.stringify(['sync']), attr: JSON.stringify({mode: mode}), csrf_token: csrf_token},
+      success: function(res) {
+        var msg = (res && res[0]) ? res[0] : {type: 'danger', msg: 'generic_server_error'};
+        var key = $.isArray(msg.msg) ? msg.msg[0] : msg.msg;
+        var text = (msg.type === 'success' ? lang_success : lang_danger)[key] || key;
+        mailcow_alert_box(text, msg.type === 'success' ? 'success' : 'danger');
+        polls = 0;
+        load();
+      }
+    });
+  }
+
+  $(document).ready(function() {
+    if (!$('#iam_sync_status').length) return;
+    load();
+    $(document).on('click', '.iam_sync_request', function(e) {
+      e.preventDefault();
+      var mode = $(this).data('mode');
+      if (mode === 'force' && !confirm(L('iam_sync_force_confirm'))) return;
+      request(mode);
+    });
+  });
+
+  return {load: load};
+})(jQuery);

data/web/js/site/mailbox.js

@@ -120,6 +120,10 @@ $(document).ready(function() {
       }
     });
   });
+  // Shared mailboxes need no password, the server sets a random one
+  $('#add_mailbox_shared').on('change', function() {
+    $(this).closest('form').find('input[name="password"], input[name="password2"]').prop('required', !this.checked);
+  });
   // @Open Mailbox add modal
   $('#addMailboxModal').on('show.bs.modal', function(e) {
     $.ajax({
@@ -996,6 +1000,9 @@ jQuery(function($){
               'style="min-width:2em;width:' + item.percent_in_use + '%">' + item.percent_in_use + '%' + '</div></div>'
             };
             item.username = escapeHtml(item.username);
+            if (item.attributes && item.attributes.shared == '1') {
+              item.username += ' <span class="badge bg-secondary">' + escapeHtml(lang.shared_mailbox) + '</span>';
+            }
             item.name = escapeHtml(item.name);
 
             if (Array.isArray(item.tags)){
@@ -1926,6 +1933,12 @@ jQuery(function($){
               '<a href="#" data-action="delete_selected" data-id="single-alias" data-api-url="delete/alias" data-item="' + encodeURIComponent(item.id) + '" class="btn btn-sm btn-xs-lg btn-xs-half btn-danger"><i class="bi bi-trash"></i> ' + lang.remove + '</a>' +
               '</div>';
             item.chkbox = '<input type="checkbox" class="form-check-input" data-id="alias" name="multi_select" value="' + encodeURIComponent(item.id) + '" />';
+            if (item.group_id) {
+              // Distribution address of a group: changed through the group
+              item.action = '<a href="/edit/mailbox-group/' + encodeURIComponent(item.group_id) + '" class="btn btn-sm btn-xs-lg btn-secondary"><i class="bi bi-people"></i> ' +
+                escapeHtml((lang.groups && lang.groups.managed_alias ? lang.groups.managed_alias : '%s').replace('%s', item.group_name)) + '</a>';
+              item.chkbox = '<input type="checkbox" class="form-check-input" disabled />';
+            }
             item.goto = escapeHtml(item.goto.replace(/,/g, " "));
             if (item.public_comment !== null) {
               item.public_comment = escapeHtml(item.public_comment);
@@ -2479,6 +2492,7 @@ jQuery(function($){
   onVisible("[id^=aliasdomain_table]", () => draw_aliasdomain_table());
   onVisible("[id^=sync_job_table]", () => draw_sync_job_table());
   onVisible("[id^=imapsync_source_table]", () => mailcowImapsync.drawSourceTable(role === 'admin' || acl_data.syncjobs === 1));
+  onVisible("[id^=mailbox_group_table]", () => mailcowGroups.drawTable());
   onVisible("[id^=filter_table]", () => draw_filter_table());
   onVisible("[id^=bcc_table]", () => draw_bcc_table());
   onVisible("[id^=recipient_map_table]", () => draw_recipient_map_table());

data/web/json_api.php

@@ -258,6 +258,9 @@ if (isset($_GET['query'])) {
         case "api-key":
           process_add_return(\Mailcow\ApiKey\ApiKeyModule::fromGlobals()->api->addKey($attr));
         break;
+        case "mailbox-group":
+          process_add_return(\Mailcow\MailboxGroup\MailboxGroupModule::fromGlobals()->api->addGroup($attr));
+        break;
         case "domain":
           switch ($object) {
             case "template":
@@ -820,6 +823,22 @@ if (isset($_GET['query'])) {
             }
           break;
 
+          case "mailbox-group":
+            switch ($object) {
+              case "all":
+                process_get_return(\Mailcow\MailboxGroup\MailboxGroupModule::fromGlobals()->api->getGroups($extra));
+              break;
+
+              case "member":
+                process_get_return(\Mailcow\MailboxGroup\MailboxGroupModule::fromGlobals()->api->getMemberships((string)$extra));
+              break;
+
+              default:
+                process_get_return(\Mailcow\MailboxGroup\MailboxGroupModule::fromGlobals()->api->getGroup($object));
+              break;
+            }
+          break;
+
           case "logs":
             switch ($object) {
               case "dovecot":
@@ -1527,12 +1546,17 @@ if (isset($_GET['query'])) {
             process_get_return($score);
           break;
           case "identity-provider":
-            if($_SESSION['mailcow_cc_role'] === 'admin') {
+            if ($object == "sync-status") {
+              process_get_return(\Mailcow\Identity\IdentityModule::fromGlobals()->api->getStatus());
+            } elseif($_SESSION['mailcow_cc_role'] === 'admin') {
               process_get_return($iam_settings);
             } else {
               process_get_return(null);
             }
           break;
+          case "identity-link":
+            process_get_return(\Mailcow\Identity\IdentityModule::fromGlobals()->api->getLink((string)$object));
+          break;
         break;
         // return no route found if no case is matched
         default:
@@ -1726,6 +1750,9 @@ if (isset($_GET['query'])) {
         case "api-key":
           process_delete_return(\Mailcow\ApiKey\ApiKeyModule::fromGlobals()->api->deleteKeys($items));
         break;
+        case "mailbox-group":
+          process_delete_return(\Mailcow\MailboxGroup\MailboxGroupModule::fromGlobals()->api->deleteGroups($items));
+        break;
         case "app-passwd":
           process_delete_return(app_passwd('delete', array('id' => $items)));
         break;
@@ -1825,6 +1852,9 @@ if (isset($_GET['query'])) {
         case "identity-provider":
           process_delete_return(identity_provider('delete'));
         break;
+        case "identity-link":
+          process_delete_return(\Mailcow\Identity\IdentityModule::fromGlobals()->api->unlink($items));
+        break;
         // return no route found if no case is matched
         default:
           http_response_code(404);
@@ -1894,6 +1924,9 @@ if (isset($_GET['query'])) {
         case "api-key":
           process_edit_return(\Mailcow\ApiKey\ApiKeyModule::fromGlobals()->api->editKeys($items, $attr));
         break;
+        case "mailbox-group":
+          process_edit_return(\Mailcow\MailboxGroup\MailboxGroupModule::fromGlobals()->api->editGroups($items, $attr));
+        break;
         case "recipient_map":
           process_edit_return(recipient_map('edit', array_merge(array('id' => $items), $attr)));
         break;
@@ -2081,6 +2114,9 @@ if (isset($_GET['query'])) {
         case "identity-provider-test":
           process_edit_return(identity_provider('test', $attr));
         break;
+        case "identity-provider-sync":
+          process_edit_return(\Mailcow\Identity\IdentityModule::fromGlobals()->api->requestRun($attr));
+        break;
         case "cors":
           process_edit_return(cors('edit', $attr));
         break;

data/web/lang/lang.de-de.json

@@ -11,6 +11,7 @@
         "extend_sender_acl": "Eingabe externer Absenderadressen erlauben",
         "filters": "Filter",
         "login_as": "Einloggen als Mailbox-Benutzer",
+        "mailbox_groups": "Gruppen",
         "mailbox_relayhost": "Relayhost für eine Mailbox setzen",
         "prohibited": "Untersagt durch Richtlinie",
         "protocol_access": "Ändern der erlaubten Protokolle",
@@ -149,6 +150,91 @@
         "credentials_transport_warning": "<b>Warnung</b>: Das Hinzufügen einer neuen Regel bewirkt die Aktualisierung der Authentifizierungsdaten aller vorhandenen Einträge mit identischem Next Hop.",
         "customer_id": "Kunde",
         "customize": "UI-Anpassung",
+        "iam_attribute_field_info": "Optional. LDAP-Attribut, dessen Wert in der Zuordnung unten die Vorlage wählt.",
+        "iam_disabled_filter": "Filter für deaktivierte Benutzer",
+        "iam_disabled_filter_info": "LDAP-Filter für deaktivierte Benutzer. Active-Directory-Konten mit ACCOUNTDISABLE in userAccountControl gelten immer als deaktiviert.",
+        "iam_encryption": "Verschlüsselung",
+        "iam_encryption_info": "StartTLS nutzt den normalen Port (389). SSL (LDAPS) nutzt Port 636, Port 389 wird automatisch umgestellt.",
+        "iam_encryption_none": "Keine",
+        "iam_filter_info": "LDAP-Filter für die Benutzer, die sich anmelden dürfen und synchronisiert werden, z. B. <code>(objectClass=person)</code>.",
+        "iam_group_autocreate": "Gruppen anlegen",
+        "iam_group_autocreate_info": "Legt für jede IdP-Gruppe ohne Gegenstück eine Gruppe an. Die Mail-Adresse der Gruppe wird ihre Adresse, wenn sie frei ist.",
+        "iam_group_basedn": "Gruppen-Base-DN",
+        "iam_group_default_domain": "Standard-Domain für Gruppen",
+        "iam_group_default_domain_info": "Domain neuer Gruppen, deren Mail-Adresse in keiner mailcow-Domain liegt.",
+        "iam_group_filter": "Gruppenfilter",
+        "iam_group_member_attribute": "Mitglieder-Attribut",
+        "iam_group_member_attribute_info": "Nur für \"Mitglieder-Attribut der Gruppen\", z. B. member oder uniqueMember.",
+        "iam_group_member_mode": "Mitgliedschaften",
+        "iam_group_member_mode_ad_chain": "Active Directory inkl. verschachtelter Gruppen",
+        "iam_group_member_mode_member": "Mitglieder-Attribut der Gruppen",
+        "iam_group_member_mode_memberof": "memberOf der Benutzer",
+        "iam_group_name_attribute": "Attribut für Gruppennamen",
+        "iam_group_paths": "Gruppenpfade",
+        "iam_group_paths_info": "Kommagetrennte Keycloak-Gruppenpfade: <code>/Vertrieb</code> oder <code>/mailcow/*</code> für alle Gruppen unter /mailcow. Der mailcow-Client braucht die Berechtigung <code>query-groups</code>.",
+        "iam_group_sync": "Gruppen-Sync",
+        "iam_group_sync_info": "Überträgt die Mitglieder von IdP-Gruppen in Gruppen (Mailboxen → Gruppen). In mailcow hinzugefügte Mitglieder bleiben.",
+        "iam_id_attribute": "ID-Attribut",
+        "iam_id_attribute_info": "Stabile Benutzer-ID. Leer = objectGUID, entryUUID, nsUniqueId oder ipaUniqueID. Eine Änderung verknüpft alle Mailboxen erneut über die E-Mail-Adresse.",
+        "iam_import_users_info": "Legt Postfächer für alle IdP-Benutzer mit passender Vorlage an, ohne auf ihre erste Anmeldung zu warten.",
+        "iam_login_provisioning_info": "Legt das Postfach bei der ersten Anmeldung an, mit passender Vorlage oder der Standard-Vorlage.",
+        "iam_mapping_add": "Zuordnung hinzufügen",
+        "iam_mapping_info": "Der Attributwert eines Benutzers wählt die Vorlage (Keycloak und OIDC: <code>mailcow_template</code>). Vorlagen von Gruppen haben Vorrang.",
+        "iam_offboarding": "Offboarding",
+        "iam_offboarding_info": "Benutzer, die im IdP deaktiviert sind oder in zwei vollständigen Sync-Läufen fehlen, können sich nicht mehr anmelden. Ihre Mailbox empfängt weiter E-Mails. Nur vom Sync gesperrte Mailboxen werden wieder freigegeben.",
+        "iam_offboarding_limit": "Änderungslimit (%)",
+        "iam_offboarding_limit_info": "Sync-Läufe, die mehr Mailboxen sperren oder mehr Gruppenmitgliedschaften entfernen würden als dieser Anteil (mindestens 5), werden blockiert.",
+        "iam_periodic_full_sync_info": "Übernimmt Name und Vorlage bestehender Postfächer aus dem IdP.",
+        "iam_redirect_url_add": "Redirect-URL hinzufügen",
+        "iam_section_connection": "Verbindung",
+        "iam_section_groups": "Gruppen",
+        "iam_section_login": "Anmeldung",
+        "iam_section_sync": "Synchronisation",
+        "iam_section_templates": "Postfach-Vorlagen",
+        "iam_section_users": "Benutzer",
+        "iam_sync_accounts": "IdP-Mailboxen",
+        "iam_sync_changes": "Änderungen",
+        "iam_sync_count_conflicts": "Konflikte",
+        "iam_sync_count_creates": "Angelegt",
+        "iam_sync_count_deactivate": "Login gesperrt",
+        "iam_sync_count_errors": "Fehler",
+        "iam_sync_count_found": "Wieder gefunden",
+        "iam_sync_count_group_creates": "Gruppen angelegt",
+        "iam_sync_count_group_renames": "Gruppen umbenannt",
+        "iam_sync_count_links": "Verknüpft",
+        "iam_sync_count_membership_removals": "Mitgliedschaften entfernt",
+        "iam_sync_count_memberships": "Gruppen mit neuen Mitgliedern",
+        "iam_sync_count_missing": "Fehlend",
+        "iam_sync_count_orphaned_groups": "Gruppen nicht im IdP",
+        "iam_sync_count_release": "Freigegeben",
+        "iam_sync_count_restore": "Login entsperrt",
+        "iam_sync_count_skipped": "Übersprungen",
+        "iam_sync_count_updates": "Aktualisiert",
+        "iam_sync_details": "Details",
+        "iam_sync_force": "Ohne Limit ausführen",
+        "iam_sync_force_confirm": "Sync ohne Änderungslimit ausführen? Dabei können Mailboxen gesperrt und Gruppenmitgliedschaften entfernt werden.",
+        "iam_sync_idp_disabled": "Vom IdP gesperrt",
+        "iam_sync_linked": "Verknüpft",
+        "iam_sync_missing": "Fehlen im IdP",
+        "iam_sync_mode": "Modus",
+        "iam_sync_mode_force": "Ohne Limit",
+        "iam_sync_mode_preview": "Vorschau",
+        "iam_sync_mode_run": "Lauf",
+        "iam_sync_no_changes": "Keine Änderungen",
+        "iam_sync_none": "Noch keine Sync-Läufe.",
+        "iam_sync_off": "Der Sync ist aus. Aktiviere Import, periodischen Sync, Offboarding oder Gruppen-Sync.",
+        "iam_sync_preview": "Vorschau",
+        "iam_sync_result": "Ergebnis",
+        "iam_sync_run": "Jetzt ausführen",
+        "iam_sync_started": "Gestartet",
+        "iam_sync_status": "Sync-Status",
+        "iam_sync_status_blocked": "Blockiert",
+        "iam_sync_status_error": "Fehler",
+        "iam_sync_status_info": "Läufe starten innerhalb einer Minute. Eine Vorschau zeigt die Änderungen, ohne sie auszuführen.",
+        "iam_sync_status_ok": "OK",
+        "iam_sync_status_pending": "Wartet",
+        "iam_sync_status_running": "Läuft",
+        "iam_username_field_info": "Attribut mit der E-Mail-Adresse, sie wird zum Postfachnamen. Standard: mail.",
         "login_page": "Login-Seite",
         "description": "Beschreibung",
         "destination": "Ziel",
@@ -217,7 +303,7 @@
         "iam_default_template": "Standardvorlage",
         "iam_default_template_description": "Falls für einen Benutzer kein Template hinterlegt ist, wird die Standardvorlage zum Erstellen der Mailbox verwendet, jedoch nicht zum Aktualisieren der Mailbox.",
         "iam_description": "Konfiguriere einen externen Identity Provider für die Authentifizierung<br>Die Mailboxen der Benutzer werden bei ihrer ersten Anmeldung automatisch erstellt, vorausgesetzt, dass ein Attribut Mapping festgelegt wurde.",
-        "iam_extra_permission": "Damit die folgenden Einstellungen funktionieren, benötigt der mailcow Client in Keycloak ein <code>Service-Konto</code> und die Berechtigung <code>view-users</code>.",
+        "iam_extra_permission": "Damit die folgenden Einstellungen funktionieren, benötigt der mailcow Client in Keycloak ein <code>Service-Konto</code> und die Berechtigung <code>view-users</code> (Gruppen-Sync: zusätzlich <code>query-groups</code>).",
         "iam_host": "Host",
         "iam_host_info": "Gib einen oder mehrere LDAP-Hosts ein, getrennt durch Kommas.",
         "iam_import_users": "Importiere Benutzer",
@@ -420,6 +506,7 @@
         "alias_domain_invalid": "Alias-Domain %s ist ungültig",
         "alias_empty": "Alias-Adresse darf nicht leer sein",
         "alias_goto_identical": "Alias- und Ziel-Adresse dürfen nicht identisch sein",
+        "alias_group_managed": "Alias %s gehört zu einer Gruppe und kann nur dort geändert werden",
         "alias_invalid": "Alias-Adresse %s ist ungültig",
         "aliasd_targetd_identical": "Alias-Domain darf nicht gleich Ziel-Domain sein: %s",
         "aliases_in_use": "Maximale Anzahl an Aliassen muss größer oder gleich %d sein",
@@ -461,7 +548,17 @@
         "global_map_write_error": "Kann globale Map ID %s nicht schreiben: %s",
         "goto_empty": "Eine Alias-Adresse muss auf mindestens eine gültige Ziel-Adresse zeigen",
         "goto_invalid": "Ziel-Adresse %s ist ungültig",
+        "group_address_invalid": "Gruppenadresse %s ist ungültig oder liegt nicht in der Domain der Gruppe",
+        "group_description_invalid": "Die Beschreibung der Gruppe darf höchstens 255 Zeichen lang sein",
+        "group_grant_invalid": "Ungültige Freigabe für Mailbox %s",
+        "group_member_idp": "%s ist über den Identity Provider Mitglied und kann nur dort entfernt werden",
+        "group_member_invalid": "%s ist kein Postfach und kann nicht Mitglied einer Gruppe werden",
+        "group_name_invalid": "Der Gruppenname ist ungültig (1-100 Zeichen)",
+        "group_priority_invalid": "Die Priorität muss eine Zahl sein",
+        "group_send_as_invalid": "Send-as-Adresse %s ist ungültig oder unbekannt",
         "ham_learn_error": "Ham-Lernfehler: %s",
+        "iam_sync_mode_invalid": "Ungültiger Sync-Modus",
+        "iam_sync_unavailable": "Der Identity Provider kann nicht synchronisiert werden (nur Keycloak und LDAP)",
         "iam_test_connection": "Verbindung fehlgeschlagen",
         "imagick_exception": "Fataler Bildverarbeitungsfehler",
         "img_dimensions_exceeded": "Grafik überschreitet die maximale Bildgröße",
@@ -523,6 +620,7 @@
         "recipient_map_entry_exists": "Eine Empfängerumschreibung für Objekt \"%s\" existiert bereits",
         "recovery_email_failed": "E-Mail zur Wiederherstellung konnte nicht gesendet werden. Bitte wenden Sie sich an Ihren Administrator.",
         "redis_error": "Redis Fehler: %s",
+        "refresh_login_failed": "Die Sitzung konnte nicht verlängert werden. Bitte melden Sie sich erneut an.",
         "relayhost_invalid": "Map-Eintrag %s ist ungültig",
         "release_send_failed": "Die Nachricht konnte nicht versendet werden: %s",
         "reset_f2b_regex": "Regex-Filter konnten nicht in vorgegebener Zeit zurückgesetzt werden, bitte erneut versuchen oder die Webseite neu laden.",
@@ -720,6 +818,12 @@
         "generate": "generieren",
         "grant_types": "Grant-types",
         "hostname": "Servername",
+        "iam_idp_disabled": "Login vom IdP-Sync gesperrt",
+        "iam_link": "IdP-Verknüpfung",
+        "iam_link_info": "Die Mailbox gehört zu diesem IdP-Benutzer. Löse die Verknüpfung, wenn die Adresse an einen anderen IdP-Benutzer vergeben wurde; sie wird dann erneut über die E-Mail-Adresse verknüpft.",
+        "iam_missing_since": "Fehlt im IdP seit",
+        "iam_not_linked": "Noch nicht verknüpft",
+        "iam_unlink": "Verknüpfung lösen",
         "inactive": "Inaktiv",
         "internal": "Intern",
         "internal_info": "Interne Aliasse sind nur von der eigenen Domäne oder Alias-Domänen erreichbar.",
@@ -837,6 +941,57 @@
         "restarting_container": "Container wird neugestartet, bitte warten...",
         "hibp_check": "Gegen haveibeenpwned.com prüfen"
     },
+    "groups": {
+        "active": "Aktiv",
+        "add": "Gruppe hinzufügen",
+        "address": "Gruppenadresse",
+        "address_hint": "Optional. Mails an diese Adresse gehen an alle Mitglieder.",
+        "description": "Beschreibung",
+        "domain": "Domain",
+        "effective_template": "Template aus Gruppen",
+        "grant_add": "Hinzufügen",
+        "grant_folder": "Ordner-ID in SOGo, personal = Standardordner",
+        "grant_owner": "Mailbox",
+        "grant_state_applied": "Aktiv",
+        "grant_state_failed": "Fehlgeschlagen",
+        "grant_state_pending": "Ausstehend",
+        "grant_subscribe": "Abonnieren",
+        "grant_subscribe_imap_hint": "Abonniert die Ordner der Mailbox innerhalb einer Minute bei jedem Mitglied, damit Mailprogramme sie anzeigen. Einmalig: Wer sie abbestellt, behält das so",
+        "grant_subscribe_sogo_hint": "Fügt den Ordner innerhalb einer Minute bei jedem Mitglied in SOGo hinzu, einmalig: Wer ihn entfernt, bekommt ihn nicht erneut",
+        "group": "Gruppe",
+        "groups": "Gruppen",
+        "idp": "IdP",
+        "idp_member": "Vom Identity Provider synchronisiert, nur dort änderbar",
+        "idp_ref": "IdP-Gruppe",
+        "imap_grants": "Postfachzugriff",
+        "imap_grants_hint": "Mitglieder öffnen diese Mailboxen in ihrem Mailprogramm (Ordner Shared/<mailbox>). Lesen: lesen und als gelesen markieren. Schreiben: zusätzlich ablegen, verschieben und löschen. Vollzugriff: zusätzlich Ordner löschen. Team-Postfächer ohne eigenen Login als geteiltes Postfach markieren.",
+        "info": "Gruppen bündeln Postfächer. Eine Gruppe kann eine eigene Adresse haben: ein Alias, der automatisch an alle Mitglieder zustellt (in Exchange: Verteilerliste). Mitglieder können als andere Adressen senden, auf freigegebene Postfächer, Kalender und Adressbücher zugreifen und ein Postfach-Template erhalten. Vom Identity Provider synchronisierte Mitglieder sind mit IdP markiert.",
+        "internal": "Nur Mails von Absendern der Domain annehmen",
+        "list_error": "Gruppen konnten nicht geladen werden",
+        "managed_alias": "Wird von Gruppe %s verwaltet",
+        "members": "Mitglieder",
+        "memberships": "Gruppenmitgliedschaften",
+        "name": "Name",
+        "no_memberships": "In keiner Gruppe",
+        "priority": "Priorität",
+        "reapply_template": "Template erneut auf alle Mitglieder anwenden",
+        "rights_full": "Vollzugriff",
+        "rights_read": "Lesen",
+        "rights_write": "Schreiben",
+        "send_as": "Senden als",
+        "send_as_groups": "Darf senden als (über Gruppen)",
+        "send_as_hint": "Adressen (Postfach oder Alias) oder @domain, als die die Mitglieder senden dürfen, eine pro Zeile.",
+        "sender_allowed": "Mitglieder dürfen als Gruppenadresse senden",
+        "sogo_grants": "Kalender und Adressbücher",
+        "sogo_grants_hint": "Mitglieder erhalten Zugriff auf den SOGo-Ordner der Mailbox. Mit \"Abonnieren\" erscheint er automatisch in ihrem SOGo, sonst abonnieren sie ihn selbst. Ausstehend: Die Mailbox hat SOGo noch nicht geöffnet.",
+        "sogo_visible": "Gruppenadresse in SOGo als Identität anzeigen",
+        "template": "Mailbox-Template",
+        "template_hint": "Wird auf alle Mitglieder angewendet. Ist ein Postfach in mehreren Gruppen, gilt das Template der Gruppe mit der höchsten Priorität.",
+        "template_none": "Kein Template",
+        "type_calendar": "Kalender",
+        "type_contacts": "Adressbuch",
+        "view": "Ansehen"
+    },
     "header": {
         "administration": "Server-Konfiguration",
         "apps": "Apps",
@@ -998,6 +1153,8 @@
         "running": "In Ausführung",
         "set_postfilter": "Als Postfilter markieren",
         "set_prefilter": "Als Prefilter markieren",
+        "shared_mailbox": "Geteiltes Postfach",
+        "shared_mailbox_info": "Kein eigener Login (IMAP, SMTP, SOGo, ActiveSync, App-Passwörter, mailcow-UI). Es empfängt Mails, Gruppenmitglieder öffnen es über Freigaben. Kein Passwort nötig.",
         "sieve_info": "Es können mehrere Filter pro Benutzer existieren, aber nur ein Filter eines Typs (Pre-/Postfilter) kann gleichzeitig aktiv sein.<br>\r\nDie Ausführung erfolgt in nachstehender Reihenfolge. Ein fehlgeschlagenes Script sowie der Befehl \"keep;\" stoppen die weitere Verarbeitung <b>nicht</b>. Änderungen an globalen Sieve-Filtern bewirken einen Neustart von Dovecot.<br><br>Global sieve prefilter &#8226; Prefilter &#8226; User scripts &#8226; Postfilter &#8226; Global sieve postfilter",
         "sieve_preset_1": "E-Mails mit potenziell gefährlichen Dateitypen abweisen",
         "sieve_preset_2": "E-Mail eines bestimmten Absenders immer als gelesen markieren",
@@ -1173,7 +1330,12 @@
         "forwarding_host_added": "Weiterleitungs-Host %s wurde hinzugefügt",
         "forwarding_host_removed": "Weiterleitungs-Host %s wurde entfernt",
         "global_filter_written": "Filterdatei wurde erfolgreich geschrieben",
+        "group_added": "Gruppe %s wurde hinzugefügt",
+        "group_modified": "Änderungen an Gruppe %s wurden gespeichert",
+        "group_removed": "Gruppe %s wurde entfernt",
         "hash_deleted": "Hash wurde gelöscht",
+        "iam_link_removed": "IdP-Verknüpfung von %s gelöst",
+        "iam_sync_requested": "Sync-Lauf eingereiht, er startet innerhalb einer Minute",
         "iam_test_connection": "Verbindung erfolgreich",
         "ip_check_opt_in_modified": "IP Check wurde erfolgreich gespeichert",
         "item_deleted": "Objekt %s wurde entfernt",
@@ -1554,6 +1716,11 @@
         "domain_added_sogo_failed": "Domain wurde hinzugefügt, aber SOGo konnte nicht neugestartet werden",
         "dovecot_restart_failed": "Dovecot wurde nicht erfolgreich neu gestartet, bitte prüfen Sie die Logs.",
         "fuzzy_learn_error": "Fuzzy-Lernfehler: %s",
+        "group_imap_grant_failed": "Der Postfachzugriff auf %s konnte in Dovecot noch nicht gesetzt werden, er wird alle 15 Minuten erneut versucht",
+        "group_sogo_init_failed": "Die SOGo-Ordner von %s konnten noch nicht angelegt werden, es wird alle 15 Minuten erneut versucht",
+        "group_subscription_failed": "Abonnement für %s fehlgeschlagen, es wird automatisch erneut versucht",
+        "group_template_failed": "Template %s konnte nicht auf %s angewendet werden",
+        "group_too_many_members": "Gruppe %s hat mehr als %s Mitglieder. Postfix stellt Mails an eine Adresse höchstens an so viele Empfänger zu.",
         "hash_not_found": "Hash nicht gefunden. Möglicherweise wurde dieser bereits gelöscht.",
         "ip_invalid": "Ungültige IP übersprungen: %s",
         "is_not_primary_alias": "Überspringe nicht-primären Alias %s",

data/web/lang/lang.en-gb.json

@@ -11,6 +11,7 @@
         "extend_sender_acl": "Allow to extend sender ACL by external addresses",
         "filters": "Filters",
         "login_as": "Login as mailbox user",
+        "mailbox_groups": "Groups",
         "mailbox_relayhost": "Change relayhost for a mailbox",
         "prohibited": "Prohibited by ACL",
         "protocol_access": "Change protocol access",
@@ -146,6 +147,91 @@
         "ays": "Are you sure you want to proceed?",
         "ban_list_info": "See a list of banned IPs below: <b>network (remaining ban time) - [actions]</b>.<br />IPs queued to be unbanned will be removed from the active ban list within a few seconds.<br />Red labels indicate active permanent bans by denylisting.",
         "change_logo": "Change logo",
+        "iam_attribute_field_info": "Optional. LDAP attribute whose value selects the template in the mapping below.",
+        "iam_disabled_filter": "Disabled filter",
+        "iam_disabled_filter_info": "LDAP filter for disabled users. Active Directory accounts with ACCOUNTDISABLE in userAccountControl always count as disabled.",
+        "iam_encryption": "Encryption",
+        "iam_encryption_info": "StartTLS uses the normal port (389). SSL (LDAPS) uses port 636, port 389 is changed automatically.",
+        "iam_encryption_none": "None",
+        "iam_filter_info": "LDAP filter for the users that may log in and are synced, e.g. <code>(objectClass=person)</code>.",
+        "iam_group_autocreate": "Create groups",
+        "iam_group_autocreate_info": "Creates a mailbox group for every IdP group that has none yet. The group mail becomes its address if it is free.",
+        "iam_group_basedn": "Group Base DN",
+        "iam_group_default_domain": "Default group domain",
+        "iam_group_default_domain_info": "Domain of new groups whose mail is not in a mailcow domain.",
+        "iam_group_filter": "Group filter",
+        "iam_group_member_attribute": "Member attribute",
+        "iam_group_member_attribute_info": "Only for \"Member attribute of the groups\", e.g. member or uniqueMember.",
+        "iam_group_member_mode": "Memberships",
+        "iam_group_member_mode_ad_chain": "Active Directory incl. nested groups",
+        "iam_group_member_mode_member": "Member attribute of the groups",
+        "iam_group_member_mode_memberof": "memberOf of the users",
+        "iam_group_name_attribute": "Group name attribute",
+        "iam_group_paths": "Group paths",
+        "iam_group_paths_info": "Comma-separated Keycloak group paths: <code>/Sales</code> or <code>/mailcow/*</code> for all groups below /mailcow. The mailcow client needs the <code>query-groups</code> permission.",
+        "iam_group_sync": "Group sync",
+        "iam_group_sync_info": "Syncs the members of IdP groups to mailbox groups (Mailboxes → Groups). Members added in mailcow stay.",
+        "iam_id_attribute": "ID attribute",
+        "iam_id_attribute_info": "Stable user ID. Empty = objectGUID, entryUUID, nsUniqueId or ipaUniqueID. Changing it links all mailboxes again by email.",
+        "iam_import_users_info": "Creates mailboxes for all users of the IdP with a matching template, without waiting for their first login.",
+        "iam_login_provisioning_info": "Creates the mailbox at the first login of a user, with a matching or the default template.",
+        "iam_mapping_add": "Add mapping",
+        "iam_mapping_info": "The attribute value of a user selects the template (Keycloak and OIDC: <code>mailcow_template</code>). Templates of groups take precedence.",
+        "iam_offboarding": "Offboarding",
+        "iam_offboarding_info": "Users disabled in the IdP or missing in two complete sync runs cannot log in anymore. Their mailbox still receives mail. Only mailboxes disabled by the sync are enabled again.",
+        "iam_offboarding_limit": "Change limit (%)",
+        "iam_offboarding_limit_info": "Sync runs that would disable more mailboxes or remove more group memberships than this share (at least 5) are blocked.",
+        "iam_periodic_full_sync_info": "Updates name and template of existing mailboxes from the IdP.",
+        "iam_redirect_url_add": "Add redirect URL",
+        "iam_section_connection": "Connection",
+        "iam_section_groups": "Groups",
+        "iam_section_login": "Login",
+        "iam_section_sync": "Synchronization",
+        "iam_section_templates": "Mailbox templates",
+        "iam_section_users": "Users",
+        "iam_sync_accounts": "IdP mailboxes",
+        "iam_sync_changes": "Changes",
+        "iam_sync_count_conflicts": "Conflicts",
+        "iam_sync_count_creates": "Created",
+        "iam_sync_count_deactivate": "Login disabled",
+        "iam_sync_count_errors": "Errors",
+        "iam_sync_count_found": "Found again",
+        "iam_sync_count_group_creates": "Groups created",
+        "iam_sync_count_group_renames": "Groups renamed",
+        "iam_sync_count_links": "Linked",
+        "iam_sync_count_membership_removals": "Memberships removed",
+        "iam_sync_count_memberships": "Groups with new members",
+        "iam_sync_count_missing": "Missing",
+        "iam_sync_count_orphaned_groups": "Groups not in IdP",
+        "iam_sync_count_release": "Released",
+        "iam_sync_count_restore": "Login enabled",
+        "iam_sync_count_skipped": "Skipped",
+        "iam_sync_count_updates": "Updated",
+        "iam_sync_details": "Details",
+        "iam_sync_force": "Run without limit",
+        "iam_sync_force_confirm": "Run the sync without the change limit? Mailboxes may be disabled and group memberships removed.",
+        "iam_sync_idp_disabled": "Disabled by IdP",
+        "iam_sync_linked": "Linked",
+        "iam_sync_missing": "Missing in IdP",
+        "iam_sync_mode": "Mode",
+        "iam_sync_mode_force": "Without limit",
+        "iam_sync_mode_preview": "Preview",
+        "iam_sync_mode_run": "Run",
+        "iam_sync_no_changes": "No changes",
+        "iam_sync_none": "No sync runs yet.",
+        "iam_sync_off": "The sync is off. Enable import, periodic sync, offboarding or group sync.",
+        "iam_sync_preview": "Preview",
+        "iam_sync_result": "Result",
+        "iam_sync_run": "Run now",
+        "iam_sync_started": "Started",
+        "iam_sync_status": "Sync status",
+        "iam_sync_status_blocked": "Blocked",
+        "iam_sync_status_error": "Error",
+        "iam_sync_status_info": "Runs start within a minute. A preview shows the changes without applying them.",
+        "iam_sync_status_ok": "OK",
+        "iam_sync_status_pending": "Queued",
+        "iam_sync_status_running": "Running",
+        "iam_username_field_info": "Attribute with the email address, it becomes the mailbox name. Default: mail.",
         "logo_normal_label": "Normal",
         "logo_dark_label": "Inverted for dark mode",
         "configuration": "Configuration",
@@ -224,7 +310,7 @@
         "iam_default_template": "Default Template",
         "iam_default_template_description": "If no template is assigned to a user, the default template will be used for creating the mailbox, but not for updating the mailbox.",
         "iam_description": "Configure an external Provider for Authentication<br>User's mailboxes will be automatically created upon their first login, provided that an attribute mapping has been set.",
-        "iam_extra_permission": "For the following settings to work, the mailcow client in Keycloak needs a <code>Service account</code> and the permission to <code>view-users</code>.",
+        "iam_extra_permission": "For the following settings to work, the mailcow client in Keycloak needs a <code>Service account</code> and the permission to <code>view-users</code> (group sync: also <code>query-groups</code>).",
         "iam_host": "Host",
         "iam_host_info": "Enter one or more LDAP hosts, separated by commas.",
         "iam_import_users": "Import Users",
@@ -417,10 +503,21 @@
     },
     "danger": {
         "access_denied": "Access denied or invalid form data",
+        "alias_group_managed": "Alias %s belongs to a group and can only be changed there",
         "api_key_access_invalid": "Invalid API access type, allowed values are ro and rw",
         "api_key_description_invalid": "API key description must not exceed 255 characters",
         "api_key_network_invalid": "Invalid IP address or network: %s",
         "api_key_service_locked": "API key %s is defined in mailcow.conf and can only be changed there",
+        "group_address_invalid": "Group address %s is invalid or not in the domain of the group",
+        "group_description_invalid": "The group description must not exceed 255 characters",
+        "group_grant_invalid": "Invalid share for mailbox %s",
+        "group_member_idp": "%s is a member through the identity provider and can only be removed there",
+        "group_member_invalid": "%s is not a mailbox and cannot be a group member",
+        "group_name_invalid": "Group name is invalid (1-100 characters)",
+        "group_priority_invalid": "The priority must be a number",
+        "group_send_as_invalid": "Send-as address %s is invalid or unknown",
+        "iam_sync_mode_invalid": "Invalid sync mode",
+        "iam_sync_unavailable": "The identity provider cannot be synced (Keycloak and LDAP only)",
         "tfa_removal_blocked": "Two-factor authentication cannot be removed because it is required for your account.",
         "alias_domain_invalid": "Alias domain %s is invalid",
         "alias_empty": "Alias address must not be empty",
@@ -524,6 +621,7 @@
         "recipient_map_entry_exists": "A Recipient map entry \"%s\" exists",
         "recovery_email_failed": "Could not send a recovery email. Please contact your administrator.",
         "redis_error": "Redis error: %s",
+        "refresh_login_failed": "The session could not be refreshed. Please log in again.",
         "relayhost_invalid": "Map entry %s is invalid",
         "release_send_failed": "Message could not be released: %s",
         "required_data_missing": "Required data %s is missing",
@@ -720,6 +818,12 @@
         "generate": "generate",
         "grant_types": "Grant types",
         "hostname": "Hostname",
+        "iam_idp_disabled": "Login disabled by the IdP sync",
+        "iam_link": "IdP link",
+        "iam_link_info": "The mailbox is bound to this IdP user. Unlink it when the address was given to another IdP user; it is linked again by email.",
+        "iam_missing_since": "Missing in the IdP since",
+        "iam_not_linked": "Not linked yet",
+        "iam_unlink": "Unlink",
         "inactive": "Inactive",
         "internal": "Internal",
         "internal_info": "Internal aliases are only accessible from the own domain or alias domains.",
@@ -837,6 +941,57 @@
         "restart_now": "Restart now",
         "restarting_container": "Restarting container, this may take a while"
     },
+    "groups": {
+        "active": "Active",
+        "add": "Add group",
+        "address": "Group address",
+        "address_hint": "Optional. Mail to this address is delivered to all members.",
+        "description": "Description",
+        "domain": "Domain",
+        "effective_template": "Template from groups",
+        "grant_add": "Add",
+        "grant_folder": "Folder ID in SOGo, personal = default folder",
+        "grant_owner": "Mailbox",
+        "grant_state_applied": "Active",
+        "grant_state_failed": "Failed",
+        "grant_state_pending": "Pending",
+        "grant_subscribe": "Subscribe",
+        "grant_subscribe_imap_hint": "Subscribes the folders of the mailbox for every member within a minute, so mail clients show them. Once: a member who unsubscribes keeps it that way",
+        "grant_subscribe_sogo_hint": "Adds the folder to the SOGo of every member within a minute, once: a member who removes it keeps it removed",
+        "group": "Group",
+        "groups": "Groups",
+        "idp": "IdP",
+        "idp_member": "Synced from the identity provider, can only be changed there",
+        "idp_ref": "IdP group",
+        "imap_grants": "Mailbox access",
+        "imap_grants_hint": "Members open these mailboxes in their mail client (folder Shared/<mailbox>). Read: read and mark as read. Write: also file, move and delete mails. Full access: also delete folders. For team mailboxes without a login of their own, mark the mailbox as shared mailbox.",
+        "info": "Groups bundle mailboxes. A group can have its own address: an alias that delivers to all members automatically (in Exchange: distribution list). Members can send as other addresses, access shared mailboxes, calendars and address books and get a mailbox template. Members synced from the identity provider are marked IdP.",
+        "internal": "Only accept mail from senders of the domain",
+        "list_error": "Groups could not be loaded",
+        "managed_alias": "Managed by group %s",
+        "members": "Members",
+        "memberships": "Group memberships",
+        "name": "Name",
+        "no_memberships": "Not a member of any group",
+        "priority": "Priority",
+        "reapply_template": "Apply the template to all members again",
+        "rights_full": "Full access",
+        "rights_read": "Read",
+        "rights_write": "Write",
+        "send_as": "Send as",
+        "send_as_groups": "May send as (through groups)",
+        "send_as_hint": "Addresses (mailbox or alias) or @domain the members may send as, one per line.",
+        "sender_allowed": "Members may send as the group address",
+        "sogo_grants": "Calendars and address books",
+        "sogo_grants_hint": "Members get access to the SOGo folder of the mailbox. With \"Subscribe\" it appears in their SOGo automatically, otherwise they subscribe to it themselves. Pending: the mailbox has not opened SOGo yet.",
+        "sogo_visible": "Show the group address as identity in SOGo",
+        "template": "Mailbox template",
+        "template_hint": "Applied to all members. A mailbox in several groups gets the template of the group with the highest priority.",
+        "template_none": "No template",
+        "type_calendar": "Calendar",
+        "type_contacts": "Address book",
+        "view": "View"
+    },
     "header": {
         "administration": "Configuration & Details",
         "apps": "Apps",
@@ -1007,6 +1162,8 @@
         "sender": "Sender",
         "set_postfilter": "Mark as postfilter",
         "set_prefilter": "Mark as prefilter",
+        "shared_mailbox": "Shared mailbox",
+        "shared_mailbox_info": "No login of its own (IMAP, SMTP, SOGo, ActiveSync, app passwords, mailcow UI). It receives mail, members of groups open it through shares. No password needed.",
         "sieve_info": "You can store multiple filters per user, but only one prefilter and one postfilter can be active at the same time.<br>\r\nEach filter will be processed in the described order. Neither a failed script nor an issued \"keep;\" will stop processing of further scripts. Changes to global sieve scripts will trigger a restart of Dovecot.<br><br>Global sieve prefilter &#8226; Prefilter &#8226; User scripts &#8226; Postfilter &#8226; Global sieve postfilter",
         "sieve_preset_1": "Discard mail with probable dangerous file types",
         "sieve_preset_2": "Always mark the e-mail of a specific sender as seen",
@@ -1180,7 +1337,12 @@
         "forwarding_host_added": "Forwarding host %s has been added",
         "forwarding_host_removed": "Forwarding host %s has been removed",
         "global_filter_written": "Filter was successfully written to file",
+        "group_added": "Group %s has been added",
+        "group_modified": "Changes to group %s have been saved",
+        "group_removed": "Group %s has been removed",
         "hash_deleted": "Hash deleted",
+        "iam_link_removed": "IdP link of %s removed",
+        "iam_sync_requested": "Sync run queued, it starts within a minute",
         "iam_test_connection": "Connection successful",
         "ip_check_opt_in_modified": "IP check was saved successfully",
         "item_deleted": "Item %s successfully deleted",
@@ -1561,6 +1723,11 @@
         "domain_added_sogo_failed": "Added domain but failed to restart SOGo, please check your server logs.",
         "dovecot_restart_failed": "Dovecot failed to restart, please check the logs",
         "fuzzy_learn_error": "Fuzzy hash learn error: %s",
+        "group_imap_grant_failed": "Mailbox access to %s could not be set in Dovecot yet, it is retried every 15 minutes",
+        "group_sogo_init_failed": "The SOGo folders of %s could not be created yet, it is retried every 15 minutes",
+        "group_subscription_failed": "Subscription for %s failed, it is retried automatically",
+        "group_template_failed": "Template %s could not be applied to %s",
+        "group_too_many_members": "Group %s has more than %s members. Postfix delivers mail to an address to at most that many recipients.",
         "hash_not_found": "Hash not found or already deleted",
         "ip_invalid": "Skipped invalid IP: %s",
         "is_not_primary_alias": "Skipped non-primary alias %s",

data/web/templates/admin/iam-redirect-urls.twig

@@ -0,0 +1,41 @@
+{# Redirect URLs of the OIDC forms (iam_form = keycloak|generic); row markup is used by addRedirectUrlRow() in admin.js #}
+          <div class="row mb-2">
+            <div class="col-md-3 d-flex align-items-center justify-content-md-end">
+              <label class="control-label">{{ lang.admin.iam_redirect_url }}:</label>
+            </div>
+            <div class="col-12 col-md-9 col-lg-4">
+              <div class="row mx-0 align-items-center">
+                <span class="col-10 p-0 pe-2">
+                  <input type="text" class="form-control" name="redirect_url" value="{{ iam_settings.redirect_url }}" required>
+                </span>
+                <div class="col-2 p-0 d-flex">
+                  <button class="btn btn-sm d-block d-sm-inline btn-secondary ms-auto iam_redirect_add_{{ iam_form }}" title="{{ lang.admin.iam_redirect_url_add }}"><i class="bi bi-plus-lg"></i></button>
+                </div>
+              </div>
+            </div>
+          </div>
+          <div class="row mb-2" id="iam_{{ iam_form }}_redirect_list">
+            <input type="hidden" name="redirect_url_extra" value="">
+            {% for key, url in iam_settings.redirect_url_extra %}
+            <div class="offset-md-3 col-12 col-md-9 col-lg-4 mb-2">
+              <div class="row mx-0">
+                <div class="col-10 p-0 pe-2">
+                  <input type="text" class="form-control me-2" name="redirect_url_extra" value="{{ iam_settings.redirect_url_extra[key] }}">
+                </div>
+                <div class="col-2 p-0 d-flex">
+                  <button class="iam_{{ iam_form }}_redirect_del btn btn-sm d-block d-sm-inline btn-secondary ms-auto"><i class="bi bi-x-lg"></i></button>
+                </div>
+              </div>
+            </div>
+            {% endfor %}
+            <div class="offset-md-3 col-12 col-md-9 col-lg-4 mb-2">
+              <div class="row mx-0">
+                <div class="col-10 p-0 pe-2">
+                  <input type="text" class="form-control me-2" name="redirect_url_extra" value="">
+                </div>
+                <div class="col-2 p-0 d-flex">
+                  <button class="iam_{{ iam_form }}_redirect_del btn btn-sm d-block d-sm-inline btn-secondary ms-auto"><i class="bi bi-x-lg"></i></button>
+                </div>
+              </div>
+            </div>
+          </div>

data/web/templates/admin/iam-sync-settings.twig

@@ -0,0 +1,153 @@
+{# Sync and group settings of the Keycloak and LDAP forms (iam_form = keycloak|ldap) #}
+          <legend class="fs-5 mt-4"><i class="bi bi-arrow-repeat"></i> {{ lang.admin.iam_section_sync }}</legend><hr>
+          {% if iam_form == 'keycloak' %}
+          <div class="row mb-2">
+            <div class="offset-md-3 col-12 col-md-9">
+              <small class="text-muted">{{ lang.admin.iam_extra_permission|raw }}</small>
+            </div>
+          </div>
+          {% endif %}
+          <div class="row mb-2">
+            <div class="col-md-3 d-flex align-items-center justify-content-md-end">
+              <i style="font-size: 16px; cursor: pointer;" class="bi bi-patch-question-fill mx-2 ms-0" data-bs-toggle="tooltip" data-bs-html="true" data-bs-placement="bottom" title="{{ lang.admin.iam_import_users_info }}"></i>
+              <label class="control-label">{{ lang.admin.iam_import_users }}</label>
+            </div>
+            <div class="col-12 col-md-9 d-flex align-items-center">
+              <div class="form-check form-switch">
+                <input class="form-check-input" type="checkbox" role="switch" name="import_users" value="1" {% if iam_settings.import_users == 1 %}checked{% endif %}>
+              </div>
+            </div>
+          </div>
+          <div class="row mb-2">
+            <div class="col-md-3 d-flex align-items-center justify-content-md-end">
+              <i style="font-size: 16px; cursor: pointer;" class="bi bi-patch-question-fill mx-2 ms-0" data-bs-toggle="tooltip" data-bs-html="true" data-bs-placement="bottom" title="{{ lang.admin.iam_periodic_full_sync_info }}"></i>
+              <label class="control-label">{{ lang.admin.iam_periodic_full_sync }}</label>
+            </div>
+            <div class="col-12 col-md-9 d-flex align-items-center">
+              <div class="form-check form-switch">
+                <input class="form-check-input" type="checkbox" role="switch" name="periodic_sync" value="1" {% if iam_settings.periodic_sync == 1 %}checked{% endif %}>
+              </div>
+            </div>
+          </div>
+          <div class="row mb-2">
+            <div class="col-md-3 d-flex align-items-center justify-content-md-end">
+              <i style="font-size: 16px; cursor: pointer;" class="bi bi-patch-question-fill mx-2 ms-0" data-bs-toggle="tooltip" data-bs-html="true" data-bs-placement="bottom" title="{{ lang.admin.iam_offboarding_info }}"></i>
+              <label class="control-label">{{ lang.admin.iam_offboarding }}</label>
+            </div>
+            <div class="col-12 col-md-9 d-flex align-items-center">
+              <div class="form-check form-switch">
+                <input class="form-check-input" type="checkbox" role="switch" name="offboarding" value="1" {% if iam_settings.offboarding == 1 %}checked{% endif %}>
+              </div>
+            </div>
+          </div>
+          <div class="row mb-2">
+            <div class="col-md-3 d-flex align-items-center justify-content-md-end">
+              <label class="control-label">{{ lang.admin.iam_sync_interval }}:</label>
+            </div>
+            <div class="col-12 col-md-9 col-lg-4">
+              <input class="form-control" type="number" min="1" name="sync_interval" style="width: 80px;" value="{{ iam_settings.sync_interval ?: 15 }}">
+            </div>
+          </div>
+          <div class="row mb-2">
+            <div class="col-md-3 d-flex align-items-center justify-content-md-end">
+              <i style="font-size: 16px; cursor: pointer;" class="bi bi-patch-question-fill mx-2 ms-0" data-bs-toggle="tooltip" data-bs-html="true" data-bs-placement="bottom" title="{{ lang.admin.iam_offboarding_limit_info }}"></i>
+              <label class="control-label">{{ lang.admin.iam_offboarding_limit }}:</label>
+            </div>
+            <div class="col-12 col-md-9 col-lg-4">
+              <input class="form-control" type="number" min="0" max="100" name="offboarding_limit" style="width: 80px;" value="{{ iam_settings.offboarding_limit ?? 10 }}">
+            </div>
+          </div>
+          <legend class="fs-5 mt-4"><i class="bi bi-people"></i> {{ lang.admin.iam_section_groups }}</legend><hr>
+          <div class="row mb-2">
+            <div class="col-md-3 d-flex align-items-center justify-content-md-end">
+              <i style="font-size: 16px; cursor: pointer;" class="bi bi-patch-question-fill mx-2 ms-0" data-bs-toggle="tooltip" data-bs-html="true" data-bs-placement="bottom" title="{{ lang.admin.iam_group_sync_info }}"></i>
+              <label class="control-label">{{ lang.admin.iam_group_sync }}</label>
+            </div>
+            <div class="col-12 col-md-9 d-flex align-items-center">
+              <div class="form-check form-switch">
+                <input class="form-check-input" type="checkbox" role="switch" name="group_sync" value="1" {% if iam_settings.group_sync == 1 %}checked{% endif %}>
+              </div>
+            </div>
+          </div>
+          {% if iam_form == 'keycloak' %}
+          <div class="row mb-2">
+            <div class="col-md-3 d-flex align-items-center justify-content-md-end">
+              <i style="font-size: 16px; cursor: pointer;" class="bi bi-patch-question-fill mx-2 ms-0" data-bs-toggle="tooltip" data-bs-html="true" data-bs-placement="bottom" title="{{ lang.admin.iam_group_paths_info }}"></i>
+              <label class="control-label" for="iam_{{ iam_form }}_group_paths">{{ lang.admin.iam_group_paths }}:</label>
+            </div>
+            <div class="col-12 col-md-9 col-lg-4">
+              <input type="text" class="form-control" placeholder="/mailcow/*" id="iam_{{ iam_form }}_group_paths" name="group_paths" value="{{ iam_settings.group_paths }}">
+            </div>
+          </div>
+          {% else %}
+          <div class="row mb-2">
+            <div class="col-md-3 d-flex align-items-center justify-content-md-end">
+              <label class="control-label" for="iam_{{ iam_form }}_group_basedn">{{ lang.admin.iam_group_basedn }}:</label>
+            </div>
+            <div class="col-12 col-md-9 col-lg-4">
+              <input type="text" class="form-control" placeholder="{{ lang.admin.iam_basedn }}" id="iam_{{ iam_form }}_group_basedn" name="group_basedn" value="{{ iam_settings.group_basedn }}">
+            </div>
+          </div>
+          <div class="row mb-2">
+            <div class="col-md-3 d-flex align-items-center justify-content-md-end">
+              <label class="control-label" for="iam_{{ iam_form }}_group_filter">{{ lang.admin.iam_group_filter }}:</label>
+            </div>
+            <div class="col-12 col-md-9 col-lg-4">
+              <input type="text" class="form-control" placeholder="(&amp;(objectClass=group)(cn=mailcow-*))" id="iam_{{ iam_form }}_group_filter" name="group_filter" value="{{ iam_settings.group_filter }}">
+            </div>
+          </div>
+          <div class="row mb-2">
+            <div class="col-md-3 d-flex align-items-center justify-content-md-end">
+              <label class="control-label" for="iam_{{ iam_form }}_group_name_attribute">{{ lang.admin.iam_group_name_attribute }}:</label>
+            </div>
+            <div class="col-12 col-md-9 col-lg-4">
+              <input type="text" class="form-control" placeholder="cn" id="iam_{{ iam_form }}_group_name_attribute" name="group_name_attribute" value="{{ iam_settings.group_name_attribute }}">
+            </div>
+          </div>
+          <div class="row mb-2">
+            <div class="col-md-3 d-flex align-items-center justify-content-md-end">
+              <label class="control-label" for="iam_ldap_group_member_mode">{{ lang.admin.iam_group_member_mode }}:</label>
+            </div>
+            <div class="col-12 col-md-9 col-lg-4">
+              <select id="iam_ldap_group_member_mode" name="group_member_mode" class="form-control">
+                {% for mode in ['memberof', 'member', 'ad_chain'] %}
+                <option value="{{ mode }}" {% if (iam_settings.group_member_mode ?: 'memberof') == mode %}selected{% endif %}>{{ attribute(lang.admin, 'iam_group_member_mode_' ~ mode) }}</option>
+                {% endfor %}
+              </select>
+            </div>
+          </div>
+          <div class="row mb-2">
+            <div class="col-md-3 d-flex align-items-center justify-content-md-end">
+              <i style="font-size: 16px; cursor: pointer;" class="bi bi-patch-question-fill mx-2 ms-0" data-bs-toggle="tooltip" data-bs-html="true" data-bs-placement="bottom" title="{{ lang.admin.iam_group_member_attribute_info }}"></i>
+              <label class="control-label" for="iam_{{ iam_form }}_group_member_attribute">{{ lang.admin.iam_group_member_attribute }}:</label>
+            </div>
+            <div class="col-12 col-md-9 col-lg-4">
+              <input type="text" class="form-control" placeholder="member" id="iam_{{ iam_form }}_group_member_attribute" name="group_member_attribute" value="{{ iam_settings.group_member_attribute }}">
+            </div>
+          </div>
+          {% endif %}
+          <div class="row mb-2">
+            <div class="col-md-3 d-flex align-items-center justify-content-md-end">
+              <i style="font-size: 16px; cursor: pointer;" class="bi bi-patch-question-fill mx-2 ms-0" data-bs-toggle="tooltip" data-bs-html="true" data-bs-placement="bottom" title="{{ lang.admin.iam_group_autocreate_info }}"></i>
+              <label class="control-label">{{ lang.admin.iam_group_autocreate }}</label>
+            </div>
+            <div class="col-12 col-md-9 d-flex align-items-center">
+              <div class="form-check form-switch">
+                <input class="form-check-input" type="checkbox" role="switch" name="group_autocreate" value="1" {% if iam_settings.group_autocreate is not defined or iam_settings.group_autocreate == 1 %}checked{% endif %}>
+              </div>
+            </div>
+          </div>
+          <div class="row mb-2">
+            <div class="col-md-3 d-flex align-items-center justify-content-md-end">
+              <i style="font-size: 16px; cursor: pointer;" class="bi bi-patch-question-fill mx-2 ms-0" data-bs-toggle="tooltip" data-bs-html="true" data-bs-placement="bottom" title="{{ lang.admin.iam_group_default_domain_info }}"></i>
+              <label class="control-label">{{ lang.admin.iam_group_default_domain }}:</label>
+            </div>
+            <div class="col-12 col-md-9 col-lg-4">
+              <select data-live-search="true" name="group_default_domain" class="form-control" title="-- {{ lang.admin.iam_group_default_domain }} --">
+                <option value="" {% if not iam_settings.group_default_domain %}selected{% endif %}>-- {{ lang.admin.iam_group_default_domain }} --</option>
+                {% for domain in domains %}
+                <option {% if domain == iam_settings.group_default_domain %}selected{% endif %}>{{ domain }}</option>
+                {% endfor %}
+              </select>
+            </div>
+          </div>

data/web/templates/admin/iam-sync-status.twig

@@ -0,0 +1,30 @@
+{# Status of the identity sync (Keycloak and LDAP), filled by js/site/identity.js #}
+      <div class="card mt-4" id="iam_sync_status">
+        <div class="card-header d-flex flex-wrap align-items-center">
+          <span class="me-2">{{ lang.admin.iam_sync_status }}</span>
+          <div class="btn-group ms-auto">
+            <button class="btn btn-sm btn-secondary iam_sync_request" data-mode="preview"><i class="bi bi-eye"></i> {{ lang.admin.iam_sync_preview }}</button>
+            <button class="btn btn-sm btn-primary iam_sync_request" data-mode="run"><i class="bi bi-play"></i> {{ lang.admin.iam_sync_run }}</button>
+            <button class="btn btn-sm btn-danger iam_sync_request" data-mode="force"><i class="bi bi-exclamation-triangle"></i> {{ lang.admin.iam_sync_force }}</button>
+          </div>
+        </div>
+        <div class="card-body">
+          <p class="text-muted"><small>{{ lang.admin.iam_sync_status_info }}</small></p>
+          <div id="iam_sync_counts" class="mb-3"></div>
+          <div class="table-responsive">
+            <table class="table table-sm table-striped mb-0" id="iam_sync_runs">
+              <thead>
+                <tr>
+                  <th>{{ lang.admin.iam_sync_started }}</th>
+                  <th>{{ lang.admin.iam_sync_mode }}</th>
+                  <th>{{ lang.admin.iam_sync_result }}</th>
+                  <th>{{ lang.admin.iam_sync_changes }}</th>
+                </tr>
+              </thead>
+              <tbody>
+                <tr><td colspan="4" class="text-muted">{{ lang.admin.iam_sync_none }}</td></tr>
+              </tbody>
+            </table>
+          </div>
+        </div>
+      </div>

data/web/templates/admin/iam-template-mapping.twig

@@ -0,0 +1,72 @@
+{# Default template and attribute mapping of all IdP forms (iam_form = keycloak|generic|ldap); row markup is used by
+   addAttributeMappingRow() in admin.js #}
+          <div class="row mb-2">
+            <div class="col-md-3 d-flex align-items-center justify-content-md-end">
+              <i style="font-size: 16px; cursor: pointer;" class="bi bi-patch-question-fill mx-2 ms-0" data-bs-toggle="tooltip" data-bs-html="true" data-bs-placement="bottom" title="{{ lang.admin.iam_default_template_description }}"></i>
+              <label class="control-label">{{ lang.admin.iam_default_template }}:</label>
+            </div>
+            <div class="col-12 col-md-9 col-lg-4">
+              <select data-live-search="true" name="default_template" class="form-control" title="-- {{ lang.mailbox.template }} --">
+                <option value="" {% if not iam_settings.default_template %}selected{% endif %}>-- {{ lang.mailbox.template }} --</option>
+                {% for mbox_template in mbox_templates %}
+                <option {% if mbox_template.template == iam_settings.default_template %}selected{% endif %}>{{ mbox_template.template }}</option>
+                {% endfor %}
+              </select>
+            </div>
+          </div>
+          <div class="row mb-2">
+            <div class="col-md-3 d-flex align-items-center justify-content-md-end">
+              <i style="font-size: 16px; cursor: pointer;" class="bi bi-patch-question-fill mx-2 ms-0" data-bs-toggle="tooltip" data-bs-html="true" data-bs-placement="bottom" title="{{ lang.admin.iam_mapping_info }}"></i>
+              <label class="control-label">{{ lang.admin.iam_mapping }}:</label>
+            </div>
+            <div class="col-12 col-md-9 col-lg-4">
+              <div class="row mx-0 align-items-center">
+                <span class="col-5 p-0 pe-2 text-muted">{{ lang.user.attribute }}</span>
+                <span class="col-5 p-0 pe-2 text-muted">{{ lang.mailbox.template }}</span>
+                <div class="col-2 p-0 d-flex">
+                  <button class="btn btn-sm d-block d-sm-inline btn-secondary ms-auto iam_rolemap_add_{{ iam_form }}" title="{{ lang.admin.iam_mapping_add }}"><i class="bi bi-plus-lg"></i></button>
+                </div>
+              </div>
+            </div>
+          </div>
+          <div class="row mb-2" id="iam_{{ iam_form }}_mapping_list">
+            <input type="hidden" name="mappers" value="">
+            <input type="hidden" name="templates" value="">
+            {% for key, role in iam_settings.mappers %}
+            <div class="offset-md-3 col-12 col-md-9 col-lg-4 mb-2">
+              <div class="row mx-0">
+                <div class="col-5 p-0 pe-2">
+                  <input type="text" class="form-control me-2" name="mappers" value="{{ iam_settings.mappers[key] }}" required>
+                </div>
+                <div class="col-5 p-0 pe-2">
+                  <select data-live-search="true" name="templates" class="form-control" title="-- {{ lang.mailbox.template }} --" required>
+                  {% for mbox_template in mbox_templates %}
+                    <option{% if mbox_template.template == iam_settings.templates[key] %} selected{% endif %}>{{ mbox_template.template }}</option>
+                  {% endfor %}
+                  </select>
+                </div>
+                <div class="col-2 p-0 d-flex">
+                  <button class="iam_{{ iam_form }}_rolemap_del btn btn-sm d-block d-sm-inline btn-secondary ms-auto"><i class="bi bi-x-lg"></i></button>
+                </div>
+              </div>
+            </div>
+            {% endfor %}
+            <div class="offset-md-3 col-12 col-md-9 col-lg-4 mb-2">
+              <div class="row mx-0">
+                <div class="col-5 p-0 pe-2">
+                  <input type="text" class="form-control me-2" name="mappers" value="">
+                </div>
+                <div class="col-5 p-0 pe-2">
+                  <select data-live-search="true" name="templates" class="form-control" title="-- {{ lang.mailbox.template }} --">
+                  <option value="" selected>-- {{ lang.mailbox.template }} --</option>
+                  {% for mbox_template in mbox_templates %}
+                    <option>{{ mbox_template.template }}</option>
+                  {% endfor %}
+                  </select>
+                </div>
+                <div class="col-2 p-0 d-flex">
+                  <button class="iam_{{ iam_form }}_rolemap_del btn btn-sm d-block d-sm-inline btn-secondary ms-auto"><i class="bi bi-x-lg"></i></button>
+                </div>
+              </div>
+            </div>
+          </div>

data/web/templates/admin/tab-config-identity-provider.twig

@@ -10,7 +10,7 @@
       <p class="offset-sm-3 mb-4">{{ lang.admin.iam_description|raw }}</p>
       <div class="row mb-4">
         <div class="col-md-3 d-flex align-items-center justify-content-md-end">
-          <label class="control-label" for="iam_realm">{{ lang.admin.iam }}:</label>
+          <label class="control-label" for="iam_provider">{{ lang.admin.iam }}:</label>
         </div>
         <div class="col-12 col-md-9 col-lg-4">
           <select
@@ -24,15 +24,17 @@
           </select>
         </div>
       </div>
+      {# Keycloak #}
       <div id="keycloak_settings" class="{% if iam_settings.authsource and iam_settings.authsource != 'keycloak' %}d-none{% endif %}">
         <form class="form-horizontal" autocapitalize="none" data-id="iam_keycloak" autocorrect="off" role="form" method="post">
           <input type="hidden" name="authsource" value="keycloak">
+          <legend class="fs-5 mt-2"><i class="bi bi-plug"></i> {{ lang.admin.iam_section_connection }}</legend><hr>
           <div class="row mb-2">
             <div class="col-md-3 d-flex align-items-center justify-content-md-end">
-                <label class="control-label" for="iam_keycloak_url">{{ lang.admin.iam_server_url }}:</label>
+              <label class="control-label" for="iam_keycloak_url">{{ lang.admin.iam_server_url }}:</label>
             </div>
             <div class="col-12 col-md-9 col-lg-4">
-              <input type="text" class="form-control" id="iam_keycloak_url" name="server_url" value="{{ iam_settings.server_url }}" required>
+              <input type="text" class="form-control" id="iam_keycloak_url" name="server_url" value="{{ iam_settings.server_url }}" placeholder="https://auth.example.org" required>
             </div>
           </div>
           <div class="row mb-2">
@@ -43,6 +45,14 @@
               <input type="text" class="form-control" id="iam_keycloak_realm" name="realm" value="{{ iam_settings.realm }}" required>
             </div>
           </div>
+          <div class="row mb-2">
+            <div class="col-md-3 d-flex align-items-center justify-content-md-end">
+              <label class="control-label" for="iam_keycloak_version">{{ lang.admin.iam_version }}:</label>
+            </div>
+            <div class="col-12 col-md-9 col-lg-4">
+              <input type="text" class="form-control" id="iam_keycloak_version" name="version" value="{{ iam_settings.version }}" placeholder="26.0.0" required>
+            </div>
+          </div>
           <div class="row mb-2">
             <div class="col-md-3 d-flex align-items-center justify-content-md-end">
               <label class="control-label" for="iam_keycloak_clientid">{{ lang.admin.iam_client_id }}:</label>
@@ -62,215 +72,62 @@
               </div>
             </div>
           </div>
-          <div class="row mb-2">
-            <div class="col-md-3 d-flex align-items-center justify-content-md-end">
-              <label class="control-label">{{ lang.admin.iam_redirect_url }}:</label>
-            </div>
-            <div class="col-12 col-md-9 col-lg-4">
-              <div class="row px-2 align-items-center">
-                <span class="col-10 p-0 pe-2">
-                  <input type="text" class="form-control"  name="redirect_url" value="{{ iam_settings.redirect_url }}" required>
-                </span>
-                <div class="col-2 p-0 d-flex">
-                  <button class="btn btn-sm d-block d-sm-inline btn-secondary ms-auto iam_redirect_add_keycloak"><i class="bi bi-plus-lg"></i></button>
-                </div>
-              </div>
-            </div>
-          </div>
-          <div class="row mb-2" id="iam_keycloak_redirect_list">
-            <input type="hidden" name="redirect_url_extra" value="">
-            {% for key, url in iam_settings.redirect_url_extra %}
-            <div class="offset-md-3 col-12 col-md-9 col-lg-4 mb-2">
-              <div class="row px-2">
-                <div class="col-10 p-0 pe-2">
-                  <input type="text" class="form-control me-2" name="redirect_url_extra" value="{{ iam_settings.redirect_url_extra[key] }}">
-                </div>
-                <div class="col-2 p-0 d-flex">
-                  <button class="iam_keycloak_redirect_del btn btn-sm d-block d-sm-inline btn-secondary ms-auto"><i class="bi bi-x-lg"></i></button>
-                </div>
-              </div>
-            </div>
-            {% endfor %}
-            <div class="offset-md-3 col-12 col-md-9 col-lg-4 mb-2">
-              <div class="row px-2">
-                <div class="col-10 p-0 pe-2">
-                  <input type="text" class="form-control me-2" name="redirect_url_extra" value="">
-                </div>
-                <div class="col-2 p-0 d-flex">
-                  <button class="iam_keycloak_redirect_del btn btn-sm d-block d-sm-inline btn-secondary ms-auto"><i class="bi bi-x-lg"></i></button>
-                </div>
-              </div>
-            </div>
-          </div>
-          <div class="row mb-4">
-            <div class="col-md-3 d-flex align-items-center justify-content-md-end">
-              <label class="control-label" for="iam_keycloak_version">{{ lang.admin.iam_version }}:</label>
-            </div>
-            <div class="col-sm-4">
-              <input type="text" class="form-control" id="iam_keycloak_version" name="version" value="{{ iam_settings.version }}" required>
-            </div>
-          </div>
-          <div class="row mb-2">
-            <div class="col-md-3 d-flex align-items-center justify-content-md-end">
-              <label class="control-label">{{ lang.admin.iam_mapping }}:</label>
-            </div>
-            <div class="col-12 col-md-9 col-lg-4">
-              <div class="row px-2 align-items-center">
-                <span class="col-5 p-0 pe-2">{{ lang.user.attribute }}</span>
-                <span class="col-5 p-0 pe-2">{{ lang.mailbox.template }}</span>
-                <div class="col-2 p-0 d-flex">
-                  <button class="btn btn-sm d-block d-sm-inline btn-secondary ms-auto iam_rolemap_add_keycloak"><i class="bi bi-plus-lg"></i></button>
-                </div>
-              </div>
-            </div>
-          </div>
-          <div class="row mb-2" id="iam_keycloak_mapping_list">
-            <input type="hidden" name="mappers" value="">
-            <input type="hidden" name="templates" value="">
-            <div class="offset-md-3 col-12 col-md-9 col-lg-4 mb-2">
-              <div class="row px-2">
-                <div class="col-5 p-0 pe-2">
-                  <i style="font-size: 16px; cursor: pointer;" class="bi bi-patch-question-fill" data-bs-toggle="tooltip" data-bs-html="true" data-bs-placement="bottom" title="{{ lang.admin.iam_default_template_description }}"></i>
-                  <span>{{ lang.admin.iam_default_template}}</span>
-                </div>
-                <div class="col-5 p-0 pe-2 align-content-end">
-                  <select data-live-search="true" name="default_template" class="form-control" title="-- {{ lang.mailbox.template }} --">
-                  <option value="" {% if not iam_settings.default_template %}selected{% endif %}>-- {{ lang.mailbox.template }} --</option>
-                  {% for mbox_template in mbox_templates %}
-                    <option {% if mbox_template.template == iam_settings.default_template %}selected{% endif %}>
-                      {{ mbox_template.template }}
-                    </option>
-                  {% endfor %}
-                  </select>
-                </div>
-                <div class="col-2 p-0 d-flex"></div>
-              </div>
-            </div>
-            {% for key, role in iam_settings.mappers %}
-            <div class="offset-md-3 col-12 col-md-9 col-lg-4 mb-2">
-              <div class="row px-2">
-                <div class="col-5 p-0 pe-2">
-                  <input type="text" class="form-control me-2" name="mappers" value="{{ iam_settings.mappers[key] }}" required>
-                </div>
-                <div class="col-5 p-0 pe-2">
-                  <select data-live-search="true" name="templates" class="form-control" title="-- {{ lang.mailbox.template }} --" required>
-                  {% for mbox_template in mbox_templates %}
-                    <option{% if mbox_template.template == iam_settings.templates[key] %} selected{% endif %}>
-                      {{ mbox_template.template }}
-                    </option>
-                  {% endfor %}
-                  </select>
-                </div>
-                <div class="col-2 p-0 d-flex">
-                  <button class="iam_keycloak_rolemap_del btn btn-sm d-block d-sm-inline btn-secondary ms-auto"><i class="bi bi-x-lg"></i></button>
-                </div>
-              </div>
-            </div>
-            {% endfor %}
-            <div class="offset-md-3 col-12 col-md-9 col-lg-4 mb-2">
-              <div class="row px-2">
-                <div class="col-5 p-0 pe-2">
-                  <input type="text" class="form-control me-2" name="mappers" value="">
-                </div>
-                <div class="col-5 p-0 pe-2">
-                  <select data-live-search="true" name="templates" class="form-control" title="-- {{ lang.mailbox.template }} --">
-                  <option value="" selected>-- {{ lang.mailbox.template }} --</option>
-                  {% for mbox_template in mbox_templates %}
-                    <option>
-                      {{ mbox_template.template }}
-                    </option>
-                  {% endfor %}
-                  </select>
-                </div>
-                <div class="col-2 p-0 d-flex">
-                  <button class="iam_keycloak_rolemap_del btn btn-sm d-block d-sm-inline btn-secondary ms-auto"><i class="bi bi-x-lg"></i></button>
-                </div>
-              </div>
-            </div>
-          </div>
-          <div class="row mb-2 mt-4">
-            <div class="col-md-3 d-flex align-items-center justify-content-md-end"></div>
-            <div class="col-12 col-md-9">
-              <span>{{ lang.admin.iam_extra_permission|raw }}</span>
-            </div>
-          </div>
-          <div class="row mb-2">
-            <div class="col-md-3 d-flex align-items-start justify-content-md-end">
-              <label class="control-label">{{ lang.admin.iam_rest_flow }}</label>
-            </div>
-            <div class="col-12 col-md-9">
-              <div class="form-check form-switch">
-                <input class="form-check-input" type="checkbox" role="switch" name="mailpassword_flow" value="1" {% if iam_settings.mailpassword_flow == 1 %}checked{% endif %}>
-              </div>
-              <p class="text-muted">
-                <small>
-                  {{ lang.admin.iam_auth_flow_info|raw }}
-                </small>
-              </p>
-            </div>
-          </div>
           <div class="row mb-2">
             <div class="col-md-3 d-flex align-items-center justify-content-md-end">
               <label class="control-label">{{ lang.admin.ignore_ssl_error }}</label>
             </div>
-            <div class="col-12 col-md-9">
+            <div class="col-12 col-md-9 d-flex align-items-center">
               <div class="form-check form-switch">
                 <input class="form-check-input" type="checkbox" role="switch" name="ignore_ssl_error" value="1" {% if iam_settings.ignore_ssl_error == 1 %}checked{% endif %}>
               </div>
             </div>
           </div>
+          <div class="row mb-2">
+            <div class="offset-md-3 col-12 col-md-9">
+              <button class="btn btn-sm d-block d-sm-inline btn-secondary iam_test_connection" data-id="iam_keycloak"><i class="bi bi-play"></i> {{ lang.admin.iam_test_connection }}</button>
+            </div>
+          </div>
+          <legend class="fs-5 mt-4"><i class="bi bi-box-arrow-in-right"></i> {{ lang.admin.iam_section_login }}</legend><hr>
+          {% include 'admin/iam-redirect-urls.twig' with {'iam_form': 'keycloak'} %}
           <div class="row mb-2">
             <div class="col-md-3 d-flex align-items-center justify-content-md-end">
+              <i style="font-size: 16px; cursor: pointer;" class="bi bi-patch-question-fill mx-2 ms-0" data-bs-toggle="tooltip" data-bs-html="true" data-bs-placement="bottom" title="{{ lang.admin.iam_auth_flow_info }}"></i>
+              <label class="control-label">{{ lang.admin.iam_rest_flow }}</label>
+            </div>
+            <div class="col-12 col-md-9 d-flex align-items-center">
+              <div class="form-check form-switch">
+                <input class="form-check-input" type="checkbox" role="switch" name="mailpassword_flow" value="1" {% if iam_settings.mailpassword_flow == 1 %}checked{% endif %}>
+              </div>
+            </div>
+          </div>
+          <div class="row mb-2">
+            <div class="col-md-3 d-flex align-items-center justify-content-md-end">
+              <i style="font-size: 16px; cursor: pointer;" class="bi bi-patch-question-fill mx-2 ms-0" data-bs-toggle="tooltip" data-bs-html="true" data-bs-placement="bottom" title="{{ lang.admin.iam_login_provisioning_info }}"></i>
               <label class="control-label">{{ lang.admin.iam_login_provisioning }}</label>
             </div>
-            <div class="col-12 col-md-9">
+            <div class="col-12 col-md-9 d-flex align-items-center">
               <div class="form-check form-switch">
-                <input class="form-check-input" type="checkbox" role="switch" name="login_provisioning"  value="1" {% if iam_settings.login_provisioning == 1 %}checked{% endif %}>
+                <input class="form-check-input" type="checkbox" role="switch" name="login_provisioning" value="1" {% if iam_settings.login_provisioning == 1 %}checked{% endif %}>
               </div>
             </div>
           </div>
+          <legend class="fs-5 mt-4"><i class="bi bi-file-earmark-text"></i> {{ lang.admin.iam_section_templates }}</legend><hr>
+          {% include 'admin/iam-template-mapping.twig' with {'iam_form': 'keycloak'} %}
+          {% include 'admin/iam-sync-settings.twig' with {'iam_form': 'keycloak'} %}
+          <hr class="mt-4">
           <div class="row mb-2">
-            <div class="col-md-3 d-flex align-items-center justify-content-md-end">
-              <label class="control-label">{{ lang.admin.iam_periodic_full_sync }}</label>
-            </div>
-            <div class="col-12 col-md-9">
-              <div class="form-check form-switch">
-                <input class="form-check-input" type="checkbox" role="switch" name="periodic_sync"  value="1" {% if iam_settings.periodic_sync == 1 %}checked{% endif %}>
-              </div>
-            </div>
-          </div>
-          <div class="row mb-2">
-            <div class="col-md-3 d-flex align-items-center justify-content-md-end">
-              <label class="control-label">{{ lang.admin.iam_import_users }}</label>
-            </div>
-            <div class="col-12 col-md-9">
-              <div class="form-check form-switch">
-                <input class="form-check-input" type="checkbox" role="switch" name="import_users"  value="1" {% if iam_settings.import_users == 1 %}checked{% endif %}>
-              </div>
-            </div>
-          </div>
-          <div class="row mb-2">
-            <div class="col-md-3 d-flex align-items-center justify-content-md-end">
-              <label class="control-label">{{ lang.admin.iam_sync_interval }}</label>
-            </div>
-            <div class="col-12 col-md-9 col-lg-4">
-              <input class="form-control" type="number" min="1" name="sync_interval" style="width: 80px;"  {% if iam_settings.sync_interval %}value="{{ iam_settings.sync_interval }}"{% else %}value="15"{% endif %}>
-            </div>
-          </div>
-          <div class="row mt-4 mb-2">
             <div class="offset-md-3 col-12 col-md-9 d-flex flex-wrap">
-              <div class="btn-group mb-2">
-                <button class="btn btn-sm d-block d-sm-inline btn-secondary iam_test_connection iam_test_connection" data-id="iam_keycloak"><i class="bi bi-play"></i> {{ lang.admin.iam_test_connection }}</button>
-                <button class="btn btn-sm d-block d-sm-inline btn-success" data-item="identity-provider" data-action="edit_selected" data-id="iam_keycloak" data-api-url='edit/identity-provider' data-api-attr='{}'><i class="bi bi-check-lg"></i> {{ lang.admin.save }}</button>
-              </div>
+              <button class="btn btn-sm d-block d-sm-inline btn-success mb-2" data-item="identity-provider" data-action="edit_selected" data-id="iam_keycloak" data-api-url='edit/identity-provider' data-api-attr='{}'><i class="bi bi-check-lg"></i> {{ lang.admin.save }}</button>
               <button class="btn btn-sm d-block d-sm-inline btn-danger ms-auto mb-2" data-item="identity-provider" data-action="delete_selected" data-id="iam_keycloak" data-api-url='delete/identity-provider'><i class="bi bi-trash"></i> {{ lang.mailbox.remove }}</button>
             </div>
           </div>
         </form>
       </div>
+      {# Generic OIDC #}
       <div id="generic_oidc_settings" class="{% if not iam_settings.authsource or iam_settings.authsource != 'generic-oidc' %}d-none{% endif %}">
         <form class="form-horizontal" autocapitalize="none" data-id="iam_generic" autocorrect="off" role="form" method="post">
           <input type="hidden" name="authsource" value="generic-oidc">
+          <legend class="fs-5 mt-2"><i class="bi bi-plug"></i> {{ lang.admin.iam_section_connection }}</legend><hr>
           <div class="row mb-2">
             <div class="col-md-3 d-flex align-items-center justify-content-md-end">
               <label class="control-label" for="iam_authorize_url">{{ lang.admin.iam_authorize_url }}:</label>
@@ -315,46 +172,6 @@
             </div>
           </div>
           <div class="row mb-2">
-            <div class="col-md-3 d-flex align-items-center justify-content-md-end">
-              <label class="control-label">{{ lang.admin.iam_redirect_url }}:</label>
-            </div>
-            <div class="col-12 col-md-9 col-lg-4">
-              <div class="row px-2 align-items-center">
-                <span class="col-10 p-0 pe-2">
-                  <input type="text" class="form-control" name="redirect_url" value="{{ iam_settings.redirect_url }}" required>
-                </span>
-                <div class="col-2 p-0 d-flex">
-                  <button class="btn btn-sm d-block d-sm-inline btn-secondary ms-auto iam_redirect_add_generic"><i class="bi bi-plus-lg"></i></button>
-                </div>
-              </div>
-            </div>
-          </div>
-          <div class="row mb-2" id="iam_generic_redirect_list">
-            <input type="hidden" name="redirect_url_extra" value="">
-            {% for key, url in iam_settings.redirect_url_extra %}
-            <div class="offset-md-3 col-12 col-md-9 col-lg-4 mb-2">
-              <div class="row px-2">
-                <div class="col-10 p-0 pe-2">
-                  <input type="text" class="form-control me-2" name="redirect_url_extra" value="{{ iam_settings.redirect_url_extra[key] }}">
-                </div>
-                <div class="col-2 p-0 d-flex">
-                  <button class="iam_generic_redirect_del btn btn-sm d-block d-sm-inline btn-secondary ms-auto"><i class="bi bi-x-lg"></i></button>
-                </div>
-              </div>
-            </div>
-            {% endfor %}
-            <div class="offset-md-3 col-12 col-md-9 col-lg-4 mb-2">
-              <div class="row px-2">
-                <div class="col-10 p-0 pe-2">
-                  <input type="text" class="form-control me-2" name="redirect_url_extra" value="">
-                </div>
-                <div class="col-2 p-0 d-flex">
-                  <button class="iam_generic_redirect_del btn btn-sm d-block d-sm-inline btn-secondary ms-auto"><i class="bi bi-x-lg"></i></button>
-                </div>
-              </div>
-            </div>
-          </div>
-          <div class="row mb-4">
             <div class="col-md-3 d-flex align-items-center justify-content-md-end">
               <label class="control-label" for="iam_client_scopes">{{ lang.admin.iam_client_scopes }}:</label>
             </div>
@@ -362,125 +179,57 @@
               <input type="text" placeholder="openid profile email mailcow_template" class="form-control" id="iam_client_scopes" name="client_scopes" value="{{ iam_settings.client_scopes }}">
             </div>
           </div>
-          <div class="row mb-2">
-            <div class="col-md-3 d-flex align-items-center justify-content-md-end">
-              <label class="control-label">{{ lang.admin.iam_mapping }}:</label>
-            </div>
-            <div class="col-12 col-md-9 col-lg-4">
-              <div class="row px-2 align-items-center">
-                <span class="col-5 p-0 pe-2">{{ lang.user.attribute }}</span>
-                <span class="col-5 p-0 pe-2">{{ lang.mailbox.template }}</span>
-                <div class="col-2 p-0 d-flex">
-                  <button class="btn btn-sm d-block d-sm-inline btn-secondary ms-auto iam_rolemap_add_generic"><i class="bi bi-plus-lg"></i></button>
-                </div>
-              </div>
-            </div>
-          </div>
-          <div class="row mb-2" id="iam_generic_mapping_list">
-            <input type="hidden" name="mappers" value="">
-            <input type="hidden" name="templates" value="">
-            <div class="offset-md-3 col-12 col-md-9 col-lg-4 mb-2">
-              <div class="row px-2">
-                <div class="col-5 p-0 pe-2">
-                  <i style="font-size: 16px; cursor: pointer;" class="bi bi-patch-question-fill" data-bs-toggle="tooltip" data-bs-html="true" data-bs-placement="bottom" title="{{ lang.admin.iam_default_template_description }}"></i>
-                  <span>{{ lang.admin.iam_default_template}}</span>
-                </div>
-                <div class="col-5 p-0 pe-2 align-content-end">
-                  <select data-live-search="true" name="default_template" class="form-control" title="-- {{ lang.mailbox.template }} --">
-                  <option value="" {% if not iam_settings.default_template %}selected{% endif %}>-- {{ lang.mailbox.template }} --</option>
-                  {% for mbox_template in mbox_templates %}
-                    <option {% if mbox_template.template == iam_settings.default_template %}selected{% endif %}>
-                      {{ mbox_template.template }}
-                    </option>
-                  {% endfor %}
-                  </select>
-                </div>
-                <div class="col-2 p-0 d-flex"></div>
-              </div>
-            </div>
-            {% for key, role in iam_settings.mappers %}
-            <div class="offset-md-3 col-12 col-md-9 col-lg-4 mb-2">
-              <div class="row px-2">
-                <div class="col-5 p-0 pe-2">
-                  <input type="text" class="form-control me-2" name="mappers" value="{{ iam_settings.mappers[key] }}" required>
-                </div>
-                <div class="col-5 p-0 pe-2">
-                  <select data-live-search="true" name="templates" class="form-control" title="-- {{ lang.mailbox.template }} --" required>
-                  {% for mbox_template in mbox_templates %}
-                    <option{% if mbox_template.template == iam_settings.templates[key] %} selected{% endif %}>
-                      {{ mbox_template.template }}
-                    </option>
-                  {% endfor %}
-                  </select>
-                </div>
-                <div class="col-2 p-0 d-flex">
-                  <button class="iam_generic_rolemap_del btn btn-sm d-block d-sm-inline btn-secondary ms-auto"><i class="bi bi-x-lg"></i></button>
-                </div>
-              </div>
-            </div>
-            {% endfor %}
-            <div class="offset-md-3 col-12 col-md-9 col-lg-4 mb-2">
-              <div class="row px-2">
-                <div class="col-5 p-0 pe-2">
-                  <input type="text" class="form-control me-2" name="mappers" value="">
-                </div>
-                <div class="col-5 p-0 pe-2">
-                  <select data-live-search="true" name="templates" class="form-control" title="-- {{ lang.mailbox.template }} --">
-                  <option value="" selected>-- {{ lang.mailbox.template }} --</option>
-                  {% for mbox_template in mbox_templates %}
-                    <option>
-                      {{ mbox_template.template }}
-                    </option>
-                  {% endfor %}
-                  </select>
-                </div>
-                <div class="col-2 p-0 d-flex">
-                  <button class="iam_generic_rolemap_del btn btn-sm d-block d-sm-inline btn-secondary ms-auto"><i class="bi bi-x-lg"></i></button>
-                </div>
-              </div>
-            </div>
-          </div>
           <div class="row mb-2">
             <div class="col-md-3 d-flex align-items-center justify-content-md-end">
               <label class="control-label">{{ lang.admin.ignore_ssl_error }}</label>
             </div>
-            <div class="col-12 col-md-9">
+            <div class="col-12 col-md-9 d-flex align-items-center">
               <div class="form-check form-switch">
                 <input class="form-check-input" type="checkbox" role="switch" name="ignore_ssl_error" value="1" {% if iam_settings.ignore_ssl_error == 1 %}checked{% endif %}>
               </div>
             </div>
           </div>
-          <div class="row mb-4">
+          <div class="row mb-2">
+            <div class="offset-md-3 col-12 col-md-9">
+              <button class="btn btn-sm d-block d-sm-inline btn-secondary iam_test_connection" data-id="iam_generic"><i class="bi bi-play"></i> {{ lang.admin.iam_test_connection }}</button>
+            </div>
+          </div>
+          <legend class="fs-5 mt-4"><i class="bi bi-box-arrow-in-right"></i> {{ lang.admin.iam_section_login }}</legend><hr>
+          {% include 'admin/iam-redirect-urls.twig' with {'iam_form': 'generic'} %}
+          <div class="row mb-2">
             <div class="col-md-3 d-flex align-items-center justify-content-md-end">
+              <i style="font-size: 16px; cursor: pointer;" class="bi bi-patch-question-fill mx-2 ms-0" data-bs-toggle="tooltip" data-bs-html="true" data-bs-placement="bottom" title="{{ lang.admin.iam_login_provisioning_info }}"></i>
               <label class="control-label">{{ lang.admin.iam_login_provisioning }}</label>
             </div>
-            <div class="col-12 col-md-9">
+            <div class="col-12 col-md-9 d-flex align-items-center">
               <div class="form-check form-switch">
-                <input class="form-check-input" type="checkbox" role="switch" name="login_provisioning"  value="1" {% if iam_settings.login_provisioning == 1 %}checked{% endif %}>
+                <input class="form-check-input" type="checkbox" role="switch" name="login_provisioning" value="1" {% if iam_settings.login_provisioning == 1 %}checked{% endif %}>
               </div>
             </div>
           </div>
-          <div class="row mt-4 mb-2">
+          <legend class="fs-5 mt-4"><i class="bi bi-file-earmark-text"></i> {{ lang.admin.iam_section_templates }}</legend><hr>
+          {% include 'admin/iam-template-mapping.twig' with {'iam_form': 'generic'} %}
+          <hr class="mt-4">
+          <div class="row mb-2">
             <div class="offset-md-3 col-12 col-md-9 d-flex flex-wrap">
-              <div class="btn-group mb-2">
-                <button class="btn btn-sm d-block d-sm-inline btn-secondary iam_test_connection" data-id="iam_generic"><i class="bi bi-play"></i> {{ lang.admin.iam_test_connection }}</button>
-                <button class="btn btn-sm d-block d-sm-inline btn-success" data-item="identity-provider" data-action="edit_selected" data-id="iam_generic" data-api-url='edit/identity-provider' data-api-attr='{}'><i class="bi bi-check-lg"></i> {{ lang.admin.save }}</button>
-              </div>
+              <button class="btn btn-sm d-block d-sm-inline btn-success mb-2" data-item="identity-provider" data-action="edit_selected" data-id="iam_generic" data-api-url='edit/identity-provider' data-api-attr='{}'><i class="bi bi-check-lg"></i> {{ lang.admin.save }}</button>
               <button class="btn btn-sm d-block d-sm-inline btn-danger ms-auto mb-2" data-item="identity-provider" data-action="delete_selected" data-id="iam_generic" data-api-url='delete/identity-provider'><i class="bi bi-trash"></i> {{ lang.mailbox.remove }}</button>
             </div>
           </div>
         </form>
       </div>
+      {# LDAP #}
       <div id="ldap_settings" class="{% if not iam_settings.authsource or iam_settings.authsource != 'ldap' %}d-none{% endif %}">
         <form class="form-horizontal" autocapitalize="none" data-id="iam_ldap" autocorrect="off" role="form" method="post">
           <input type="hidden" name="authsource" value="ldap">
+          <legend class="fs-5 mt-2"><i class="bi bi-plug"></i> {{ lang.admin.iam_section_connection }}</legend><hr>
           <div class="row mb-2">
             <div class="col-md-3 d-flex align-items-center justify-content-md-end">
               <i style="font-size: 16px; cursor: pointer;" class="bi bi-patch-question-fill mx-2 ms-0" data-bs-toggle="tooltip" data-bs-html="true" data-bs-placement="bottom" title="{{ lang.admin.iam_host_info }}"></i>
               <label class="control-label" for="iam_ldap_host">{{ lang.admin.iam_host }}:</label>
             </div>
-            <div class="col-12 col-md-9 col-lg-4 d-flex">
-              <input type="text" class="form-control" id="iam_ldap_host" name="host" value="{{ iam_settings.host }}" required>
+            <div class="col-12 col-md-9 col-lg-4">
+              <input type="text" class="form-control" id="iam_ldap_host" name="host" value="{{ iam_settings.host }}" placeholder="ldap1.example.org, ldap2.example.org" required>
             </div>
           </div>
           <div class="row mb-2">
@@ -488,96 +237,44 @@
               <label class="control-label" for="iam_ldap_port">{{ lang.admin.iam_port }}:</label>
             </div>
             <div class="col-12 col-md-9 col-lg-4">
-              <input type="number" class="form-control" id="iam_ldap_port" name="port" value="{{ iam_settings.port }}" required>
+              <input type="number" class="form-control" id="iam_ldap_port" name="port" value="{{ iam_settings.port }}" placeholder="389" required>
             </div>
           </div>
           <div class="row mb-2">
             <div class="col-md-3 d-flex align-items-center justify-content-md-end">
-              <i style="font-size: 16px; cursor: pointer;" class="bi bi-patch-question-fill mx-2 ms-0" data-bs-toggle="tooltip" data-bs-html="true" data-bs-placement="bottom" title="{{ lang.admin.iam_use_ssl_info }}"></i>
-              <label class="control-label">{{ lang.admin.iam_use_ssl }}</label>
+              <i style="font-size: 16px; cursor: pointer;" class="bi bi-patch-question-fill mx-2 ms-0" data-bs-toggle="tooltip" data-bs-html="true" data-bs-placement="bottom" title="{{ lang.admin.iam_encryption_info }}"></i>
+              <label class="control-label" for="iam_ldap_encryption">{{ lang.admin.iam_encryption }}:</label>
             </div>
-            <div class="col-12 col-md-9 d-flex align-items-center">
-              <div class="form-check form-switch">
-                <input class="form-check-input"
-                       type="checkbox"
-                       role="switch"
-                       id="use_ssl"
-                       name="use_ssl"
-                       value="1"
-                       onchange="if(this.checked) document.getElementById('use_tls').checked = false"
-                       {% if iam_settings.use_ssl == 1 %}checked{% endif %}>
-              </div>
+            <div class="col-12 col-md-9 col-lg-4">
+              {# use_ssl and use_tls exclude each other, the select sets both #}
+              <input type="hidden" name="use_ssl" value="{{ iam_settings.use_ssl ? 1 : 0 }}">
+              <input type="hidden" name="use_tls" value="{{ iam_settings.use_tls ? 1 : 0 }}">
+              <select id="iam_ldap_encryption" class="form-control iam_ldap_encryption">
+                <option value="none" {% if not iam_settings.use_ssl and not iam_settings.use_tls %}selected{% endif %}>{{ lang.admin.iam_encryption_none }}</option>
+                <option value="tls" {% if iam_settings.use_tls and not iam_settings.use_ssl %}selected{% endif %}>StartTLS</option>
+                <option value="ssl" {% if iam_settings.use_ssl %}selected{% endif %}>SSL (LDAPS)</option>
+              </select>
             </div>
           </div>
           <div class="row mb-2">
-            <div class="col-md-3 d-flex align-items-center justify-content-md-end">
-              <i style="font-size: 16px; cursor: pointer;" class="bi bi-patch-question-fill mx-2 ms-0" data-bs-toggle="tooltip" data-bs-html="true" data-bs-placement="bottom" title="{{ lang.admin.iam_use_tls_info }}"></i>
-              <label class="control-label">{{ lang.admin.iam_use_tls }}</label>
-            </div>
-            <div class="col-12 col-md-9 d-flex align-items-center">
-              <div class="form-check form-switch">
-                <input class="form-check-input"
-                       type="checkbox"
-                       role="switch"
-                       id="use_tls"
-                       name="use_tls"
-                       value="1"
-                       onchange="if(this.checked) document.getElementById('use_ssl').checked = false"
-                       {% if iam_settings.use_tls == 1 %}checked{% endif %}>
-              </div>
-            </div>
-          </div>
-          <div class="row mb-4">
             <div class="col-md-3 d-flex align-items-center justify-content-md-end">
               <label class="control-label">{{ lang.admin.ignore_ssl_error }}</label>
             </div>
-            <div class="col-12 col-md-9">
+            <div class="col-12 col-md-9 d-flex align-items-center">
               <div class="form-check form-switch">
                 <input class="form-check-input" type="checkbox" role="switch" name="ignore_ssl_error" value="1" {% if iam_settings.ignore_ssl_error == 1 %}checked{% endif %}>
               </div>
             </div>
           </div>
-          <div class="row mb-2">
-            <div class="col-md-3 d-flex align-items-center justify-content-md-end">
-              <label class="control-label" for="iam_ldap_basedn">{{ lang.admin.iam_basedn }}:</label>
-            </div>
-            <div class="col-12 col-md-9 col-lg-4">
-              <input type="text" class="form-control" id="iam_ldap_basedn" name="basedn" value="{{ iam_settings.basedn }}" required>
-            </div>
-          </div>
-          <div class="row mb-2">
-            <div class="col-md-3 d-flex align-items-center justify-content-md-end">
-              <label class="control-label" for="iam_ldap_username_field">{{ lang.admin.iam_username_field }}:</label>
-            </div>
-            <div class="col-12 col-md-9 col-lg-4">
-              <input type="text" class="form-control" placeholder="mail" id="iam_ldap_username_field" name="username_field" value="{{ iam_settings.username_field }}">
-            </div>
-          </div>
-          <div class="row mb-2">
-            <div class="col-md-3 d-flex align-items-center justify-content-md-end">
-              <label class="control-label" for="iam_ldap_filter">{{ lang.admin.filter }}:</label>
-            </div>
-            <div class="col-12 col-md-9 col-lg-4">
-              <input type="text" class="form-control" placeholder="" id="iam_ldap_filter" name="filter" value="{{ iam_settings.filter }}">
-            </div>
-          </div>
-          <div class="row mb-2">
-            <div class="col-md-3 d-flex align-items-center justify-content-md-end">
-              <label class="control-label" for="iam_ldap_attribute_field">{{ lang.admin.iam_attribute_field }}:</label>
-            </div>
-            <div class="col-12 col-md-9 col-lg-4">
-              <input type="text" class="form-control" id="iam_ldap_attribute_field" name="attribute_field" value="{{ iam_settings.attribute_field }}" required>
-            </div>
-          </div>
           <div class="row mb-2">
             <div class="col-md-3 d-flex align-items-center justify-content-md-end">
               <label class="control-label" for="iam_ldap_binddn">{{ lang.admin.iam_binddn }}:</label>
             </div>
             <div class="col-12 col-md-9 col-lg-4">
-              <input type="text" class="form-control" id="iam_ldap_binddn" name="binddn" value="{{ iam_settings.binddn }}" required>
+              <input type="text" class="form-control" id="iam_ldap_binddn" name="binddn" value="{{ iam_settings.binddn }}" placeholder="cn=mailcow,ou=services,dc=example,dc=org" required>
             </div>
           </div>
-          <div class="row mb-4">
+          <div class="row mb-2">
             <div class="col-md-3 d-flex align-items-center justify-content-md-end">
               <label class="control-label" for="iam_ldap_bindpass">{{ lang.admin.iam_bindpass }}:</label>
             </div>
@@ -589,132 +286,91 @@
             </div>
           </div>
           <div class="row mb-2">
-            <div class="col-md-3 d-flex align-items-center justify-content-md-end">
-              <label class="control-label">{{ lang.admin.iam_mapping }}:</label>
-            </div>
-            <div class="col-12 col-md-9 col-lg-4">
-              <div class="row px-2 align-items-center">
-                <span class="col-5 p-0 pe-2">{{ lang.user.attribute }}</span>
-                <span class="col-5 p-0 pe-2">{{ lang.mailbox.template }}</span>
-                <div class="col-2 p-0 d-flex">
-                  <button class="btn btn-sm d-block d-sm-inline btn-secondary ms-auto iam_rolemap_add_ldap"><i class="bi bi-plus-lg"></i></button>
-                </div>
-              </div>
+            <div class="offset-md-3 col-12 col-md-9">
+              <button class="btn btn-sm d-block d-sm-inline btn-secondary iam_test_connection" data-id="iam_ldap"><i class="bi bi-play"></i> {{ lang.admin.iam_test_connection }}</button>
             </div>
           </div>
-          <div class="row mb-2" id="iam_ldap_mapping_list">
-            <input type="hidden" name="mappers" value="">
-            <input type="hidden" name="templates" value="">
-            <div class="offset-md-3 col-12 col-md-9 col-lg-4 mb-2">
-              <div class="row px-2">
-                <div class="col-5 p-0 pe-2">
-                  <i style="font-size: 16px; cursor: pointer;" class="bi bi-patch-question-fill" data-bs-toggle="tooltip" data-bs-html="true" data-bs-placement="bottom" title="{{ lang.admin.iam_default_template_description }}"></i>
-                  <span>{{ lang.admin.iam_default_template }}</span>
-                </div>
-                <div class="col-5 p-0 pe-2 align-content-end">
-                  <select data-live-search="true" name="default_template" class="form-control" title="-- {{ lang.mailbox.template }} --">
-                  <option value="" {% if not iam_settings.default_template %}selected{% endif %}>-- {{ lang.mailbox.template }} --</option>
-                  {% for mbox_template in mbox_templates %}
-                    <option {% if mbox_template.template == iam_settings.default_template %}selected{% endif %}>
-                      {{ mbox_template.template }}
-                    </option>
-                  {% endfor %}
-                  </select>
-                </div>
-                <div class="col-2 p-0 d-flex"></div>
-              </div>
+          <legend class="fs-5 mt-4"><i class="bi bi-person-lines-fill"></i> {{ lang.admin.iam_section_users }}</legend><hr>
+          <div class="row mb-2">
+            <div class="col-md-3 d-flex align-items-center justify-content-md-end">
+              <label class="control-label" for="iam_ldap_basedn">{{ lang.admin.iam_basedn }}:</label>
             </div>
-            {% for key, role in iam_settings.mappers %}
-            <div class="offset-md-3 col-12 col-md-9 col-lg-4 mb-2">
-              <div class="row px-2">
-                <div class="col-5 p-0 pe-2">
-                  <input type="text" class="form-control me-2" name="mappers" value="{{ iam_settings.mappers[key] }}" required>
-                </div>
-                <div class="col-5 p-0 pe-2">
-                  <select data-live-search="true" name="templates" class="form-control" title="-- {{ lang.mailbox.template }} --" required>
-                  {% for mbox_template in mbox_templates %}
-                    <option{% if mbox_template.template == iam_settings.templates[key] %} selected{% endif %}>
-                      {{ mbox_template.template }}
-                    </option>
-                  {% endfor %}
-                  </select>
-                </div>
-                <div class="col-2 p-0 d-flex">
-                  <button class="iam_ldap_rolemap_del btn btn-sm d-block d-sm-inline btn-secondary ms-auto"><i class="bi bi-x-lg"></i></button>
-                </div>
-              </div>
-            </div>
-            {% endfor %}
-            <div class="offset-md-3 col-12 col-md-9 col-lg-4 mb-2">
-              <div class="row px-2">
-                <div class="col-5 p-0 pe-2">
-                  <input type="text" class="form-control me-2" name="mappers" value="">
-                </div>
-                <div class="col-5 p-0 pe-2">
-                  <select data-live-search="true" name="templates" class="form-control" title="-- {{ lang.mailbox.template }} --">
-                  <option value="" selected>-- {{ lang.mailbox.template }} --</option>
-                  {% for mbox_template in mbox_templates %}
-                    <option>
-                      {{ mbox_template.template }}
-                    </option>
-                  {% endfor %}
-                  </select>
-                </div>
-                <div class="col-2 p-0 d-flex">
-                  <button class="iam_ldap_rolemap_del btn btn-sm d-block d-sm-inline btn-secondary ms-auto"><i class="bi bi-x-lg"></i></button>
-                </div>
-              </div>
+            <div class="col-12 col-md-9 col-lg-4">
+              <input type="text" class="form-control" id="iam_ldap_basedn" name="basedn" value="{{ iam_settings.basedn }}" placeholder="ou=people,dc=example,dc=org" required>
             </div>
           </div>
           <div class="row mb-2">
             <div class="col-md-3 d-flex align-items-center justify-content-md-end">
+              <i style="font-size: 16px; cursor: pointer;" class="bi bi-patch-question-fill mx-2 ms-0" data-bs-toggle="tooltip" data-bs-html="true" data-bs-placement="bottom" title="{{ lang.admin.iam_filter_info }}"></i>
+              <label class="control-label" for="iam_ldap_filter">{{ lang.admin.filter }}:</label>
+            </div>
+            <div class="col-12 col-md-9 col-lg-4">
+              <input type="text" class="form-control" placeholder="(objectClass=person)" id="iam_ldap_filter" name="filter" value="{{ iam_settings.filter }}">
+            </div>
+          </div>
+          <div class="row mb-2">
+            <div class="col-md-3 d-flex align-items-center justify-content-md-end">
+              <i style="font-size: 16px; cursor: pointer;" class="bi bi-patch-question-fill mx-2 ms-0" data-bs-toggle="tooltip" data-bs-html="true" data-bs-placement="bottom" title="{{ lang.admin.iam_username_field_info }}"></i>
+              <label class="control-label" for="iam_ldap_username_field">{{ lang.admin.iam_username_field }}:</label>
+            </div>
+            <div class="col-12 col-md-9 col-lg-4">
+              <input type="text" class="form-control" placeholder="mail" id="iam_ldap_username_field" name="username_field" value="{{ iam_settings.username_field }}">
+            </div>
+          </div>
+          <div class="row mb-2">
+            <div class="col-md-3 d-flex align-items-center justify-content-md-end">
+              <i style="font-size: 16px; cursor: pointer;" class="bi bi-patch-question-fill mx-2 ms-0" data-bs-toggle="tooltip" data-bs-html="true" data-bs-placement="bottom" title="{{ lang.admin.iam_id_attribute_info }}"></i>
+              <label class="control-label" for="iam_ldap_id_attribute">{{ lang.admin.iam_id_attribute }}:</label>
+            </div>
+            <div class="col-12 col-md-9 col-lg-4">
+              <input type="text" class="form-control" placeholder="objectGUID, entryUUID" id="iam_ldap_id_attribute" name="id_attribute" value="{{ iam_settings.id_attribute }}">
+            </div>
+          </div>
+          <div class="row mb-2">
+            <div class="col-md-3 d-flex align-items-center justify-content-md-end">
+              <i style="font-size: 16px; cursor: pointer;" class="bi bi-patch-question-fill mx-2 ms-0" data-bs-toggle="tooltip" data-bs-html="true" data-bs-placement="bottom" title="{{ lang.admin.iam_disabled_filter_info }}"></i>
+              <label class="control-label" for="iam_ldap_disabled_filter">{{ lang.admin.iam_disabled_filter }}:</label>
+            </div>
+            <div class="col-12 col-md-9 col-lg-4">
+              <input type="text" class="form-control" placeholder="(employeeType=inactive)" id="iam_ldap_disabled_filter" name="disabled_filter" value="{{ iam_settings.disabled_filter }}">
+            </div>
+          </div>
+          <legend class="fs-5 mt-4"><i class="bi bi-box-arrow-in-right"></i> {{ lang.admin.iam_section_login }}</legend><hr>
+          <div class="row mb-2">
+            <div class="col-md-3 d-flex align-items-center justify-content-md-end">
+              <i style="font-size: 16px; cursor: pointer;" class="bi bi-patch-question-fill mx-2 ms-0" data-bs-toggle="tooltip" data-bs-html="true" data-bs-placement="bottom" title="{{ lang.admin.iam_login_provisioning_info }}"></i>
               <label class="control-label">{{ lang.admin.iam_login_provisioning }}</label>
             </div>
-            <div class="col-12 col-md-9">
+            <div class="col-12 col-md-9 d-flex align-items-center">
               <div class="form-check form-switch">
-                <input class="form-check-input" type="checkbox" role="switch" name="login_provisioning"  value="1" {% if iam_settings.login_provisioning == 1 %}checked{% endif %}>
+                <input class="form-check-input" type="checkbox" role="switch" name="login_provisioning" value="1" {% if iam_settings.login_provisioning == 1 %}checked{% endif %}>
               </div>
             </div>
           </div>
+          <legend class="fs-5 mt-4"><i class="bi bi-file-earmark-text"></i> {{ lang.admin.iam_section_templates }}</legend><hr>
           <div class="row mb-2">
             <div class="col-md-3 d-flex align-items-center justify-content-md-end">
-              <label class="control-label">{{ lang.admin.iam_periodic_full_sync }}</label>
-            </div>
-            <div class="col-12 col-md-9">
-              <div class="form-check form-switch">
-                <input class="form-check-input" type="checkbox" role="switch" name="periodic_sync"  value="1" {% if iam_settings.periodic_sync == 1 %}checked{% endif %}>
-              </div>
-            </div>
-          </div>
-          <div class="row mb-2">
-            <div class="col-md-3 d-flex align-items-center justify-content-md-end">
-              <label class="control-label">{{ lang.admin.iam_import_users }}</label>
-            </div>
-            <div class="col-12 col-md-9">
-              <div class="form-check form-switch">
-                <input class="form-check-input" type="checkbox" role="switch" name="import_users"  value="1" {% if iam_settings.import_users == 1 %}checked{% endif %}>
-              </div>
-            </div>
-          </div>
-          <div class="row mb-2">
-            <div class="col-md-3 d-flex align-items-center justify-content-md-end">
-              <label class="control-label">{{ lang.admin.iam_sync_interval }}</label>
+              <i style="font-size: 16px; cursor: pointer;" class="bi bi-patch-question-fill mx-2 ms-0" data-bs-toggle="tooltip" data-bs-html="true" data-bs-placement="bottom" title="{{ lang.admin.iam_attribute_field_info }}"></i>
+              <label class="control-label" for="iam_ldap_attribute_field">{{ lang.admin.iam_attribute_field }}:</label>
             </div>
             <div class="col-12 col-md-9 col-lg-4">
-              <input class="form-control" type="number" min="1" name="sync_interval" style="width: 80px;"  {% if iam_settings.sync_interval %}value="{{ iam_settings.sync_interval }}"{% else %}value="15"{% endif %}>
+              <input type="text" class="form-control" id="iam_ldap_attribute_field" name="attribute_field" value="{{ iam_settings.attribute_field }}" placeholder="departmentNumber">
             </div>
           </div>
-          <div class="row mt-4 mb-2">
+          {% include 'admin/iam-template-mapping.twig' with {'iam_form': 'ldap'} %}
+          {% include 'admin/iam-sync-settings.twig' with {'iam_form': 'ldap'} %}
+          <hr class="mt-4">
+          <div class="row mb-2">
             <div class="offset-md-3 col-12 col-md-9 d-flex flex-wrap">
-              <div class="btn-group mb-2">
-                <button class="btn btn-sm d-block d-sm-inline btn-secondary iam_test_connection iam_test_connection" data-id="iam_ldap"><i class="bi bi-play"></i> {{ lang.admin.iam_test_connection }}</button>
-                <button class="btn btn-sm d-block d-sm-inline btn-success" data-item="identity-provider" data-action="edit_selected" data-id="iam_ldap" data-api-url='edit/identity-provider' data-api-attr='{}'><i class="bi bi-check-lg"></i> {{ lang.admin.save }}</button>
-              </div>
+              <button class="btn btn-sm d-block d-sm-inline btn-success mb-2" data-item="identity-provider" data-action="edit_selected" data-id="iam_ldap" data-api-url='edit/identity-provider' data-api-attr='{}'><i class="bi bi-check-lg"></i> {{ lang.admin.save }}</button>
               <button class="btn btn-sm d-block d-sm-inline btn-danger ms-auto mb-2" data-item="identity-provider" data-action="delete_selected" data-id="iam_ldap" data-api-url='delete/identity-provider'><i class="bi bi-trash"></i> {{ lang.mailbox.remove }}</button>
             </div>
           </div>
         </form>
       </div>
+      {% if iam_settings.authsource == 'keycloak' or iam_settings.authsource == 'ldap' %}
+      {% include 'admin/iam-sync-status.twig' %}
+      {% endif %}
     </div>
   </div>
 </div>

data/web/templates/edit.twig

@@ -27,6 +27,7 @@
   var lang_admin = {{ lang_admin|raw }};
   var lang_datatables = {{ lang_datatables|raw }};
   var lang_syncjobs = {{ lang_syncjobs|raw }};
+  var lang_groups = {{ lang_groups|raw }};
   var csrf_token = '{{ csrf_token }}';
   var pagination_size = Math.trunc('{{ pagination_size }}');
   var table_for_domain = '{{ domain }}';

data/web/templates/edit/mailbox-group-grant.twig

@@ -0,0 +1,49 @@
+{# One share row of the group edit page: kind = imap|sogo, grant = {} for the add template #}
+{% set level_key = kind == 'imap' ? 'rights' : 'access' %}
+{# new IMAP shares are subscribed by default, like automapping in Exchange #}
+{% set subscribed = grant.owner is defined ? grant.subscribe|default(0) == 1 : kind == 'imap' %}
+<tr class="group-grant">
+  <td class="{{ kind == 'imap' ? 'w-50' : 'w-25' }}">
+    <select data-grant="owner" data-live-search="true" data-width="100%" class="form-control" title="{{ lang.groups.grant_owner }}"{% if ro %} disabled{% endif %}>
+      {% for mailbox in mailboxes %}
+      <option{% if mailbox == grant.owner %} selected{% endif %}>{{ mailbox }}</option>
+      {% endfor %}
+      {% if grant.owner and grant.owner not in mailboxes %}
+      <option selected>{{ grant.owner }}</option>
+      {% endif %}
+    </select>
+  </td>
+  {% if kind == 'sogo' %}
+  <td>
+    <select data-grant="type" data-width="100%" class="form-control"{% if ro %} disabled{% endif %}>
+      <option value="Calendar"{% if grant.type == 'Calendar' %} selected{% endif %}>{{ lang.groups.type_calendar }}</option>
+      <option value="Contacts"{% if grant.type == 'Contacts' %} selected{% endif %}>{{ lang.groups.type_contacts }}</option>
+    </select>
+  </td>
+  <td class="w-25">
+    <input type="text" data-grant="folder" class="form-control" value="{{ grant.folder ?? 'personal' }}" maxlength="100" title="{{ lang.groups.grant_folder }}"{% if ro %} disabled{% endif %}>
+  </td>
+  {% endif %}
+  <td class="{{ kind == 'imap' ? 'w-25' : '' }}">
+    <select data-grant="{{ level_key }}" data-width="100%" class="form-control"{% if ro %} disabled{% endif %}>
+      {% for level in (kind == 'imap' ? ['read', 'write', 'full'] : ['read', 'write']) %}
+      <option value="{{ level }}"{% if level == attribute(grant, level_key)|default('read') %} selected{% endif %}>{{ attribute(lang.groups, 'rights_' ~ level) }}</option>
+      {% endfor %}
+    </select>
+  </td>
+  <td class="text-nowrap">
+    <div class="form-check mb-0" title="{{ attribute(lang.groups, 'grant_subscribe_' ~ kind ~ '_hint') }}">
+      <label><input type="checkbox" class="form-check-input" data-grant="subscribe" value="1"{% if subscribed %} checked{% endif %}{% if ro %} disabled{% endif %}> {{ lang.groups.grant_subscribe }}</label>
+    </div>
+  </td>
+  <td>
+    {% if grant.state %}
+    <span class="badge {{ grant.state == 'applied' ? 'bg-success' : (grant.state == 'failed' ? 'bg-danger' : 'bg-secondary') }}"{% if grant.last_error %} title="{{ grant.last_error }}"{% endif %}>{{ attribute(lang.groups, 'grant_state_' ~ grant.state) }}</span>
+    {% endif %}
+  </td>
+  <td class="text-end">
+    {% if not ro %}
+    <button class="btn btn-sm btn-secondary group-grant-del" title="{{ lang.mailbox.remove }}"><i class="bi bi-x-lg"></i></button>
+    {% endif %}
+  </td>
+</tr>

data/web/templates/edit/mailbox-group-grants.twig

@@ -0,0 +1,24 @@
+{# Shares of a group (edit page, add modal): kind = imap|sogo, grants, id = table id, ro; rows go to the hidden JSON field #}
+{% set field = kind ~ '_grants' %}
+<div class="row mb-2">
+  <label class="control-label col-sm-2{{ label_class|default('') }}">{{ attribute(lang.groups, field) }}</label>
+  <div class="col-sm-10">
+    {% if not ro %}
+    <input type="hidden" name="{{ field }}" value="{{ grants|json_encode }}">
+    {% endif %}
+    <table class="table table-sm align-middle group-grants mb-1" id="{{ id }}" data-field="{{ field }}">
+      <tbody>
+        {% for grant in grants %}
+        {% include 'edit/mailbox-group-grant.twig' with {'kind': kind, 'grant': grant} %}
+        {% endfor %}
+      </tbody>
+    </table>
+    {% if not ro %}
+    <template id="{{ id }}_template">
+      {% include 'edit/mailbox-group-grant.twig' with {'kind': kind, 'grant': {}} %}
+    </template>
+    <button class="btn btn-sm btn-secondary group-grant-add" data-table="{{ id }}"><i class="bi bi-plus-lg"></i> {{ lang.groups.grant_add }}</button>
+    {% endif %}
+    <small class="text-muted d-block">{{ attribute(lang.groups, field ~ '_hint') }}</small>
+  </div>
+</div>

data/web/templates/edit/mailbox-group.twig

@@ -0,0 +1,142 @@
+{% extends 'edit.twig' %}
+
+{% block inner_content %}
+{% if result %}
+{% set ro = not result.can_edit %}
+{% set editable_members = [] %}
+{% set fixed_members = [] %}
+{% for member in result.members %}
+  {% if member.source == 'idp' or member.username not in mailboxes %}
+    {% set fixed_members = fixed_members|merge([member]) %}
+  {% else %}
+    {% set editable_members = editable_members|merge([member.username]) %}
+  {% endif %}
+{% endfor %}
+<h4>{{ lang.groups.group }}: {{ result.name }}</h4>
+{% if result.idp_ref %}
+<div class="alert alert-secondary" role="alert"><span class="badge bg-info">{{ lang.groups.idp }}</span> {{ lang.groups.idp_ref }}: <code>{{ result.idp_ref }}</code></div>
+{% endif %}
+<form data-id="edit_mailbox_group" class="form-horizontal" role="form" method="post" autocapitalize="none" autocorrect="off">
+  <input type="hidden" value="0" name="active">
+  <input type="hidden" value="0" name="sender_allowed">
+  <input type="hidden" value="0" name="sogo_visible">
+  <input type="hidden" value="0" name="internal">
+  <input type="hidden" value="0" name="reapply_template">
+  {% if not ro %}
+  {# an empty selection still sends the field, so all editable members can be removed #}
+  <input type="hidden" value="" name="members">
+  {% endif %}
+  <div class="row mb-2">
+    <label class="control-label col-sm-2" for="group_domain">{{ lang.groups.domain }}</label>
+    <div class="col-sm-10">
+      <input type="text" class="form-control" id="group_domain" value="{{ result.domain }}" disabled>
+    </div>
+  </div>
+  <div class="row mb-2">
+    <label class="control-label col-sm-2" for="group_name">{{ lang.groups.name }}</label>
+    <div class="col-sm-10">
+      <input type="text" class="form-control" name="name" id="group_name" value="{{ result.name }}" maxlength="100" required{% if ro %} disabled{% endif %}>
+    </div>
+  </div>
+  <div class="row mb-2">
+    <label class="control-label col-sm-2" for="group_description">{{ lang.groups.description }}</label>
+    <div class="col-sm-10">
+      <input type="text" class="form-control" name="description" id="group_description" value="{{ result.description }}" maxlength="255"{% if ro %} disabled{% endif %}>
+    </div>
+  </div>
+  <div class="row mb-2">
+    <label class="control-label col-sm-2" for="group_address">{{ lang.groups.address }}</label>
+    <div class="col-sm-10">
+      <input type="text" class="form-control" name="address" id="group_address" value="{{ result.address }}" placeholder="name@{{ result.domain }}"{% if ro %} disabled{% endif %}>
+      <small class="text-muted">{{ lang.groups.address_hint }}</small>
+    </div>
+  </div>
+  <div class="row mb-2">
+    <label class="control-label col-sm-2" for="group_members">{{ lang.groups.members }}</label>
+    <div class="col-sm-10">
+      <select data-live-search="true" data-width="100%" name="members" id="group_members" class="form-control" multiple{% if ro %} disabled{% endif %}>
+        {% for mailbox in mailboxes %}
+        <option{% if mailbox in editable_members %} selected{% endif %}>{{ mailbox }}</option>
+        {% endfor %}
+      </select>
+      {% if fixed_members %}
+      <div class="mt-2">
+        {% for member in fixed_members %}
+        <span class="badge bg-secondary"{% if member.source == 'idp' %} title="{{ lang.groups.idp_member }}"{% endif %}>{% if member.source == 'idp' %}<i class="bi bi-cloud"></i> {% endif %}{{ member.username }}</span>
+        {% endfor %}
+      </div>
+      {% endif %}
+    </div>
+  </div>
+  <div class="row mb-2">
+    <label class="control-label col-sm-2" for="group_send_as">{{ lang.groups.send_as }}</label>
+    <div class="col-sm-10">
+      <textarea class="form-control" rows="3" name="send_as" id="group_send_as"{% if ro %} disabled{% endif %}>{{ result.send_as|join("\n") }}</textarea>
+      <small class="text-muted">{{ lang.groups.send_as_hint }}</small>
+    </div>
+  </div>
+  {% include 'edit/mailbox-group-grants.twig' with {'kind': 'imap', 'grants': result.imap_grants, 'id': 'group_imap_grants'} %}
+  {% if not skip_sogo %}
+  {% include 'edit/mailbox-group-grants.twig' with {'kind': 'sogo', 'grants': result.sogo_grants, 'id': 'group_sogo_grants'} %}
+  {% endif %}
+  <div class="row mb-2">
+    <div class="offset-sm-2 col-sm-10">
+      <div class="form-check">
+        <label><input type="checkbox" class="form-check-input" value="1" name="sender_allowed"{% if result.sender_allowed == 1 %} checked{% endif %}{% if ro %} disabled{% endif %}> {{ lang.groups.sender_allowed }}</label>
+      </div>
+      {% if not skip_sogo %}
+      <div class="form-check">
+        <label><input type="checkbox" class="form-check-input" value="1" name="sogo_visible"{% if result.sogo_visible == 1 %} checked{% endif %}{% if ro %} disabled{% endif %}> {{ lang.groups.sogo_visible }}</label>
+      </div>
+      {% endif %}
+      <div class="form-check">
+        <label><input type="checkbox" class="form-check-input" value="1" name="internal"{% if result.internal == 1 %} checked{% endif %}{% if ro %} disabled{% endif %}> {{ lang.groups.internal }}</label>
+      </div>
+    </div>
+  </div>
+  <div class="row mb-2">
+    <label class="control-label col-sm-2" for="group_template">{{ lang.groups.template }}</label>
+    {% if mailcow_cc_role == 'admin' %}
+    <div class="col-sm-6">
+      <select name="template_id" id="group_template" class="form-control">
+        <option value="">{{ lang.groups.template_none }}</option>
+        {% for template in mbox_templates %}
+        <option value="{{ template.id }}"{% if template.id == result.template_id %} selected{% endif %}>{{ template.template }}</option>
+        {% endfor %}
+      </select>
+    </div>
+    <label class="control-label col-sm-2" for="group_priority">{{ lang.groups.priority }}</label>
+    <div class="col-sm-2">
+      <input type="number" class="form-control" name="priority" id="group_priority" value="{{ result.priority }}">
+    </div>
+    <div class="offset-sm-2 col-sm-10">
+      <div class="form-check">
+        <label><input type="checkbox" class="form-check-input" value="1" name="reapply_template"> {{ lang.groups.reapply_template }}</label>
+      </div>
+      <small class="text-muted">{{ lang.groups.template_hint }}</small>
+    </div>
+    {% else %}
+    <div class="col-sm-10">
+      <input type="text" class="form-control" id="group_template" value="{% if result.template %}{{ result.template }} ({{ lang.groups.priority }} {{ result.priority }}){% else %}{{ lang.groups.template_none }}{% endif %}" disabled>
+    </div>
+    {% endif %}
+  </div>
+  <div class="row mb-4">
+    <div class="offset-sm-2 col-sm-10">
+      <div class="form-check">
+        <label><input type="checkbox" class="form-check-input" value="1" name="active"{% if result.active == 1 %} checked{% endif %}{% if ro %} disabled{% endif %}> {{ lang.groups.active }}</label>
+      </div>
+    </div>
+  </div>
+  {% if not ro %}
+  <div class="row">
+    <div class="offset-sm-2 col-sm-10">
+      <button class="btn btn-xs-lg d-block d-sm-inline btn-success" data-action="edit_selected" data-id="edit_mailbox_group" data-item="{{ result.id }}" data-api-url='edit/mailbox-group' data-api-attr='{}' href="#"><i class="bi bi-check-lg"></i> {{ lang.admin.save }}</button>
+    </div>
+  </div>
+  {% endif %}
+</form>
+{% else %}
+  {{ parent() }}
+{% endif %}
+{% endblock %}

data/web/templates/edit/mailbox.twig

@@ -24,6 +24,7 @@
                 <form class="form-horizontal" data-id="editmailbox" role="form" method="post">
                   <input type="hidden" value="default" name="sender_acl">
                   <input type="hidden" value="0" name="force_pw_update">
+                  <input type="hidden" value="0" name="shared">
                   <input type="hidden" value="0" name="force_tfa">
                   <input type="hidden" value="0" name="sogo_access">
                   <input type="hidden" value="0" name="protocol_access">
@@ -46,6 +47,20 @@
                       </select>
                     </div>
                   </div>
+                  {% if result.authsource != 'mailcow' and identity_link %}
+                  <div class="row mb-2">
+                    <label class="control-label col-sm-2">{{ lang.edit.iam_link }}</label>
+                    <div class="col-sm-10">
+                      {% if identity_link.external_id %}<code>{{ identity_link.external_id }}</code>{% else %}<span class="text-muted">{{ lang.edit.iam_not_linked }}</span>{% endif %}
+                      {% if identity_link.idp_disabled == 1 %}<span class="badge bg-warning text-dark">{{ lang.edit.iam_idp_disabled }}</span>{% endif %}
+                      {% if identity_link.missing_since %}<span class="badge bg-danger">{{ lang.edit.iam_missing_since }} {{ identity_link.missing_since }}</span>{% endif %}
+                      {% if mailcow_cc_role == 'admin' and identity_link.external_id %}
+                      <a href="#" class="btn btn-sm btn-secondary ms-2" data-action="delete_selected" data-id="identity_link" data-item="{{ mailbox }}" data-api-url="delete/identity-link"><i class="bi bi-link-45deg"></i> {{ lang.edit.iam_unlink }}</a>
+                      {% endif %}
+                      <small class="text-muted d-block">{{ lang.edit.iam_link_info }}</small>
+                    </div>
+                  </div>
+                  {% endif %}
                   <div class="row mb-2">
                     <label class="control-label col-sm-2" for="name">{{ lang.edit.full_name }}</label>
                     <div class="col-sm-10">
@@ -121,6 +136,22 @@
                       <small class="text-muted d-block">{{ lang.edit.sender_acl_info|raw }}</small>
                     </div>
                   </div>
+                  {% if mailbox_groups.groups %}
+                  <div class="row mb-2">
+                    <label class="control-label col-sm-2">{{ lang.groups.memberships }}</label>
+                    <div class="col-sm-10">
+                      {% for group in mailbox_groups.groups %}
+                      <a href="/edit/mailbox-group/{{ group.id }}" class="badge bg-secondary text-decoration-none">{% if group.source == 'idp' %}<i class="bi bi-cloud" title="{{ lang.groups.idp_member }}"></i> {% endif %}{{ group.name }}{% if group.address %} &lt;{{ group.address }}&gt;{% endif %}</a>
+                      {% endfor %}
+                      {% if mailbox_groups.template %}
+                      <small class="text-muted d-block">{{ lang.groups.effective_template }}: {{ mailbox_groups.template }}</small>
+                      {% endif %}
+                      {% if mailbox_groups.send_as %}
+                      <small class="text-muted d-block">{{ lang.groups.send_as_groups }}: {{ mailbox_groups.send_as|join(', ') }}</small>
+                      {% endif %}
+                    </div>
+                  </div>
+                  {% endif %}
                   {% if acl.mailbox_relayhost == '1' %}
                   <div class="row mb-2">
                     <label class="control-label col-sm-2" for="relayhost">{{ lang.edit.relayhost }}</label>
@@ -310,6 +341,14 @@
                       </select>
                     </div>
                   </div>
+                  <div class="row mt-2">
+                    <div class="offset-sm-2 col-sm-10">
+                      <div class="form-check">
+                        <label><input type="checkbox" class="form-check-input" value="1" name="shared"{% if result.attributes.shared == '1' %} checked{% endif %}> {{ lang.mailbox.shared_mailbox }}</label>
+                        <small class="text-muted">{{ lang.mailbox.shared_mailbox_info }}</small>
+                      </div>
+                    </div>
+                  </div>
                   <div class="row mt-2">
                     <div class="offset-sm-2 col-sm-10">
                       <div class="form-check">

data/web/templates/mailbox.twig

@@ -33,6 +33,9 @@
         <li role="presentation"><button class="dropdown-item" aria-selected="false" aria-controls="tab-domain-aliases" role="tab" data-bs-toggle="tab" data-bs-target="#tab-domain-aliases">{{ lang.mailbox.domain_aliases }}</button></li>
       </ul>
     </li>
+    {% if acl.mailbox_groups == 1 %}
+    <li class="nav-item" role="presentation"><button class="nav-link" aria-selected="false" aria-controls="tab-groups" role="tab" data-bs-toggle="tab" data-bs-target="#tab-groups">{{ lang.groups.groups }}</button></li>
+    {% endif %}
     <li class="nav-item" role="presentation"><button class="nav-link" aria-selected="false" aria-controls="tab-syncjobs" role="tab" data-bs-toggle="tab" data-bs-target="#tab-syncjobs">{{ lang.syncjobs.sync_jobs }}</button></li>
     <li class="nav-item" role="presentation"><button class="nav-link" aria-selected="false" aria-controls="tab-filters" role="tab" data-bs-toggle="tab" data-bs-target="#tab-filters">{{ lang.mailbox.filters }}</button></li>
     <li class="nav-item" role="presentation"><button class="nav-link" aria-selected="false" aria-controls="tab-bcc" role="tab" data-bs-toggle="tab" data-bs-target="#tab-bcc">{{ lang.mailbox.address_rewriting }}</button></li>
@@ -53,6 +56,9 @@
         {% include 'mailbox/tab-resources.twig' %}
         {% include 'mailbox/tab-domain-aliases.twig' %}
         {% include 'mailbox/tab-mbox-aliases.twig' %}
+        {% if acl.mailbox_groups == 1 %}
+        {% include 'mailbox/tab-groups.twig' %}
+        {% endif %}
         {% include 'mailbox/tab-syncjobs.twig' %}
         {% include 'mailbox/tab-filters.twig' %}
         {% include 'mailbox/tab-bcc.twig' %}
@@ -68,6 +74,7 @@
   var acl = '{{ acl_json|raw }}';
   var lang = {{ lang_mailbox|raw }};
   lang.syncjobs = {{ lang_syncjobs|raw }};
+  lang.groups = {{ lang_groups|raw }};
   var lang_rl = {{ lang_rl|raw }};
   var lang_edit = {{ lang_edit|raw }};
   var lang_datatables = {{ lang_datatables|raw }};

data/web/templates/mailbox/tab-groups.twig

@@ -0,0 +1,30 @@
+<div class="tab-pane fade" id="tab-groups" role="tabpanel" aria-labelledby="tab-groups">
+  <div class="card mb-4">
+    <div class="card-header d-flex fs-5">
+      <button class="btn d-md-none flex-grow-1 text-start" data-bs-target="#collapse-tab-groups" data-bs-toggle="collapse" aria-controls="collapse-tab-groups">
+        {{ lang.groups.groups }} <span class="badge bg-info table-lines"></span>
+      </button>
+      <span class="d-none d-md-block">{{ lang.groups.groups }} <span class="badge bg-info table-lines"></span></span>
+      <div class="btn-group ms-auto d-flex">
+        <button class="btn btn-xs btn-secondary refresh_table" data-table="mailbox_group_table">{{ lang.admin.refresh }}</button>
+      </div>
+    </div>
+    <div id="collapse-tab-groups" class="card-body collapse" data-bs-parent="#mail-content">
+      <p class="text-muted">{{ lang.groups.info }}</p>
+      <table id="mailbox_group_table" class="table table-striped dt-responsive w-100"></table>
+      <div class="mass-actions-mailbox mt-4">
+        <div class="btn-group">
+          <a class="btn btn-sm btn-xs-half d-block d-sm-inline btn-secondary" id="toggle_multi_select_all" data-id="mailbox_group" href="#"><i class="bi bi-check-all"></i> {{ lang.mailbox.toggle_all }}</a>
+          <a class="btn btn-sm btn-xs-half d-block d-sm-inline btn-secondary dropdown-toggle" data-bs-toggle="dropdown" href="#">{{ lang.mailbox.quick_actions }}</a>
+          <ul class="dropdown-menu">
+            <li><a class="dropdown-item" data-action="edit_selected" data-id="mailbox_group" data-api-url='edit/mailbox-group' data-api-attr='{"active":"1"}' href="#">{{ lang.mailbox.activate }}</a></li>
+            <li><a class="dropdown-item" data-action="edit_selected" data-id="mailbox_group" data-api-url='edit/mailbox-group' data-api-attr='{"active":"0"}' href="#">{{ lang.mailbox.deactivate }}</a></li>
+            <li><hr class="dropdown-divider"></li>
+            <li><a class="dropdown-item" data-action="delete_selected" data-id="mailbox_group" data-api-url='delete/mailbox-group' href="#">{{ lang.mailbox.remove }}</a></li>
+          </ul>
+          <a class="btn btn-sm d-block d-sm-inline btn-success" href="#" data-bs-toggle="modal" data-bs-target="#addMailboxGroupModal"><i class="bi bi-plus-lg"></i> {{ lang.groups.add }}</a>
+        </div>
+      </div>
+    </div>
+  </div>
+</div>

data/web/templates/modals/mailbox.twig

@@ -197,6 +197,14 @@
               </select>
             </div>
           </div>
+          <div class="row">
+            <div class="offset-sm-2 col-sm-10">
+              <div class="form-check">
+                <label><input type="checkbox" class="form-check-input" value="1" name="shared" id="add_mailbox_shared"> {{ lang.mailbox.shared_mailbox }}</label>
+                <small class="text-muted">{{ lang.mailbox.shared_mailbox_info }}</small>
+              </div>
+            </div>
+          </div>
           <div class="row">
             <div class="offset-sm-2 col-sm-10">
               <div class="form-check">
@@ -1351,3 +1359,6 @@
 </div><!-- DNS info modal -->
 
 {% include "modals/imapsync_source.twig" %}
+{% if acl.mailbox_groups == 1 %}
+{% include "modals/mailbox_group.twig" %}
+{% endif %}

data/web/templates/modals/mailbox_group.twig

@@ -0,0 +1,119 @@
+<!-- add mailbox group modal -->
+<div class="modal fade" id="addMailboxGroupModal" tabindex="-1" role="dialog" aria-hidden="true">
+  <div class="modal-dialog modal-xl">
+    <div class="modal-content">
+      <div class="modal-header">
+        <h3 class="modal-title">{{ lang.groups.add }}</h3>
+        <button type="button" class="btn-close" data-bs-dismiss="modal"></button>
+      </div>
+      <div class="modal-body">
+        <form class="form-horizontal" role="form" data-id="add_mailbox_group" autocapitalize="none" autocorrect="off">
+          <input type="hidden" value="0" name="active">
+          <input type="hidden" value="0" name="sender_allowed">
+          <input type="hidden" value="0" name="sogo_visible">
+          <input type="hidden" value="0" name="internal">
+          <div class="row mb-2">
+            <label class="control-label col-sm-2 text-sm-end" for="add_group_domain">{{ lang.groups.domain }}</label>
+            <div class="col-sm-10">
+              <select data-live-search="true" name="domain" id="add_group_domain" class="form-control mailbox-group-domain-select" required>
+                {% for domain in domains %}
+                <option>{{ domain }}</option>
+                {% endfor %}
+              </select>
+            </div>
+          </div>
+          <div class="row mb-2">
+            <label class="control-label col-sm-2 text-sm-end" for="add_group_name">{{ lang.groups.name }}</label>
+            <div class="col-sm-10">
+              <input type="text" class="form-control" name="name" id="add_group_name" maxlength="100" required>
+            </div>
+          </div>
+          <div class="row mb-2">
+            <label class="control-label col-sm-2 text-sm-end" for="add_group_description">{{ lang.groups.description }}</label>
+            <div class="col-sm-10">
+              <input type="text" class="form-control" name="description" id="add_group_description" maxlength="255">
+            </div>
+          </div>
+          <div class="row mb-2">
+            <label class="control-label col-sm-2 text-sm-end" for="add_group_local_part">{{ lang.groups.address }}</label>
+            <div class="col-sm-10">
+              <div class="input-group">
+                <input type="text" class="form-control" name="local_part" id="add_group_local_part">
+                <span class="input-group-text">@<span class="mailbox-group-domain">{{ domains|first }}</span></span>
+              </div>
+              <small class="text-muted">{{ lang.groups.address_hint }}</small>
+            </div>
+          </div>
+          <div class="row mb-2">
+            <label class="control-label col-sm-2 text-sm-end" for="add_group_members">{{ lang.groups.members }}</label>
+            <div class="col-sm-10">
+              <select data-live-search="true" data-width="100%" name="members" id="add_group_members" class="form-control" multiple>
+                {% for mailbox in mailboxes %}
+                <option>{{ mailbox }}</option>
+                {% endfor %}
+              </select>
+            </div>
+          </div>
+          <div class="row mb-2">
+            <label class="control-label col-sm-2 text-sm-end" for="add_group_send_as">{{ lang.groups.send_as }}</label>
+            <div class="col-sm-10">
+              <textarea class="form-control" rows="3" name="send_as" id="add_group_send_as"></textarea>
+              <small class="text-muted">{{ lang.groups.send_as_hint }}</small>
+            </div>
+          </div>
+          {% include 'edit/mailbox-group-grants.twig' with {'kind': 'imap', 'grants': [], 'id': 'add_group_imap_grants', 'ro': false, 'label_class': ' text-sm-end'} %}
+          {% if not skip_sogo %}
+          {% include 'edit/mailbox-group-grants.twig' with {'kind': 'sogo', 'grants': [], 'id': 'add_group_sogo_grants', 'ro': false, 'label_class': ' text-sm-end'} %}
+          {% endif %}
+          <div class="row mb-2">
+            <div class="offset-sm-2 col-sm-10">
+              <div class="form-check">
+                <label><input type="checkbox" class="form-check-input" value="1" name="sender_allowed"> {{ lang.groups.sender_allowed }}</label>
+              </div>
+              {% if not skip_sogo %}
+              <div class="form-check">
+                <label><input type="checkbox" class="form-check-input" value="1" name="sogo_visible"> {{ lang.groups.sogo_visible }}</label>
+              </div>
+              {% endif %}
+              <div class="form-check">
+                <label><input type="checkbox" class="form-check-input" value="1" name="internal"> {{ lang.groups.internal }}</label>
+              </div>
+            </div>
+          </div>
+          {% if mailcow_cc_role == 'admin' %}
+          <div class="row mb-2">
+            <label class="control-label col-sm-2 text-sm-end" for="add_group_template">{{ lang.groups.template }}</label>
+            <div class="col-sm-6">
+              <select name="template_id" id="add_group_template" class="form-control">
+                <option value="">{{ lang.groups.template_none }}</option>
+                {% for template in mbox_templates %}
+                <option value="{{ template.id }}">{{ template.template }}</option>
+                {% endfor %}
+              </select>
+            </div>
+            <label class="control-label col-sm-2 text-sm-end" for="add_group_priority">{{ lang.groups.priority }}</label>
+            <div class="col-sm-2">
+              <input type="number" class="form-control" name="priority" id="add_group_priority" value="0">
+            </div>
+            <div class="offset-sm-2 col-sm-10">
+              <small class="text-muted">{{ lang.groups.template_hint }}</small>
+            </div>
+          </div>
+          {% endif %}
+          <div class="row mb-4">
+            <div class="offset-sm-2 col-sm-10">
+              <div class="form-check">
+                <label><input type="checkbox" class="form-check-input" value="1" name="active" checked> {{ lang.groups.active }}</label>
+              </div>
+            </div>
+          </div>
+          <div class="row mb-4">
+            <div class="offset-sm-2 col-sm-10">
+              <button class="btn btn-xs-lg d-block d-sm-inline btn-success" data-action="add_item" data-id="add_mailbox_group" data-api-url='add/mailbox-group' data-api-attr='{}' href="#">{{ lang.admin.add }}</button>
+            </div>
+          </div>
+        </form>
+      </div>
+    </div>
+  </div>
+</div><!-- add mailbox group modal -->

data/web/templates/user/tab-user-details.twig

@@ -61,6 +61,18 @@
           <p>{% if not user_get_alias_details.aliases_send_as_all %}<i class="bi bi-x-lg"></i>{% else %}{{ user_get_alias_details.aliases_send_as_all }}{% endif %}</p>
         </div>
       </div>
+      <div class="row">
+        <div class="col-sm-4 col-md-3 col-12 text-sm-end text-start mb-4"><i class="bi bi-people"></i> {{ lang.groups.memberships }}:</div>
+        <div class="col-sm-8 col-md-9 col-12">
+          <p>
+          {% for group in mailbox_groups.groups %}
+            {{ group.name }}{% if group.address %} &lt;{{ group.address }}&gt;{% endif %}{% if not loop.last %}<br>{% endif %}
+          {% else %}
+            <i class="bi bi-x-lg"></i>
+          {% endfor %}
+          </p>
+        </div>
+      </div>
       <div class="row">
         <div class="col-sm-4 col-md-3 col-12 text-sm-end text-start mb-4">{{ lang.user.is_catch_all }}:</div>
         <div class="col-sm-8 col-md-9 col-12">

data/web/user.php

@@ -64,6 +64,7 @@ $template_data = [
   'mailboxdata' => $mailboxdata,
   'clientconfigstr' => $clientconfigstr,
   'user_get_alias_details' => $user_get_alias_details,
+  'mailbox_groups' => \Mailcow\MailboxGroup\MailboxGroupModule::fromGlobals()->api->getMemberships($username),
   'get_tagging_options' => mailbox('get', 'delimiter_action', $username),
   'get_tls_policy' => mailbox('get', 'tls_policy', $username),
   'quarantine_notification' => mailbox('get', 'quarantine_notification', $username),

docker-compose.yml

@@ -1,3 +1,6 @@
+# Version of the database schema
+x-db-version: &db_version DB_VERSION=26102026_1200
+
 services:
 
     unbound-mailcow:
@@ -150,6 +153,7 @@ services:
       dns:
         - ${IPV4_NETWORK:-172.22.1}.254
       environment:
+        - *db_version
         - REDIS_SLAVEOF_IP=${REDIS_SLAVEOF_IP:-}
         - REDIS_SLAVEOF_PORT=${REDIS_SLAVEOF_PORT:-}
         - REDISPASS=${REDISPASS}
@@ -188,12 +192,12 @@ services:
       restart: always
       labels:
         ofelia.enabled: "true"
-        ofelia.job-exec.phpfpm_keycloak_sync.schedule: "0 * * * * *"
-        ofelia.job-exec.phpfpm_keycloak_sync.no-overlap: "true"
-        ofelia.job-exec.phpfpm_keycloak_sync.command: "/bin/bash -c \"php /crons/keycloak-sync.php || exit 0\""
-        ofelia.job-exec.phpfpm_ldap_sync.schedule: "0 * * * * *"
-        ofelia.job-exec.phpfpm_ldap_sync.no-overlap: "true"
-        ofelia.job-exec.phpfpm_ldap_sync.command: "/bin/bash -c \"php /crons/ldap-sync.php || exit 0\""
+        ofelia.job-exec.phpfpm_identity_sync.schedule: "0 * * * * *"
+        ofelia.job-exec.phpfpm_identity_sync.no-overlap: "true"
+        ofelia.job-exec.phpfpm_identity_sync.command: "/bin/bash -c \"php /crons/identity-sync.php || exit 0\""
+        ofelia.job-exec.phpfpm_group_grants.schedule: "0 * * * * *"
+        ofelia.job-exec.phpfpm_group_grants.no-overlap: "true"
+        ofelia.job-exec.phpfpm_group_grants.command: "/bin/bash -c \"php /crons/group-grants.php || exit 0\""
         ofelia.job-exec.phpfpm_imapsync_oauth_refresh.schedule: "0 * * * * *"
         ofelia.job-exec.phpfpm_imapsync_oauth_refresh.no-overlap: "true"
         ofelia.job-exec.phpfpm_imapsync_oauth_refresh.command: "/bin/bash -c \"php /crons/imapsync-oauth-refresh.php || exit 0\""
@@ -205,6 +209,7 @@ services:
     sogo-mailcow:
       image: ghcr.io/mailcow/sogo:5.12.12-1
       environment:
+        - *db_version
         - DBNAME=${DBNAME}
         - DBUSER=${DBUSER}
         - DBPASS=${DBPASS}
@@ -227,7 +232,6 @@ services:
       volumes:
         - ./data/hooks/sogo:/hooks:Z
         - ./data/conf/sogo/:/etc/sogo/:z
-        - ./data/web/inc/init_db.inc.php:/init_db.inc.php:z
         - ./data/conf/sogo/custom-favicon.ico:/usr/local/lib/GNUstep/SOGo/WebServerResources/img/sogo.ico:z
         - ./data/conf/sogo/custom-shortlogo.svg:/usr/local/lib/GNUstep/SOGo/WebServerResources/img/sogo-compact.svg:z
         - ./data/conf/sogo/custom-fulllogo.svg:/usr/local/lib/GNUstep/SOGo/WebServerResources/img/sogo-full.svg:z
@@ -278,6 +282,7 @@ services:
         - rspamd-vol-1:/var/lib/rspamd
         - mysql-socket-vol-1:/var/run/mysqld/:z
       environment:
+        - *db_version
         - DOVECOT_MASTER_USER=${DOVECOT_MASTER_USER:-}
         - DOVECOT_MASTER_PASS=${DOVECOT_MASTER_PASS:-}
         - MAILCOW_REPLICA_IP=${MAILCOW_REPLICA_IP:-}

tests/php/Auth/Service/IdpLoginServiceTest.php

@@ -0,0 +1,67 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Mailcow\Tests\Auth\Service;
+
+use Mailcow\Auth\Service\IdpLoginService;
+use Mailcow\Identity\Model\Settings;
+use Mailcow\Identity\Service\LinkService;
+use Mailcow\MailboxGroup\Service\TemplateService;
+use PDOException;
+use PHPUnit\Framework\TestCase;
+
+class IdpLoginServiceTest extends TestCase
+{
+    public function testLinkErrorsDenyTheLogin(): void
+    {
+        $links = $this->createMock(LinkService::class);
+        $links->method('verify')->willThrowException(new PDOException('gone'));
+        $links->method('mayCreate')->willThrowException(new PDOException('gone'));
+        $links->method('link')->willThrowException(new PDOException('gone'));
+        $login = new IdpLoginService(Settings::fromArray([]), $links, $this->createMock(TemplateService::class));
+
+        $this->assertFalse($login->verifyLink('keycloak', 'a@example.org', 'u1'));
+        $this->assertFalse($login->mayCreate('keycloak', 'a@example.org', 'u1'));
+        $login->storeLink('keycloak', 'a@example.org', 'u1');
+    }
+
+    public function testLinkChecksArePassedOn(): void
+    {
+        $links = $this->createMock(LinkService::class);
+        $links->method('verify')->with('ldap', 'a@example.org', 'guid-1')->willReturn(true);
+        $links->method('mayCreate')->with('ldap', 'b@example.org', 'guid-2')->willReturn(false);
+        $links->expects($this->once())->method('link')->with('ldap', 'c@example.org', 'guid-3');
+        $login = new IdpLoginService(Settings::fromArray([]), $links, $this->createMock(TemplateService::class));
+
+        $this->assertTrue($login->verifyLink('ldap', 'a@example.org', 'guid-1'));
+        $this->assertFalse($login->mayCreate('ldap', 'b@example.org', 'guid-2'));
+        $login->storeLink('ldap', 'c@example.org', 'guid-3');
+    }
+
+    public function testGroupTemplateWinsAndErrorsFallBackToTheMapping(): void
+    {
+        $templates = $this->createMock(TemplateService::class);
+        $templates->method('templateForLogin')->willReturnCallback(function (string $username, ?string $mapped): ?string {
+            if ($username === 'broken@example.org') {
+                throw new PDOException('gone');
+            }
+            return 'Group';
+        });
+        $login = new IdpLoginService(Settings::fromArray([]), $this->createMock(LinkService::class), $templates);
+
+        $this->assertSame('Group', $login->templateFor('a@example.org', 'Staff'));
+        $this->assertSame('Staff', $login->templateFor('broken@example.org', 'Staff'));
+    }
+
+    public function testMappingTakesSingleValuesAndLists(): void
+    {
+        $settings = Settings::fromArray(['mappers' => ['default', 'sales'], 'templates' => ['Staff', 'Sales']]);
+        $login = new IdpLoginService($settings, $this->createMock(LinkService::class), $this->createMock(TemplateService::class));
+
+        $this->assertSame('Staff', $login->mappedTemplate('default'));
+        $this->assertSame('Sales', $login->mappedTemplate(['other', 'sales']));
+        $this->assertNull($login->mappedTemplate(null));
+        $this->assertNull($login->mappedTemplate(['unknown']));
+    }
+}

tests/php/Core/ApiResponseTest.php

@@ -29,6 +29,17 @@ class ApiResponseTest extends TestCase
         ], $response->messages());
     }
 
+    public function testWarningsKeepTheCallSuccessful(): void
+    {
+        $response = new ApiResponse();
+
+        $response->warning(['group_template_failed', 'Staff', 'a@example.org'], ['mailbox_group', 'edit', 'group', []]);
+
+        $this->assertSame([
+            ['type' => 'warning', 'log' => ['mailbox_group', 'edit', 'group', []], 'msg' => ['group_template_failed', 'Staff', 'a@example.org']],
+        ], $response->messages());
+    }
+
     public function testSecretsAreMaskedInArrayLogParts(): void
     {
         $response = new ApiResponse(['password1', 'oauth_client_secret']);

tests/php/Core/ContextTest.php

@@ -4,6 +4,7 @@ declare(strict_types=1);
 
 namespace Mailcow\Tests\Core;
 
+use Mailcow\Core\AccessDenied;
 use Mailcow\Core\Context;
 use Mailcow\Tests\Support\LegacyAclCalls;
 use PHPUnit\Framework\TestCase;
@@ -84,6 +85,30 @@ class ContextTest extends TestCase
         $this->assertFalse($context->hasAcl('syncjobs'));
     }
 
+    public function testAdminRightsComeFromTheRoleOrAccessAll(): void
+    {
+        $this->assertTrue((new Context('admin', 'admin'))->hasAdminRights());
+        $this->assertTrue((new Context('user', 'user@example.org', [], true))->hasAdminRights());
+        $this->assertFalse((new Context('domainadmin', 'da'))->hasAdminRights());
+        $this->assertFalse(Context::system()->hasAdminRights());
+    }
+
+    public function testReadOnlyApiKeysMayOnlyRead(): void
+    {
+        $readOnly = new Context('admin', 'admin', [], false, 'ro');
+        $readOnly->requireAdmin(false);
+        (new Context('admin', 'admin', [], false, 'rw'))->requireAdmin();
+
+        $this->expectException(AccessDenied::class);
+        $readOnly->requireAdmin();
+    }
+
+    public function testRequireAdminDeniesOtherRoles(): void
+    {
+        $this->expectException(AccessDenied::class);
+        (new Context('domainadmin', 'da'))->requireAdmin(false);
+    }
+
     public function testBridgePassesUsernameAndRoleToTheLegacyFunctions(): void
     {
         $context = new Context('user', 'user@example.org');

tests/php/Dovecot/Service/DovecotServiceTest.php

@@ -0,0 +1,60 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Mailcow\Tests\Dovecot\Service;
+
+use Mailcow\Dovecot\Service\DovecotService;
+use PHPUnit\Framework\TestCase;
+
+class DovecotServiceTest extends TestCase
+{
+    public function testAclOnAllFolders(): void
+    {
+        $dovecot = new FakeDovecot(['type' => 'success', 'msg' => 'command completed successfully']);
+
+        $this->assertNull($dovecot->setAclAll('shared@example.org', 'group=mcg_7', ['lookup', 'read']));
+        $this->assertSame([['cmd' => 'doveadm', 'task' => 'set_acl_all', 'user' => 'shared@example.org', 'id' => 'group=mcg_7',
+            'rights' => ['lookup', 'read']]], $dovecot->calls);
+    }
+
+    public function testErrorsOfDockerapiAreReturned(): void
+    {
+        $this->assertSame('command failed: no such user', (new FakeDovecot(['type' => 'danger', 'msg' => 'command failed: no such user']))
+            ->setAclAll('x@example.org', 'group=mcg_7', []));
+        $this->assertSame('dockerapi did not answer', (new FakeDovecot(false))->setAclAll('x@example.org', 'group=mcg_7', []));
+    }
+
+    public function testSharedFoldersAreSubscribedThroughDockerapi(): void
+    {
+        $dovecot = new FakeDovecot(['type' => 'success']);
+
+        $this->assertNull($dovecot->subscribeShared('team@example.org', ['a@example.org'], true));
+        $this->assertSame([['cmd' => 'doveadm', 'task' => 'subscribe_shared', 'owner' => 'team@example.org', 'users' => ['a@example.org'],
+            'unsubscribe' => true]], $dovecot->calls);
+    }
+
+    public function testAuthCacheFlushOnlyWithUsers(): void
+    {
+        $dovecot = new FakeDovecot([]);
+        $dovecot->flushAuthCache([]);
+        $dovecot->flushAuthCache(['a@example.org']);
+
+        $this->assertSame([['cmd' => 'doveadm', 'task' => 'auth_cache_flush', 'users' => ['a@example.org']]], $dovecot->calls);
+    }
+}
+
+class FakeDovecot extends DovecotService
+{
+    public array $calls = [];
+
+    public function __construct(private mixed $result)
+    {
+    }
+
+    protected function exec(array $fields): mixed
+    {
+        $this->calls[] = $fields;
+        return is_array($this->result) ? json_encode($this->result) : $this->result;
+    }
+}

tests/php/Identity/Directory/KeycloakDirectoryTest.php

@@ -0,0 +1,117 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Mailcow\Tests\Identity\Directory;
+
+use Mailcow\Identity\Directory\DirectoryException;
+use Mailcow\Identity\Directory\KeycloakDirectory;
+use Mailcow\Identity\Http\KeycloakClient;
+use Mailcow\Identity\Model\Settings;
+use PHPUnit\Framework\TestCase;
+
+class KeycloakDirectoryTest extends TestCase
+{
+    public function testListsAllPagesOfUsers(): void
+    {
+        $users = [];
+        for ($i = 1; $i <= 150; $i++) {
+            $users[] = ['id' => "u$i", 'email' => "User$i@Example.org", 'firstName' => 'User', 'lastName' => (string)$i, 'enabled' => $i !== 2,
+                'attributes' => ['mailcow_template' => ['staff']]];
+        }
+        $client = new FakeKeycloakClient(['/users' => $users]);
+
+        $listing = (new KeycloakDirectory($client, Settings::fromArray([])))->listAll(false);
+
+        $this->assertCount(150, $listing->users);
+        $this->assertNull($listing->groups);
+        $this->assertSame('user1@example.org', $listing->users['u1']->email);
+        $this->assertSame('User 1', $listing->users['u1']->name);
+        $this->assertSame(['staff'], $listing->users['u1']->templateValues);
+        $this->assertFalse($listing->users['u2']->enabled);
+        $this->assertSame(['/users?briefRepresentation=false&first=0&max=100', '/users?briefRepresentation=false&first=100&max=100'],
+            $client->paths());
+    }
+
+    public function testSelectsGroupsByPathWithChildrenAndListedMembers(): void
+    {
+        $client = new FakeKeycloakClient([
+            '/users' => [['id' => 'u1', 'email' => 'a@example.org', 'enabled' => true], ['id' => 'u2', 'email' => 'b@example.org', 'enabled' => true]],
+            '/groups' => [
+                ['id' => 'g1', 'name' => 'mailcow', 'path' => '/mailcow', 'subGroupCount' => 2, 'subGroups' => []],
+                ['id' => 'g4', 'name' => 'Other', 'path' => '/Other', 'subGroups' => []],
+            ],
+            '/groups/g1/children' => [
+                ['id' => 'g2', 'name' => 'Sales', 'path' => '/mailcow/Sales'],
+                ['id' => 'g3', 'name' => 'Support', 'path' => '/mailcow/Support', 'attributes' => ['mail' => ['Support@Example.org']]],
+            ],
+            '/groups/g2/members' => [['id' => 'u1'], ['id' => 'u2'], ['id' => 'not-listed']],
+            '/groups/g3/members' => [],
+            '/groups/g4/members' => [],
+        ]);
+
+        $listing = (new KeycloakDirectory($client, Settings::fromArray(['group_paths' => '/mailcow/*, /Other'])))->listAll(true);
+
+        $this->assertSame(['g2', 'g3', 'g4'], array_keys($listing->groups));
+        $this->assertSame(['u1', 'u2'], $listing->groups['g2']->memberIds);
+        $this->assertSame('support@example.org', $listing->groups['g3']->mail);
+        $this->assertSame('Other', $listing->groups['g4']->name);
+    }
+
+    public function testRejectedTokenIsRenewedOnce(): void
+    {
+        $client = new FakeKeycloakClient(['/users' => []], 1);
+
+        (new KeycloakDirectory($client, Settings::fromArray([])))->listAll(false);
+
+        $this->assertSame(2, $client->tokens);
+    }
+
+    public function testHttpErrorsAbortTheListing(): void
+    {
+        $client = new FakeKeycloakClient(['/users' => 500]);
+
+        $this->expectException(DirectoryException::class);
+        $this->expectExceptionMessage('Keycloak returned HTTP 500 for /users');
+        (new KeycloakDirectory($client, Settings::fromArray([])))->listAll(false);
+    }
+}
+
+/**
+ * Keycloak admin API in memory: routes are paths below the realm with a list (paged by first/max) or an HTTP status.
+ */
+class FakeKeycloakClient extends KeycloakClient
+{
+    public int $tokens = 0;
+    private array $requests = [];
+
+    public function __construct(private array $routes, private int $rejectTokens = 0)
+    {
+        parent::__construct('https://kc.example.org', 'mailcow', 'mailcow', 'secret');
+    }
+
+    /** @return string[] requested paths with query, token requests excluded */
+    public function paths(): array
+    {
+        return $this->requests;
+    }
+
+    protected function send(string $method, string $url, array $headers, ?string $body): array
+    {
+        if (str_ends_with($url, '/protocol/openid-connect/token')) {
+            $this->tokens++;
+            return [200, json_encode(['access_token' => 'token' . $this->tokens])];
+        }
+        if ($this->rejectTokens > 0 && in_array('Authorization: Bearer token1', $headers, true)) {
+            return [401, ''];
+        }
+        $path = substr((string)parse_url($url, PHP_URL_PATH), strlen('/admin/realms/mailcow'));
+        parse_str((string)parse_url($url, PHP_URL_QUERY), $query);
+        $this->requests[] = $path . '?' . http_build_query($query);
+        $route = $this->routes[$path] ?? 404;
+        if (is_int($route)) {
+            return [$route, ''];
+        }
+        return [200, json_encode(array_slice($route, (int)($query['first'] ?? 0), (int)($query['max'] ?? count($route))))];
+    }
+}

tests/php/Identity/Directory/LdapDirectoryTest.php

@@ -0,0 +1,153 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Mailcow\Tests\Identity\Directory;
+
+use Closure;
+use Mailcow\Identity\Directory\DirectoryException;
+use Mailcow\Identity\Directory\LdapDirectory;
+use Mailcow\Identity\Model\Settings;
+use PHPUnit\Framework\TestCase;
+
+class LdapDirectoryTest extends TestCase
+{
+    private const BASE = 'dc=example,dc=org';
+
+    public function testUsersWithIdsAndDisabledStates(): void
+    {
+        $directory = new FakeLdapDirectory(['basedn' => self::BASE, 'filter' => 'objectClass=person', 'disabled_filter' => '(employeeType=left)'],
+            function (string $base, string $filter): array {
+                if (str_contains($filter, 'employeeType=left')) {
+                    return [self::entry('cn=c,ou=people,dc=example,dc=org', [])];
+                }
+                return [
+                    self::entry('CN=A,ou=people,dc=example,dc=org', ['mail' => 'A@example.org', 'displayname' => 'A User',
+                        'objectguid' => hex2bin('0123456789abcdef0123456789abcdef'), 'useraccountcontrol' => '512']),
+                    self::entry('cn=b,ou=people,dc=example,dc=org', ['mail' => 'b@example.org', 'cn' => 'B',
+                        'entryuuid' => 'F81D4FAE-7DEC-11D0-A765-00A0C91E6BF6', 'useraccountcontrol' => '514']),
+                    self::entry('cn=c,ou=people,dc=example,dc=org', ['mail' => 'c@example.org']),
+                ];
+            });
+
+        $users = $directory->listAll(false)->users;
+
+        $this->assertSame(['67452301-ab89-efcd-0123-456789abcdef', 'f81d4fae-7dec-11d0-a765-00a0c91e6bf6', 'dn:cn=c,ou=people,dc=example,dc=org'],
+            array_keys($users));
+        $user = $users['67452301-ab89-efcd-0123-456789abcdef'];
+        $this->assertSame(['a@example.org', 'A User', true], [$user->email, $user->name, $user->enabled]);
+        $this->assertFalse($users['f81d4fae-7dec-11d0-a765-00a0c91e6bf6']->enabled);
+        $this->assertFalse($users['dn:cn=c,ou=people,dc=example,dc=org']->enabled);
+        $this->assertSame('(&(&(objectClass=person)(mail=*))(employeeType=left))', $directory->searches[0][1]);
+        $this->assertSame('(&(objectClass=person)(mail=*))', $directory->searches[1][1]);
+    }
+
+    public function testConfiguredIdAttributeWins(): void
+    {
+        $entry = self::entry('cn=a,dc=example,dc=org', ['employeenumber' => 'E-17', 'entryuuid' => 'x']);
+
+        $this->assertSame('e-17', LdapDirectory::entryId($entry, 'employeenumber'));
+        $this->assertSame('x', LdapDirectory::entryId($entry));
+    }
+
+    public function testMembersFromMemberOf(): void
+    {
+        $directory = new FakeLdapDirectory(['basedn' => self::BASE, 'group_filter' => '(objectClass=groupOfNames)'],
+            function (string $base, string $filter, array $attributes): array {
+                if ($filter === '(objectClass=groupOfNames)') {
+                    $this->assertContains('mail', $attributes);
+                    return [self::entry('CN=Sales,ou=groups,dc=example,dc=org', ['cn' => 'Sales', 'entryuuid' => 'g1', 'mail' => 'Sales@example.org'])];
+                }
+                $this->assertContains('memberof', $attributes);
+                return [
+                    self::entry('cn=a,dc=example,dc=org', ['mail' => 'a@example.org', 'entryuuid' => 'u1', 'memberof' => ['cn=sales,ou=groups,dc=example,dc=org']]),
+                    self::entry('cn=b,dc=example,dc=org', ['mail' => 'b@example.org', 'entryuuid' => 'u2', 'memberof' => ['cn=other,dc=example,dc=org']]),
+                ];
+            });
+
+        $groups = $directory->listAll(true)->groups;
+
+        $this->assertSame(['g1'], array_keys($groups));
+        $this->assertSame(['Sales', 'sales@example.org', ['u1']], [$groups['g1']->name, $groups['g1']->mail, $groups['g1']->memberIds]);
+    }
+
+    public function testMembersFromTheMemberAttribute(): void
+    {
+        $directory = new FakeLdapDirectory(['basedn' => self::BASE, 'group_filter' => 'objectClass=groupOfNames', 'group_member_mode' => 'member'],
+            fn(string $base, string $filter): array => ($filter === '(objectClass=groupOfNames)')
+                ? [self::entry('cn=sales,dc=example,dc=org', ['cn' => 'Sales', 'entryuuid' => 'g1',
+                    'member' => ['CN=A,dc=example,dc=org', 'cn=unknown,dc=example,dc=org']])]
+                : [self::entry('cn=a,dc=example,dc=org', ['mail' => 'a@example.org', 'entryuuid' => 'u1'])]);
+
+        $this->assertSame(['u1'], $directory->listAll(true)->groups['g1']->memberIds);
+    }
+
+    public function testRangedMemberListsAbort(): void
+    {
+        $directory = new FakeLdapDirectory(['basedn' => self::BASE, 'group_filter' => '(objectClass=group)', 'group_member_mode' => 'member'],
+            fn(string $base, string $filter): array => ($filter === '(objectClass=group)')
+                ? [self::entry('cn=big,dc=example,dc=org', ['cn' => 'Big', 'member;range=0-1499' => ['cn=a,dc=example,dc=org']])]
+                : []);
+
+        $this->expectException(DirectoryException::class);
+        $directory->listAll(true);
+    }
+
+    public function testNestedMembersFromTheAdInChainRule(): void
+    {
+        $directory = new FakeLdapDirectory(['basedn' => self::BASE, 'group_basedn' => 'ou=groups,dc=example,dc=org',
+            'group_filter' => '(objectClass=group)', 'group_member_mode' => 'ad_chain'],
+            function (string $base, string $filter): array {
+                if ($filter === '(objectClass=group)') {
+                    $this->assertSame('ou=groups,dc=example,dc=org', $base);
+                    return [self::entry('cn=sales (de),ou=groups,dc=example,dc=org', ['cn' => 'Sales', 'objectguid' => 'g1'])];
+                }
+                if (str_contains($filter, '1.2.840.113556.1.4.1941')) {
+                    $this->assertSame('(&(&(objectClass=*)(mail=*))(memberOf:1.2.840.113556.1.4.1941:=cn=sales \\28de\\29,ou=groups,dc=example,dc=org))', $filter);
+                    return [self::entry('cn=a,dc=example,dc=org', [])];
+                }
+                return [self::entry('cn=a,dc=example,dc=org', ['mail' => 'a@example.org', 'entryuuid' => 'u1'])];
+            });
+
+        $this->assertSame(['u1'], $directory->listAll(true)->groups['g1']->memberIds);
+    }
+
+    public function testGroupsNeedAFilter(): void
+    {
+        $directory = new FakeLdapDirectory(['basedn' => self::BASE], fn(): array => []);
+
+        $this->expectException(DirectoryException::class);
+        $directory->listAll(true);
+    }
+
+    /** An entry as ldap_get_entries() returns it */
+    private static function entry(string $dn, array $attributes): array
+    {
+        $entry = ['dn' => $dn];
+        foreach ($attributes as $name => $values) {
+            $values = (array)$values;
+            $entry[$name] = $values + ['count' => count($values)];
+        }
+        return $entry + ['count' => count($attributes)];
+    }
+}
+
+/**
+ * LdapDirectory with canned search results instead of an LDAP server.
+ */
+class FakeLdapDirectory extends LdapDirectory
+{
+    /** @var array[] [base, filter, attributes] of every search */
+    public array $searches = [];
+
+    public function __construct(array $settings, private Closure $results)
+    {
+        parent::__construct(null, Settings::fromArray($settings + ['authsource' => 'ldap']));
+    }
+
+    protected function search(string $base, string $filter, array $attributes): array
+    {
+        $this->searches[] = [$base, $filter, $attributes];
+        return ($this->results)($base, $filter, $attributes);
+    }
+}

tests/php/Identity/Service/LinkServiceTest.php

@@ -0,0 +1,57 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Mailcow\Tests\Identity\Service;
+
+use Mailcow\Identity\Repository\IdentityRepository;
+use Mailcow\Identity\Service\LinkService;
+use PHPUnit\Framework\TestCase;
+
+class LinkServiceTest extends TestCase
+{
+    public function testLinkedMailboxNeedsTheLinkedUser(): void
+    {
+        $repo = $this->createMock(IdentityRepository::class);
+        $repo->method('findLink')->willReturn(['provider' => 'keycloak', 'external_id' => 'u1', 'idp_disabled' => 0, 'missing_since' => null]);
+        $repo->expects($this->never())->method('link');
+        $login = new LinkService($repo);
+
+        $this->assertTrue($login->verify('keycloak', 'a@example.org', 'u1'));
+        $this->assertFalse($login->verify('keycloak', 'a@example.org', 'u2'));
+        $this->assertFalse($login->verify('keycloak', 'a@example.org', ''));
+    }
+
+    public function testUnlinkedMailboxIsLinkedOnLogin(): void
+    {
+        $repo = $this->createMock(IdentityRepository::class);
+        $repo->method('findLink')->willReturn(['provider' => 'keycloak', 'external_id' => null, 'idp_disabled' => 1, 'missing_since' => null]);
+        $repo->method('usernameOf')->willReturn(null);
+        $repo->expects($this->once())->method('link')->with('a@example.org', 'keycloak', 'u1');
+
+        $this->assertTrue((new LinkService($repo))->verify('keycloak', 'a@example.org', 'u1'));
+    }
+
+    public function testUserOfAnotherMailboxIsDenied(): void
+    {
+        $repo = $this->createMock(IdentityRepository::class);
+        $repo->method('findLink')->willReturn(null);
+        $repo->method('usernameOf')->with('ldap', 'guid-1')->willReturn('old@example.org');
+        $repo->expects($this->never())->method('link');
+        $login = new LinkService($repo);
+
+        $this->assertFalse($login->verify('ldap', 'new@example.org', 'guid-1'));
+        $this->assertFalse($login->mayCreate('ldap', 'new@example.org', 'guid-1'));
+        $this->assertTrue($login->mayCreate('ldap', 'old@example.org', 'guid-1'));
+    }
+
+    public function testLinkOfAnotherProviderIsReplaced(): void
+    {
+        $repo = $this->createMock(IdentityRepository::class);
+        $repo->method('findLink')->willReturn(['provider' => 'ldap', 'external_id' => 'guid-1', 'idp_disabled' => 0, 'missing_since' => null]);
+        $repo->method('usernameOf')->willReturn(null);
+        $repo->expects($this->once())->method('link')->with('a@example.org', 'keycloak', 'u1');
+
+        $this->assertTrue((new LinkService($repo))->verify('keycloak', 'a@example.org', 'u1'));
+    }
+}

tests/php/Identity/Service/StatusServiceTest.php

@@ -0,0 +1,68 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Mailcow\Tests\Identity\Service;
+
+use Mailcow\Core\AccessDenied;
+use Mailcow\Core\Context;
+use Mailcow\Core\UserError;
+use Mailcow\Identity\Model\Settings;
+use Mailcow\Identity\Repository\IdentityRepository;
+use Mailcow\Identity\Repository\RunRepository;
+use Mailcow\Identity\Service\StatusService;
+use Mailcow\Tests\Support\FakeContext;
+use PHPUnit\Framework\TestCase;
+
+class StatusServiceTest extends TestCase
+{
+    public function testAdminRequestsRuns(): void
+    {
+        $runs = $this->createMock(RunRepository::class);
+        $runs->expects($this->once())->method('request')->with('keycloak', 'force', 'admin')->willReturn(5);
+
+        $this->assertSame(5, $this->service(FakeContext::admin(), $runs)->requestRun('force'));
+    }
+
+    public function testInvalidModeIsRejected(): void
+    {
+        $this->expectExceptionObject(new UserError('iam_sync_mode_invalid'));
+        $this->service(FakeContext::admin())->requestRun(['run']);
+    }
+
+    public function testReadOnlyApiMayOnlyRead(): void
+    {
+        $service = $this->service(new Context('admin', 'api', [], false, 'ro'));
+
+        $this->assertSame('keycloak', $service->status()['provider']);
+        $this->expectException(AccessDenied::class);
+        $service->requestRun('run');
+    }
+
+    public function testDomainAdminsSeeOnlyLinksOfTheirMailboxes(): void
+    {
+        $repo = $this->createMock(IdentityRepository::class);
+        $repo->method('findLink')->willReturn(['provider' => 'keycloak', 'external_id' => 'u1', 'idp_disabled' => 0, 'missing_since' => null]);
+        $service = $this->service(FakeContext::domainAdmin(['a@example.org']), null, $repo);
+
+        $this->assertSame('u1', $service->link('A@example.org')['external_id']);
+        $this->assertNull($service->link('b@example.org'));
+        $this->expectException(AccessDenied::class);
+        $service->status();
+    }
+
+    public function testDomainAdminsCannotUnlink(): void
+    {
+        $repo = $this->createMock(IdentityRepository::class);
+        $repo->expects($this->never())->method('unlink');
+
+        $this->expectException(AccessDenied::class);
+        $this->service(FakeContext::domainAdmin(['a@example.org']), null, $repo)->unlink('a@example.org');
+    }
+
+    private function service(Context $context, ?RunRepository $runs = null, ?IdentityRepository $repo = null): StatusService
+    {
+        return new StatusService(Settings::fromArray(['authsource' => 'keycloak']), $repo ?? $this->createMock(IdentityRepository::class),
+            $runs ?? $this->createMock(RunRepository::class), $context);
+    }
+}

tests/php/Identity/Service/SyncPlannerTest.php

@@ -0,0 +1,264 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Mailcow\Tests\Identity\Service;
+
+use Mailcow\Identity\Model\Account;
+use Mailcow\Identity\Model\DirectoryGroup;
+use Mailcow\Identity\Model\DirectoryUser;
+use Mailcow\Identity\Model\Listing;
+use Mailcow\Identity\Model\Settings;
+use Mailcow\Identity\Model\State;
+use Mailcow\Identity\Service\SyncPlanner;
+use PHPUnit\Framework\Attributes\DataProvider;
+use PHPUnit\Framework\TestCase;
+
+class SyncPlannerTest extends TestCase
+{
+    private const SINCE = '2026-10-25 10:00:00';
+
+    public function testUnlinkedMailboxIsAdoptedByEmail(): void
+    {
+        $plan = $this->plan([self::user('u1', 'a@example.org')], [new Account('a@example.org', 'A', 1)]);
+
+        $this->assertSame(['a@example.org' => 'u1'], $plan->links);
+        $this->assertSame([], $plan->conflicts);
+    }
+
+    public function testLinkedUserWithNewEmailIsAConflictAndNotCreated(): void
+    {
+        $plan = $this->plan([self::user('u1', 'new@example.org')], [new Account('a@example.org', 'A', 1, 'u1')]);
+
+        $this->assertSame([], $plan->creates);
+        $this->assertSame([], $plan->missing);
+        $this->assertSame(['a@example.org is linked to an IdP user whose email is now new@example.org'], $plan->conflicts);
+    }
+
+    public function testMailboxLinkedToAnotherUserIsNotTakenOver(): void
+    {
+        $plan = $this->plan([self::user('u2', 'a@example.org')], [new Account('a@example.org', 'A', 1, 'u1', false, self::SINCE)]);
+
+        $this->assertSame([], $plan->links);
+        $this->assertSame(['a@example.org is linked to another IdP user'], $plan->conflicts);
+        // u1 is gone for the second run: login disabled
+        $this->assertSame(['a@example.org'], $plan->deactivate);
+    }
+
+    public function testCreatesOnlyEnabledUsersOfMailcowDomainsWithTemplate(): void
+    {
+        $settings = ['mappers' => ['staff'], 'templates' => ['Staff']];
+        $users = [
+            self::user('u1', 'new@example.org', true, ['staff'], 'New User'),
+            self::user('u2', 'off@example.org', false, ['staff']),
+            self::user('u3', 'x@foreign.org', true, ['staff']),
+            self::user('u4', 'local@example.org', true, ['staff']),
+            self::user('u5', 'none@example.org'),
+            self::user('u6', null),
+        ];
+        $plan = $this->plan($users, [], $settings, ['mailboxes' => ['local@example.org' => 'mailcow']]);
+
+        $this->assertSame([['email' => 'new@example.org', 'name' => 'New User', 'template' => 'Staff', 'id' => 'u1']], $plan->creates);
+        $this->assertSame(['No template matches none@example.org'], $plan->conflicts);
+        $this->assertSame(4, $plan->skipped);
+    }
+
+    public function testNothingIsCreatedWithoutImport(): void
+    {
+        $plan = $this->plan([self::user('u1', 'new@example.org')], [], ['import_users' => 0, 'default_template' => 'Default']);
+
+        $this->assertSame([], $plan->creates);
+    }
+
+    public function testDuplicateEmailsAreAConflict(): void
+    {
+        $plan = $this->plan([self::user('u1', 'a@example.org'), self::user('u2', 'a@example.org')], [], ['default_template' => 'Default']);
+
+        $this->assertSame([], $plan->creates);
+        $this->assertSame(['Several IdP users have the email a@example.org'], $plan->conflicts);
+    }
+
+    public function testNewMailboxGetsTheTemplateOfItsHighestPriorityGroup(): void
+    {
+        $groups = [self::group(1, 'g1', 'Sales', [], 'Sales', 5), self::group(2, 'g2', 'Board', [], 'Board', 10)];
+        $listing = [new DirectoryGroup('g1', 'Sales', null, ['u1']), new DirectoryGroup('g2', 'Board', null, ['u1'])];
+        $plan = $this->plan([self::user('u1', 'new@example.org', true, ['staff'])], [],
+            ['group_sync' => 1, 'mappers' => ['staff'], 'templates' => ['Staff']], ['groups' => $groups], $listing);
+
+        $this->assertSame('Board', $plan->creates[0]['template']);
+        $this->assertSame(['g1' => ['new@example.org'], 'g2' => ['new@example.org']], $plan->memberships);
+    }
+
+    /**
+     * @param ?bool $listed null = not listed, else enabled in the IdP
+     */
+    #[DataProvider('offboardingCases')]
+    public function testOffboardingStates(int $active, bool $idpDisabled, ?string $missingSince, ?bool $listed, bool $offboarding, array $expected): void
+    {
+        $users = ($listed === null) ? [] : [self::user('u1', 'a@example.org', $listed)];
+        $plan = $this->plan($users, [new Account('a@example.org', 'A', $active, 'u1', $idpDisabled, $missingSince)],
+            ['offboarding' => $offboarding ? 1 : 0]);
+
+        foreach (['deactivate', 'restore', 'release', 'missing', 'found'] as $kind) {
+            $this->assertSame(in_array($kind, $expected, true) ? ['a@example.org'] : [], $plan->$kind, $kind);
+        }
+    }
+
+    public static function offboardingCases(): array
+    {
+        return [
+            'disabled in the IdP' => [1, false, null, false, true, ['deactivate']],
+            'activated by an admin after the sync disabled it' => [1, true, null, false, true, []],
+            'disabled by an admin' => [2, false, null, false, true, []],
+            'inactive' => [0, false, null, false, true, []],
+            'enabled again' => [2, true, null, true, true, ['restore']],
+            'enabled again, active changed by an admin' => [0, true, null, true, true, ['release']],
+            'not listed for the first time' => [1, false, null, null, true, ['missing']],
+            'not listed for the second time' => [1, false, self::SINCE, null, true, ['deactivate']],
+            'listed again' => [1, false, self::SINCE, true, true, ['found']],
+            'listed again after removal' => [2, true, self::SINCE, true, true, ['found', 'restore']],
+            'offboarding off' => [1, false, null, false, false, []],
+            'offboarding off tracks missing users' => [1, false, null, null, false, ['missing']],
+        ];
+    }
+
+    public function testGuardBlocksMassDeactivationUnlessForced(): void
+    {
+        $accounts = [];
+        $users = [];
+        for ($i = 1; $i <= 6; $i++) {
+            $accounts[] = new Account("u$i@example.org", '', 1, "u$i");
+            $users[] = self::user("u$i", "u$i@example.org", $i > 5);
+        }
+        $this->assertFalse($this->plan($users, $accounts)->blocked);
+
+        $users[5] = self::user('u6', 'u6@example.org', false);
+        $this->assertTrue($this->plan($users, $accounts)->blocked);
+        $this->assertFalse($this->plan($users, $accounts, [], [], null, true)->blocked);
+    }
+
+    public function testGuardCountsMembershipsOfOrphanedGroups(): void
+    {
+        $members = [];
+        for ($i = 1; $i <= 6; $i++) {
+            $members["u$i@example.org"] = 'idp';
+        }
+        $plan = $this->plan([], [], ['group_sync' => 1], ['groups' => [self::group(3, 'gone', 'Old', $members)]], []);
+
+        $this->assertSame([3], $plan->orphanedGroups);
+        $this->assertSame(6, $plan->membershipRemovals);
+        $this->assertTrue($plan->blocked);
+    }
+
+    public function testGroupMembershipsFollowTheIdp(): void
+    {
+        $accounts = [new Account('a@example.org', '', 1, 'u1'), new Account('b@example.org', '', 1, 'u2'),
+            new Account('c@example.org', '', 1, 'u3'), new Account('gone@example.org', '', 1, 'u4')];
+        $members = ['a@example.org' => 'manual', 'b@example.org' => 'idp', 'gone@example.org' => 'idp'];
+        $plan = $this->plan([self::user('u1', 'a@example.org'), self::user('u2', 'b@example.org'), self::user('u3', 'c@example.org')],
+            $accounts, ['group_sync' => 1], ['groups' => [self::group(1, 'g1', 'Sales', $members)]],
+            [new DirectoryGroup('g1', 'Sales', null, ['u1', 'u3'])]);
+
+        // b leaves, c joins, a stays manual, gone@ is not listed and keeps its membership
+        $this->assertSame(['g1' => ['a@example.org', 'c@example.org', 'gone@example.org']], $plan->memberships);
+        $this->assertSame(1, $plan->membershipRemovals);
+    }
+
+    public function testUnchangedMembershipsArePlannedAsNothing(): void
+    {
+        $plan = $this->plan([self::user('u1', 'a@example.org')], [new Account('a@example.org', '', 1, 'u1')], ['group_sync' => 1],
+            ['groups' => [self::group(1, 'g1', 'Sales', ['a@example.org' => 'manual'])]], [new DirectoryGroup('g1', 'Sales', null, ['u1'])]);
+
+        $this->assertSame([], $plan->memberships);
+    }
+
+    public function testNewGroupsGoToTheDomainOfTheirMailOrTheDefaultDomain(): void
+    {
+        $groups = [
+            new DirectoryGroup('g1', 'Sales', 'sales@sub.example.org'),
+            new DirectoryGroup('g2', 'Staff', 'staff@foreign.org'),
+            new DirectoryGroup('g3', 'Board'),
+            new DirectoryGroup('g4', 'Support'),
+        ];
+        $state = ['domains' => ['example.org', 'sub.example.org'], 'groups' => [self::group(9, null, 'support', [])]];
+        $plan = $this->plan([], [], ['group_sync' => 1, 'group_autocreate' => 1, 'group_default_domain' => 'example.org'], $state, $groups);
+
+        $this->assertSame([
+            ['ref' => 'g1', 'name' => 'Sales', 'domain' => 'sub.example.org', 'mail' => 'sales@sub.example.org'],
+            ['ref' => 'g2', 'name' => 'Staff', 'domain' => 'example.org', 'mail' => 'staff@foreign.org'],
+            ['ref' => 'g3', 'name' => 'Board', 'domain' => 'example.org', 'mail' => null],
+        ], $plan->groupCreates);
+        $this->assertSame(['A group Support exists in example.org and is not linked to the IdP group'], $plan->conflicts);
+
+        $plan = $this->plan([], [], ['group_sync' => 1, 'group_autocreate' => 1], $state, [new DirectoryGroup('g3', 'Board')]);
+        $this->assertSame(['IdP group Board has no mailcow domain'], $plan->conflicts);
+
+        $plan = $this->plan([], [], ['group_sync' => 1, 'group_autocreate' => 0, 'group_default_domain' => 'example.org'], $state, $groups);
+        $this->assertSame([], $plan->groupCreates);
+    }
+
+    public function testRenamedIdpGroupsAreRenamedUnlessTheNameIsTaken(): void
+    {
+        $state = ['groups' => [self::group(1, 'g1', 'Sales', []), self::group(2, 'g2', 'Support', []), self::group(3, null, 'Board', [])]];
+        $plan = $this->plan([], [], ['group_sync' => 1], $state,
+            [new DirectoryGroup('g1', 'Sales DE'), new DirectoryGroup('g2', 'board')]);
+
+        $this->assertSame([1 => 'Sales DE'], $plan->groupRenames);
+        $this->assertSame(['IdP group Support was renamed to board, which exists in example.org'], $plan->conflicts);
+    }
+
+    public function testUpdatesNameAndTemplateWhenTheyDiffer(): void
+    {
+        $settings = ['periodic_sync' => 1, 'mappers' => ['staff'], 'templates' => ['Staff']];
+        $accounts = [new Account('a@example.org', 'A', 1, 'u1', false, null, 'h-staff'),
+            new Account('b@example.org', 'B', 1, 'u2', false, null, 'h-old'),
+            new Account('c@example.org', 'C', 1, 'u3', false, null, 'h-staff'),
+            new Account('d@example.org', 'D', 1, 'u4', false, null, 'h-staff')];
+        $users = [self::user('u1', 'a@example.org', true, ['staff'], 'A'), self::user('u2', 'b@example.org', true, ['staff'], 'B'),
+            self::user('u3', 'c@example.org', true, ['staff'], 'C New'), self::user('u4', 'd@example.org', true, ['staff'])];
+        $state = ['hashes' => ['Staff' => 'h-staff', 'Sales' => 'h-sales'], 'effective' => ['a@example.org' => 'Sales']];
+        $plan = $this->plan($users, $accounts, $settings, $state);
+
+        $this->assertSame([
+            ['username' => 'a@example.org', 'name' => 'A', 'template' => 'Staff'],
+            ['username' => 'b@example.org', 'name' => 'B', 'template' => 'Staff'],
+            ['username' => 'c@example.org', 'name' => 'C New', 'template' => 'Staff'],
+        ], $plan->updates);
+    }
+
+    private function plan(array $users, array $accounts, array $settings = [], array $state = [], ?array $groups = null, bool $force = false)
+    {
+        $byId = [];
+        foreach ($users as $user) {
+            $byId[$user->id] = $user;
+        }
+        $groupsById = null;
+        if ($groups !== null) {
+            $groupsById = [];
+            foreach ($groups as $group) {
+                $groupsById[$group->id] = $group;
+            }
+        }
+        $byName = [];
+        foreach ($accounts as $account) {
+            $byName[$account->username] = $account;
+        }
+        return (new SyncPlanner())->plan(
+            Settings::fromArray($settings + ['authsource' => 'keycloak', 'offboarding' => 1, 'import_users' => 1]),
+            new Listing($byId, $groupsById),
+            new State($byName, array_fill_keys(array_keys($byName), 'keycloak') + ($state['mailboxes'] ?? []),
+                $state['domains'] ?? ['example.org'], $state['groups'] ?? [], $state['effective'] ?? [], $state['hashes'] ?? []),
+            $force);
+    }
+
+    private static function user(string $id, ?string $email, bool $enabled = true, array $templates = [], string $name = ''): DirectoryUser
+    {
+        return new DirectoryUser($id, $email, $name, $enabled, $templates);
+    }
+
+    private static function group(int $id, ?string $ref, string $name, array $members, ?string $template = null, int $priority = 0): array
+    {
+        return ['id' => $id, 'domain' => 'example.org', 'name' => $name, 'idp_ref' => $ref, 'template' => $template,
+            'priority' => $priority, 'active' => 1, 'members' => $members];
+    }
+}

tests/php/Identity/Service/SyncServiceTest.php

@@ -0,0 +1,185 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Mailcow\Tests\Identity\Service;
+
+use Mailcow\Identity\Directory\Directory;
+use Mailcow\Identity\Directory\DirectoryException;
+use Mailcow\Identity\Legacy\LegacyAccounts;
+use Mailcow\Identity\Model\Account;
+use Mailcow\Identity\Model\DirectoryGroup;
+use Mailcow\Identity\Model\DirectoryUser;
+use Mailcow\Identity\Model\Listing;
+use Mailcow\Identity\Model\Settings;
+use Mailcow\Identity\Repository\IdentityRepository;
+use Mailcow\Identity\Repository\RunRepository;
+use Mailcow\Identity\Service\SyncPlanner;
+use Mailcow\Identity\Service\SyncService;
+use Mailcow\MailboxGroup\Model\Group;
+use Mailcow\MailboxGroup\Service\IdpSyncService;
+use Mailcow\MailboxGroup\Service\TemplateService;
+use Mailcow\Sogo\Service\SogoService;
+use PHPUnit\Framework\MockObject\MockObject;
+use PHPUnit\Framework\TestCase;
+
+class SyncServiceTest extends TestCase
+{
+    private IdentityRepository&MockObject $repo;
+    private RunRepository&MockObject $runs;
+    private IdpSyncService&MockObject $groups;
+    private TemplateService&MockObject $templates;
+    private LegacyAccounts&MockObject $legacy;
+    private SogoService&MockObject $sogo;
+    private array $finished = [];
+
+    protected function setUp(): void
+    {
+        $this->repo = $this->createMock(IdentityRepository::class);
+        $this->repo->method('accounts')->willReturn(['a@example.org' => new Account('a@example.org', 'A', 1, 'u1'),
+            'b@example.org' => new Account('b@example.org', 'B', 1)]);
+        $this->repo->method('mailboxes')->willReturn(['a@example.org' => 'keycloak', 'b@example.org' => 'keycloak']);
+        $this->repo->method('domains')->willReturn(['example.org']);
+        $this->runs = $this->createMock(RunRepository::class);
+        $this->runs->method('finish')->willReturnCallback(function (int $id, string $status, array $summary): void {
+            $this->finished = [$id, $status, $summary];
+        });
+        $this->groups = $this->createMock(IdpSyncService::class);
+        $this->groups->method('groups')->willReturn([['id' => 4, 'domain' => 'example.org', 'name' => 'Sales', 'idp_ref' => 'g1',
+            'template' => null, 'priority' => 0, 'active' => 1, 'members' => []]]);
+        $this->templates = $this->createMock(TemplateService::class);
+        $this->templates->method('effective')->willReturn([]);
+        $this->legacy = $this->createMock(LegacyAccounts::class);
+        $this->sogo = $this->createMock(SogoService::class);
+    }
+
+    public function testRunAppliesThePlan(): void
+    {
+        $this->repo->expects($this->exactly(2))->method('link')->willReturnCallback(fn(string $u, string $p, string $id) =>
+            $this->assertContains([$u, $p, $id], [['b@example.org', 'keycloak', 'u2'], ['new@example.org', 'keycloak', 'u3']]));
+        $this->repo->expects($this->once())->method('setActive')->with('a@example.org', 'keycloak', 2, true);
+        $this->legacy->expects($this->once())->method('createMailbox')->with('new@example.org', 'New', 'keycloak', 'Default')->willReturn(null);
+        $this->sogo->expects($this->once())->method('refreshStaticView')->with(['a@example.org']);
+        $group = Group::fromRow(['id' => 4, 'name' => 'Sales']);
+        $this->groups->method('findByIdpRef')->with('g1')->willReturn($group);
+        $this->groups->expects($this->once())->method('syncGroupMembers')->with(4, ['b@example.org', 'new@example.org'])
+            ->willReturn(['added' => [], 'removed' => [], 'skipped' => [], 'warnings' => []]);
+
+        $run = $this->service($this->listing())->execute(9, 'run');
+
+        $this->assertSame('ok', $run['status']);
+        $this->assertSame([], $run['summary']['errors']);
+        $this->assertSame([9, 'ok'], array_slice($this->finished, 0, 2));
+    }
+
+    public function testLeavingATemplateGroupAppliesTheMappingInTheSameRun(): void
+    {
+        $this->repo = $this->createMock(IdentityRepository::class);
+        $this->repo->method('accounts')->willReturn(['a@example.org' => new Account('a@example.org', 'A', 1, 'u1', false, null, 'h-default')]);
+        $this->repo->method('templateHashes')->willReturn(['Default' => 'h-default', 'Staff' => 'h-staff']);
+        $this->groups = $this->createMock(IdpSyncService::class);
+        $this->groups->method('groups')->willReturn([['id' => 4, 'domain' => 'example.org', 'name' => 'Sales', 'idp_ref' => 'g1',
+            'template' => 'Default', 'priority' => 0, 'active' => 1, 'members' => ['a@example.org' => 'idp']]]);
+        $this->groups->method('findByIdpRef')->willReturn(Group::fromRow(['id' => 4, 'name' => 'Sales']));
+        $this->groups->method('syncGroupMembers')->with(4, [])
+            ->willReturn(['added' => [], 'removed' => ['a@example.org'], 'skipped' => [], 'warnings' => []]);
+        $this->templates = $this->createMock(TemplateService::class);
+        $this->templates->method('effective')->willReturnOnConsecutiveCalls(['a@example.org' => 'Default'], ['a@example.org' => null]);
+        $this->legacy->expects($this->once())->method('applyTemplate')->with('a@example.org', 'A', 'Staff')->willReturn(null);
+        $directory = $this->createMock(Directory::class);
+        $directory->method('listAll')->willReturn(new Listing(['u1' => new DirectoryUser('u1', 'a@example.org', 'A', true, ['staff'])],
+            ['g1' => new DirectoryGroup('g1', 'Sales')]));
+
+        $run = $this->service($directory, ['periodic_sync' => 1, 'mappers' => ['staff'], 'templates' => ['Staff']])->execute(9, 'run');
+
+        $this->assertSame(1, $run['summary']['counts']['updates']);
+    }
+
+    public function testPreviewWritesNothing(): void
+    {
+        $this->repo->expects($this->never())->method('link');
+        $this->repo->expects($this->never())->method('setActive');
+        $this->legacy->expects($this->never())->method('createMailbox');
+        $this->groups->expects($this->never())->method('syncGroupMembers');
+
+        $run = $this->service($this->listing())->execute(9, 'preview');
+
+        $this->assertSame(['ok', 'preview', 1, 1], [$run['status'], $run['summary']['mode'], $run['summary']['counts']['deactivate'],
+            $run['summary']['counts']['creates']]);
+    }
+
+    public function testListingErrorsWriteNothing(): void
+    {
+        $this->repo->expects($this->never())->method('setMissing');
+        $directory = $this->createMock(Directory::class);
+        $directory->method('listAll')->willThrowException(new DirectoryException('LDAP search incomplete (code 4): Sizelimit exceeded'));
+
+        $run = $this->service($directory)->execute(9, 'run');
+
+        $this->assertSame('error', $run['status']);
+        $this->assertSame('LDAP search incomplete (code 4): Sizelimit exceeded', $this->finished[2]['error']);
+    }
+
+    public function testBlockedRunsWriteNothing(): void
+    {
+        $this->repo->expects($this->never())->method('link');
+        $this->repo->expects($this->never())->method('setActive');
+
+        $run = $this->service($this->listing(), ['offboarding_limit' => 0, 'group_sync' => 0], 6)->execute(9, 'run');
+
+        $this->assertSame('blocked', $run['status']);
+    }
+
+    public function testScheduledRunsWaitForTheInterval(): void
+    {
+        $this->runs->method('nextPending')->willReturn(null);
+        $this->runs->method('secondsSinceScheduled')->willReturn(600);
+        $this->runs->expects($this->never())->method('create');
+
+        $this->assertNull($this->service($this->listing())->runDue());
+    }
+
+    public function testRequestedRunsComeFirst(): void
+    {
+        $this->runs->method('nextPending')->willReturn(['id' => 3, 'mode' => 'preview']);
+        $this->runs->expects($this->once())->method('start')->with(3);
+
+        $this->assertSame('preview', $this->service($this->listing())->runDue()['mode']);
+    }
+
+    public function testNothingIsDueWithoutSync(): void
+    {
+        $this->runs->method('nextPending')->willReturn(null);
+        $this->runs->expects($this->never())->method('create');
+
+        $this->assertNull($this->service($this->listing(), ['offboarding' => 0, 'group_sync' => 0, 'import_users' => 0])->runDue());
+    }
+
+    /** a@ (linked) is disabled, b@ is adopted, new@ is created, b@ and new@ are in Sales */
+    private function listing(): Directory
+    {
+        $directory = $this->createMock(Directory::class);
+        $directory->method('listAll')->willReturn(new Listing([
+            'u1' => new DirectoryUser('u1', 'a@example.org', 'A', false),
+            'u2' => new DirectoryUser('u2', 'b@example.org', 'B', true),
+            'u3' => new DirectoryUser('u3', 'new@example.org', 'New', true),
+        ], ['g1' => new DirectoryGroup('g1', 'Sales', null, ['u2', 'u3'])]));
+        return $directory;
+    }
+
+    private function service(Directory $directory, array $settings = [], int $extraAccounts = 0): SyncService
+    {
+        if ($extraAccounts > 0) {
+            $accounts = [];
+            for ($i = 0; $i < $extraAccounts; $i++) {
+                $accounts["x$i@example.org"] = new Account("x$i@example.org", '', 1, "x$i", false, '2026-10-25 10:00:00');
+            }
+            $this->repo = $this->createMock(IdentityRepository::class);
+            $this->repo->method('accounts')->willReturn($accounts);
+            $this->repo->expects($this->never())->method('setActive');
+        }
+        return new SyncService(Settings::fromArray($settings + ['authsource' => 'keycloak', 'offboarding' => 1, 'import_users' => 1,
+            'group_sync' => 1, 'default_template' => 'Default']), fn(): Directory => $directory, $this->repo, $this->runs, new SyncPlanner(),
+            $this->groups, $this->templates, $this->legacy, $this->sogo);
+    }
+}

tests/php/MailboxGroup/Controller/MailboxGroupApiControllerTest.php

@@ -0,0 +1,136 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Mailcow\Tests\MailboxGroup\Controller;
+
+use Mailcow\Core\AccessDenied;
+use Mailcow\Core\ApiResponse;
+use Mailcow\Core\UserError;
+use Mailcow\MailboxGroup\Controller\MailboxGroupApiController;
+use Mailcow\MailboxGroup\Model\Group;
+use Mailcow\MailboxGroup\Service\AccountHooks;
+use Mailcow\MailboxGroup\Service\GroupService;
+use Mailcow\MailboxGroup\Service\TemplateService;
+use PDOException;
+use PHPUnit\Framework\MockObject\MockObject;
+use PHPUnit\Framework\TestCase;
+
+class MailboxGroupApiControllerTest extends TestCase
+{
+    private GroupService&MockObject $groups;
+    private AccountHooks&MockObject $hooks;
+    private TemplateService&MockObject $templates;
+    private MailboxGroupApiController $api;
+
+    protected function setUp(): void
+    {
+        $_SESSION = [];
+        $this->groups = $this->createMock(GroupService::class);
+        $this->hooks = $this->createMock(AccountHooks::class);
+        $this->templates = $this->createMock(TemplateService::class);
+        $this->api = new MailboxGroupApiController($this->groups, $this->hooks, $this->templates, new ApiResponse());
+    }
+
+    private static function group(string $name, array $warnings = []): Group
+    {
+        $group = Group::fromRow(['id' => 7, 'domain' => 'example.org', 'name' => $name]);
+        $group->warnings = $warnings;
+        return $group;
+    }
+
+    /** Messages written to the session as [type, msg] */
+    private function messages(): array
+    {
+        return array_map(fn(array $m): array => [$m['type'], $m['msg']], $_SESSION['return'] ?? []);
+    }
+
+    public function testAddReportsWarningsAndTheEscapedName(): void
+    {
+        $this->groups->method('create')->willReturn(self::group('<Sales>', [['group_template_failed', 'Staff', 'a@example.org']]));
+
+        $this->assertTrue($this->api->addGroup(['name' => '<Sales>']));
+
+        $this->assertSame([
+            ['warning', ['group_template_failed', 'Staff', 'a@example.org']],
+            ['success', ['group_added', '&lt;Sales&gt;']],
+        ], $this->messages());
+        $this->assertSame(['mailbox_group', 'add', 'group', ['name' => '<Sales>']], $_SESSION['return'][1]['log']);
+    }
+
+    public function testErrorsBecomeDangerMessages(): void
+    {
+        $this->groups->method('create')->willReturnOnConsecutiveCalls(
+            $this->throwException(new UserError('group_name_invalid')),
+            $this->throwException(new PDOException('gone away'))
+        );
+
+        $this->assertFalse($this->api->addGroup([]));
+        $this->assertFalse($this->api->addGroup([]));
+
+        $this->assertSame([['danger', 'group_name_invalid'], ['danger', ['mysql_error', 'gone away']]], $this->messages());
+    }
+
+    public function testEditReportsEachId(): void
+    {
+        $this->groups->method('update')->willReturnCallback(fn(int $id, array $attr): Group => ($id === 2)
+            ? throw new UserError('group_member_idp', ['a@example.org']) : self::group('G' . $id));
+
+        $this->assertTrue($this->api->editGroups(['1', '2', 'x'], ['active' => '0']));
+
+        $this->assertSame([
+            ['success', ['group_modified', 'G1']],
+            ['danger', ['group_member_idp', 'a@example.org']],
+            ['danger', 'access_denied'],
+        ], $this->messages());
+    }
+
+    public function testEditAndDeleteNeedAnEditorOnce(): void
+    {
+        $this->groups->method('requireEditor')->willThrowException(new AccessDenied());
+        $this->groups->expects($this->never())->method('update');
+        $this->groups->expects($this->never())->method('delete');
+
+        $this->assertFalse($this->api->editGroups(['1', '2'], []));
+        $this->assertFalse($this->api->deleteGroups(['1', '2']));
+
+        $this->assertSame([['danger', 'access_denied'], ['danger', 'access_denied']], $this->messages());
+    }
+
+    public function testDelete(): void
+    {
+        $this->groups->expects($this->once())->method('delete')->with(7)->willReturn(self::group('Sales'));
+
+        $this->assertTrue($this->api->deleteGroups(['7']));
+
+        $this->assertSame([['success', ['group_removed', 'Sales']]], $this->messages());
+    }
+
+    public function testGetGroupsSplitsTheDomainList(): void
+    {
+        $this->groups->expects($this->once())->method('visibleIds')->with(['a.org', 'b.org'])->willReturn([7]);
+        $this->groups->method('get')->willReturnMap([[7, self::group('Sales')]]);
+        $this->groups->method('toArray')->willReturn(['id' => 7]);
+
+        $this->assertSame([['id' => 7]], $this->api->getGroups(' a.org,,b.org '));
+        $this->assertSame([], $this->api->getGroup('all'));
+    }
+
+    public function testHooksTurnDatabaseErrorsIntoMessages(): void
+    {
+        $this->hooks->method('onMailboxDeleted')->willThrowException(new PDOException('locked'));
+
+        $this->api->mailboxDeleted('a@example.org');
+
+        $this->assertSame([['danger', ['mysql_error', 'locked']]], $this->messages());
+    }
+
+    public function testTemplateChangesReportWarnings(): void
+    {
+        $this->templates->method('onTemplateChanged')->with(3)->willReturn([['group_template_failed', 'Staff', 'a@example.org']]);
+
+        $this->api->templateChanged(3);
+
+        $this->assertSame([['warning', ['group_template_failed', 'Staff', 'a@example.org']]], $this->messages());
+    }
+}

tests/php/MailboxGroup/Legacy/LegacyMailboxTest.php

@@ -0,0 +1,70 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Mailcow\Tests\MailboxGroup\Legacy;
+
+use Mailcow\MailboxGroup\Legacy\LegacyMailbox;
+use PHPUnit\Framework\TestCase;
+use RuntimeException;
+
+class LegacyMailboxTest extends TestCase
+{
+    protected function setUp(): void
+    {
+        $_SESSION = ['return' => [['type' => 'success', 'msg' => 'caller']], 'access_all_exception' => '0'];
+    }
+
+    /** Replaces the global calls: $result is returned, $messages are written like the legacy code does */
+    private static function legacy(mixed $result, array $messages = [], array &$calls = []): LegacyMailbox
+    {
+        return new class($result, $messages, $calls) extends LegacyMailbox {
+            private array $calls;
+
+            public function __construct(private mixed $result, private array $messages, array &$calls)
+            {
+                $this->calls = &$calls;
+            }
+
+            protected function callTemplate(string $username, string $name, string $template): mixed
+            {
+                $this->calls[] = [$username, $name, $template, $_SESSION['access_all_exception']];
+                if ($this->result instanceof RuntimeException) {
+                    throw $this->result;
+                }
+                $_SESSION['return'] = array_merge($_SESSION['return'], $this->messages);
+                return $this->result;
+            }
+        };
+    }
+
+    public function testTemplatesAreAppliedAsSystemAndTheSessionIsRestored(): void
+    {
+        $calls = [];
+
+        $this->assertNull(self::legacy(true, [['type' => 'success', 'msg' => 'mailbox_modified']], $calls)->applyTemplate('a@example.org', 'A', 'Staff'));
+
+        $this->assertSame([['a@example.org', 'A', 'Staff', '1']], $calls);
+        $this->assertSame(['return' => [['type' => 'success', 'msg' => 'caller']], 'access_all_exception' => '0'], $_SESSION);
+    }
+
+    public function testTheFirstLegacyErrorIsReturned(): void
+    {
+        $error = self::legacy(false, [['type' => 'success', 'msg' => 'x'], ['type' => 'danger', 'msg' => ['mailbox_quota_exceeded', 1]]])
+            ->applyTemplate('a@example.org', 'A', 'Staff');
+
+        $this->assertSame('mailbox_quota_exceeded', $error);
+        $this->assertSame('0', $_SESSION['access_all_exception']);
+    }
+
+    public function testTheSessionIsRestoredOnExceptions(): void
+    {
+        try {
+            self::legacy(new RuntimeException('boom'))->applyTemplate('a@example.org', 'A', 'Staff');
+            $this->fail('exception expected');
+        } catch (RuntimeException) {
+        }
+
+        $this->assertSame(['return' => [['type' => 'success', 'msg' => 'caller']], 'access_all_exception' => '0'], $_SESSION);
+    }
+}

tests/php/MailboxGroup/Service/ChangeEffectsTest.php

@@ -0,0 +1,42 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Mailcow\Tests\MailboxGroup\Service;
+
+use Mailcow\Dovecot\Service\DovecotService;
+use Mailcow\MailboxGroup\Repository\GroupRepository;
+use Mailcow\MailboxGroup\Service\ChangeEffects;
+use Mailcow\MailboxGroup\Service\TemplateService;
+use Mailcow\Sogo\Service\SogoService;
+use PHPUnit\Framework\TestCase;
+
+class ChangeEffectsTest extends TestCase
+{
+    public function testCachesAreFlushedForTheWritesOfTheRepository(): void
+    {
+        $repo = $this->createMock(GroupRepository::class);
+        $repo->method('takeEffects')->willReturn(['members' => ['a@example.org'], 'sogo_acl' => true]);
+        $legacy = $this->createMock(SogoService::class);
+        $legacy->expects($this->once())->method('refreshStaticView')->with(['b@example.org']);
+        $legacy->expects($this->once())->method('flushCache');
+        $dovecot = $this->createMock(DovecotService::class);
+        $dovecot->expects($this->once())->method('flushAuthCache')->with(['a@example.org']);
+        $templates = $this->createMock(TemplateService::class);
+        $templates->method('applyChanged')->willReturn([]);
+
+        (new ChangeEffects($templates, $legacy, $repo, $dovecot))->apply(['b@example.org'], []);
+    }
+
+    public function testSogoCacheStaysWithoutAclChanges(): void
+    {
+        $repo = $this->createMock(GroupRepository::class);
+        $repo->method('takeEffects')->willReturn(['members' => [], 'sogo_acl' => false]);
+        $legacy = $this->createMock(SogoService::class);
+        $legacy->expects($this->never())->method('flushCache');
+        $templates = $this->createMock(TemplateService::class);
+        $templates->method('applyChanged')->willReturn([]);
+
+        (new ChangeEffects($templates, $legacy, $repo, $this->createMock(DovecotService::class)))->apply([], []);
+    }
+}

tests/php/MailboxGroup/Service/GroupServiceTest.php

@@ -0,0 +1,359 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Mailcow\Tests\MailboxGroup\Service;
+
+use Mailcow\Core\Context;
+use Mailcow\Core\UserError;
+use Mailcow\MailboxGroup\Model\Group;
+use Mailcow\MailboxGroup\Repository\GroupRepository;
+use Mailcow\MailboxGroup\Repository\LookupRepository;
+use Mailcow\MailboxGroup\Service\ChangeEffects;
+use Mailcow\MailboxGroup\Service\GroupService;
+use Mailcow\MailboxGroup\Service\SharingService;
+use Mailcow\MailboxGroup\Service\TemplateService;
+use Mailcow\Tests\Support\FakeContext;
+use PHPUnit\Framework\Attributes\DataProvider;
+use PHPUnit\Framework\MockObject\MockObject;
+use PHPUnit\Framework\TestCase;
+
+class GroupServiceTest extends TestCase
+{
+    private const ACL = ['mailbox_groups' => '1'];
+
+    private GroupRepository&MockObject $repo;
+    private LookupRepository&MockObject $lookup;
+    private TemplateService&MockObject $templates;
+    private ChangeEffects&MockObject $effects;
+    private SharingService&MockObject $sharing;
+
+    protected function setUp(): void
+    {
+        $this->repo = $this->createMock(GroupRepository::class);
+        $this->lookup = $this->createMock(LookupRepository::class);
+        $this->templates = $this->createMock(TemplateService::class);
+        $this->effects = $this->createMock(ChangeEffects::class);
+        $this->effects->method('snapshot')->willReturn([]);
+        $this->effects->method('apply')->willReturn([]);
+        $this->sharing = $this->createMock(SharingService::class);
+        $this->sharing->method('applyImap')->willReturn([]);
+        $this->sharing->method('applySogo')->willReturn([]);
+        $this->lookup->method('isDomain')->willReturnCallback(fn(string $d): bool => in_array($d, ['example.org', 'other.org'], true));
+        $this->lookup->method('isDomainOrAliasDomain')->willReturnCallback(fn(string $d): bool => in_array($d, ['example.org', 'other.org', 'alias.org'], true));
+        $this->lookup->method('aliasExists')->willReturnCallback(fn(string $a): bool => str_starts_with($a, 'shared@') || str_starts_with($a, 'a@'));
+        $this->lookup->method('regularMailboxes')->willReturnCallback(fn(array $u): array => array_values(array_filter($u, fn(string $x): bool => !str_starts_with($x, 'room'))));
+        $this->lookup->method('aliasesLeft')->willReturn(10);
+        $this->lookup->method('templateName')->willReturnCallback(fn(int $id): ?string => $id === 3 ? 'Staff' : null);
+    }
+
+    private function service(Context $context): GroupService
+    {
+        return new GroupService($this->repo, $this->lookup, $this->templates, $this->effects, $this->sharing, $context);
+    }
+
+    private static function admin(): FakeContext
+    {
+        return FakeContext::admin(self::ACL);
+    }
+
+    /** Domain admin of example.org with its mailboxes a@ and b@ */
+    private static function domainAdmin(array $acl = self::ACL): FakeContext
+    {
+        return FakeContext::domainAdmin(['a@example.org', 'b@example.org'], ['example.org'], $acl);
+    }
+
+    private static function stored(array $row = [], array $members = ['a@example.org' => 'manual'], array $sendAs = []): Group
+    {
+        $group = Group::fromRow($row + ['id' => 7, 'domain' => 'example.org', 'name' => 'Sales', 'address' => 'sales@example.org',
+            'sender_allowed' => 1, 'active' => 1, 'priority' => 0]);
+        $group->members = $members;
+        $group->sendAs = $sendAs;
+        return $group;
+    }
+
+    private function expectUserError(string|array $msg, callable $call): void
+    {
+        try {
+            $call();
+            $this->fail('UserError ' . json_encode($msg) . ' expected');
+        } catch (UserError $e) {
+            $this->assertSame($msg, $e->msg());
+        }
+    }
+
+    public static function deniedEditors(): array
+    {
+        return [
+            'user' => [FakeContext::user('a@example.org', self::ACL)],
+            'domain admin without ACL' => [self::domainAdmin([])],
+            'read-only API key' => [new Context('admin', 'API', self::ACL, false, 'ro')],
+            'system' => [Context::system()],
+        ];
+    }
+
+    #[DataProvider('deniedEditors')]
+    public function testOnlyAdminsAndDomainAdminsWithAclMayWrite(Context $context): void
+    {
+        $this->repo->expects($this->never())->method('insert');
+
+        $this->expectUserError('access_denied', fn() => $this->service($context)->create(['domain' => 'example.org', 'name' => 'X']));
+    }
+
+    public function testReadOnlyApiKeyMayRead(): void
+    {
+        $this->repo->expects($this->once())->method('visibleIds')->willReturn([7]);
+
+        $this->assertSame([7], $this->service(new Context('admin', 'API', self::ACL, false, 'ro'))->visibleIds());
+    }
+
+    public function testCreateNormalisesInput(): void
+    {
+        $this->repo->expects($this->once())->method('insert')->with($this->callback(function (Group $g): bool {
+            $this->assertSame('example.org', $g->domain);
+            $this->assertSame('Sales', $g->name);
+            $this->assertSame('sales@example.org', $g->address);
+            $this->assertSame(['a@example.org' => 'manual', 'b@example.org' => 'manual'], $g->members);
+            $this->assertSame(['@alias.org', 'shared@example.org'], $g->sendAs);
+            $this->assertSame([1, 0, 1, 1], [$g->senderAllowed, $g->sogoVisible, $g->internal, $g->active]);
+            $this->assertSame([3, 'Staff', 5], [$g->templateId, $g->template, $g->priority]);
+            return true;
+        }))->willReturn([]);
+
+        $group = $this->service(self::admin())->create([
+            'domain' => ' Example.ORG ', 'name' => ' Sales ', 'local_part' => 'Sales',
+            'members' => "B@example.org\na@example.org, a@example.org", 'send_as' => ['Shared@Example.org', '@alias.org'],
+            'sender_allowed' => ['0', '1'], 'sogo_visible' => '0', 'internal' => 'true',
+            'template_id' => '3', 'priority' => '5',
+        ]);
+
+        $this->assertSame([], $group->warnings);
+    }
+
+    public static function invalidInput(): array
+    {
+        return [
+            'empty name' => [['name' => ' '], 'group_name_invalid'],
+            'long name' => [['name' => str_repeat('x', 101)], 'group_name_invalid'],
+            'long description' => [['description' => str_repeat('x', 256)], 'group_description_invalid'],
+            'unknown domain' => [['domain' => 'nope.org'], ['domain_not_found', 'nope.org']],
+            'address in other domain' => [['address' => 'sales@other.org'], ['group_address_invalid', 'sales@other.org']],
+            'invalid address' => [['local_part' => 'a b'], ['group_address_invalid', 'a b@example.org']],
+            'member is a resource' => [['members' => ['room1@example.org']], ['group_member_invalid', 'room1@example.org']],
+            'unknown send-as address' => [['send_as' => 'nobody@example.org'], ['group_send_as_invalid', 'nobody@example.org']],
+            'send-as on own address' => [['local_part' => 'shared', 'send_as' => 'shared@example.org'], ['group_send_as_invalid', 'shared@example.org']],
+            'send-as on unknown domain' => [['send_as' => '@nope.org'], ['group_send_as_invalid', '@nope.org']],
+            'unknown template' => [['template_id' => '4'], ['template_id_invalid', '4']],
+            'invalid priority' => [['priority' => 'high'], 'group_priority_invalid'],
+        ];
+    }
+
+    #[DataProvider('invalidInput')]
+    public function testCreateRejectsInvalidInput(array $input, string|array $msg): void
+    {
+        $this->repo->expects($this->never())->method('insert');
+
+        $this->expectUserError($msg, fn() => $this->service(self::admin())->create($input + ['domain' => 'example.org', 'name' => 'Sales']));
+    }
+
+    public function testAddressMustBeFreeAndWithinQuota(): void
+    {
+        $lookup = $this->createMock(LookupRepository::class);
+        $lookup->method('isDomain')->willReturn(true);
+        $lookup->method('addressTaken')->willReturnOnConsecutiveCalls(true, false);
+        $lookup->method('aliasesLeft')->willReturn(0);
+        $this->lookup = $lookup;
+        $this->repo->expects($this->never())->method('insert');
+        $service = $this->service(self::admin());
+
+        $this->expectUserError(['is_alias_or_mailbox', 'sales@example.org'], fn() => $service->create(['domain' => 'example.org', 'name' => 'S', 'local_part' => 'sales']));
+        $this->expectUserError('max_alias_exceeded', fn() => $service->create(['domain' => 'example.org', 'name' => 'S', 'local_part' => 'sales']));
+    }
+
+    public function testNameIsUniquePerDomain(): void
+    {
+        $this->repo->method('nameExists')->willReturn(true);
+
+        $this->expectUserError(['object_exists', 'Sales'], fn() => $this->service(self::admin())->create(['domain' => 'example.org', 'name' => 'Sales']));
+    }
+
+    public function testDomainAdminScope(): void
+    {
+        $service = $this->service(self::domainAdmin());
+
+        $this->expectUserError('access_denied', fn() => $service->create(['domain' => 'other.org', 'name' => 'X']));
+        $this->expectUserError('access_denied', fn() => $service->create(['domain' => 'example.org', 'name' => 'X', 'members' => ['c@other.org']]));
+        $this->expectUserError('access_denied', fn() => $service->create(['domain' => 'example.org', 'name' => 'X', 'send_as' => '@other.org']));
+    }
+
+    public function testAdminFieldsAreIgnoredForDomainAdmins(): void
+    {
+        $this->repo->expects($this->once())->method('insert')->with($this->callback(fn(Group $g): bool =>
+            $g->templateId === null && $g->priority === 0 && $g->idpRef === null))->willReturn([]);
+
+        $this->service(self::domainAdmin())->create(['domain' => 'example.org', 'name' => 'X', 'template_id' => 3, 'priority' => 9, 'idp_ref' => 'x']);
+    }
+
+    public function testReplacingMembersKeepsIdpAndOutOfScopeMembers(): void
+    {
+        $this->repo->method('findVisible')->willReturn(self::stored([], [
+            'a@example.org' => 'manual', 'c@other.org' => 'manual', 'd@example.org' => 'idp',
+        ]));
+        $this->repo->expects($this->once())->method('update')->with($this->callback(fn(Group $g): bool =>
+            $g->members === ['b@example.org' => 'manual', 'c@other.org' => 'manual', 'd@example.org' => 'idp']))->willReturn([]);
+
+        $this->service(self::domainAdmin())->update(7, ['members' => ['b@example.org']]);
+    }
+
+    public function testIdpMembersCannotBeRemoved(): void
+    {
+        $this->repo->method('findVisible')->willReturn(self::stored([], ['a@example.org' => 'idp']));
+        $this->repo->expects($this->never())->method('update');
+
+        $this->expectUserError(['group_member_idp', 'a@example.org'], fn() => $this->service(self::admin())->update(7, ['remove_members' => 'a@example.org']));
+    }
+
+    public function testUpdateKeepsMissingAttributes(): void
+    {
+        $stored = self::stored(['description' => 'Team', 'template_id' => 3, 'priority' => 4], ['a@example.org' => 'manual'], ['shared@example.org']);
+        $this->repo->method('findVisible')->willReturn($stored);
+        $this->repo->expects($this->once())->method('update')->with($this->callback(function (Group $g): bool {
+            $this->assertSame(['Team', 'sales@example.org', 0, 3, 4], [$g->description, $g->address, $g->active, $g->templateId, $g->priority]);
+            $this->assertSame(['a@example.org' => 'manual'], $g->members);
+            $this->assertSame(['shared@example.org'], $g->sendAs);
+            return true;
+        }))->willReturn([]);
+
+        $this->service(self::admin())->update(7, ['active' => '0']);
+    }
+
+    public function testRemovingTheAddressFreesIt(): void
+    {
+        $this->repo->method('findVisible')->willReturn(self::stored());
+        $this->repo->expects($this->once())->method('update')->with($this->callback(fn(Group $g): bool => $g->address === null))->willReturn([]);
+
+        $this->service(self::admin())->update(7, ['address' => '']);
+    }
+
+    public function testForeignSendAsMakesAGroupReadOnlyForDomainAdmins(): void
+    {
+        $group = self::stored([], ['a@example.org' => 'manual'], ['@other.org']);
+        $this->repo->method('findVisible')->willReturn($group);
+        $this->repo->expects($this->never())->method('update');
+        $service = $this->service(self::domainAdmin());
+
+        $this->assertFalse($service->toArray($group)['can_edit']);
+        $this->expectUserError('access_denied', fn() => $service->update(7, ['name' => 'X']));
+    }
+
+    public function testGrantsAreNormalisedAndApplied(): void
+    {
+        $this->repo->method('findVisible')->willReturn(self::stored());
+        $this->repo->expects($this->once())->method('update')->with($this->callback(function (Group $g): bool {
+            $this->assertSame([['owner' => 'a@example.org', 'rights' => 'full', 'subscribe' => 1], ['owner' => 'b@example.org', 'rights' => 'read', 'subscribe' => 0]],
+                $g->imapGrants);
+            $this->assertSame([['owner' => 'a@example.org', 'type' => 'Calendar', 'folder' => 'personal', 'access' => 'write', 'subscribe' => 1],
+                ['owner' => 'a@example.org', 'type' => 'Contacts', 'folder' => 'team-1', 'access' => 'read', 'subscribe' => 0]], $g->sogoGrants);
+            return true;
+        }))->willReturn([]);
+        $this->sharing = $this->createMock(SharingService::class);
+        $this->sharing->expects($this->once())->method('applyImap')->with(7)->willReturn([['group_imap_grant_failed', 'b@example.org']]);
+        $this->sharing->expects($this->once())->method('applySogo')->with(7)->willReturn([]);
+
+        $group = $this->service(self::admin())->update(7, [
+            // a form sends JSON strings, an API client lists
+            'imap_grants' => '[{"owner":"B@example.org","rights":"read"},{"owner":"a@example.org","rights":"full","subscribe":1}]',
+            'sogo_grants' => [['owner' => 'a@example.org', 'type' => 'Contacts', 'folder' => 'team-1'],
+                ['owner' => 'a@example.org', 'access' => 'write', 'subscribe' => '1']],
+        ]);
+
+        $this->assertSame([['group_imap_grant_failed', 'b@example.org']], $group->warnings);
+    }
+
+    public static function invalidGrants(): array
+    {
+        return [
+            'unknown rights' => [['imap_grants' => [['owner' => 'a@example.org', 'rights' => 'admin']]], ['group_grant_invalid', 'a@example.org']],
+            'resource owner' => [['imap_grants' => [['owner' => 'room1@example.org']]], ['group_grant_invalid', 'room1@example.org']],
+            'no owner' => [['sogo_grants' => [['type' => 'Calendar']]], ['group_grant_invalid', '']],
+            'folder path' => [['sogo_grants' => [['owner' => 'a@example.org', 'folder' => '../x']]], ['group_grant_invalid', 'a@example.org']],
+            'unknown type' => [['sogo_grants' => [['owner' => 'a@example.org', 'type' => 'Mail']]], ['group_grant_invalid', 'a@example.org']],
+            'no list' => [['imap_grants' => 'a@example.org'], ['group_grant_invalid', '']],
+            'foreign owner for a domain admin' => [['imap_grants' => [['owner' => 'c@other.org']]], 'access_denied'],
+        ];
+    }
+
+    #[DataProvider('invalidGrants')]
+    public function testInvalidGrantsAreRejected(array $input, string|array $msg): void
+    {
+        $this->repo->method('findVisible')->willReturn(self::stored());
+        $this->repo->expects($this->never())->method('update');
+
+        $this->expectUserError($msg, fn() => $this->service(self::domainAdmin())->update(7, $input));
+    }
+
+    public function testForeignGrantOwnersMakeAGroupReadOnlyForDomainAdmins(): void
+    {
+        $group = self::stored();
+        $group->sogoGrants = [['owner' => 'c@other.org', 'type' => 'Calendar', 'folder' => 'personal', 'access' => 'read']];
+
+        $this->assertFalse($this->service(self::domainAdmin())->canEdit($group));
+        $this->assertTrue($this->service(self::admin())->canEdit($group));
+    }
+
+    public function testDeleteRemovesTheImapAclsFirst(): void
+    {
+        $group = self::stored();
+        $this->repo->method('findVisible')->willReturn($group);
+        $calls = [];
+        $this->sharing->expects($this->once())->method('removeImap')->with($group)->willReturnCallback(function () use (&$calls): void {
+            $calls[] = 'acl';
+        });
+        $this->repo->method('delete')->willReturnCallback(function () use (&$calls): array {
+            $calls[] = 'delete';
+            return [];
+        });
+
+        $this->service(self::admin())->delete(7);
+
+        $this->assertSame(['acl', 'delete'], $calls);
+    }
+
+    public function testDeleteReportsWarningsOfTheEffects(): void
+    {
+        $effects = $this->createMock(ChangeEffects::class);
+        $effects->expects($this->once())->method('snapshot')->with(['a@example.org'])->willReturn(['a@example.org' => 'Staff']);
+        $effects->expects($this->once())->method('apply')->with(['a@example.org'], ['a@example.org' => 'Staff'])->willReturn([['w']]);
+        $this->effects = $effects;
+        $this->repo->method('findVisible')->willReturn(self::stored());
+        $this->repo->expects($this->once())->method('delete')->with(7)->willReturn(['a@example.org']);
+
+        $this->assertSame([['w']], $this->service(self::admin())->delete(7)->warnings);
+    }
+
+    public function testLargeDistributionGroupsWarn(): void
+    {
+        $members = [];
+        for ($i = 0; $i < 1001; $i++) {
+            $members[] = 'u' . $i . '@example.org';
+        }
+        $this->repo->method('insert')->willReturn([]);
+
+        $group = $this->service(self::admin())->create(['domain' => 'example.org', 'name' => 'All', 'local_part' => 'all', 'members' => $members]);
+
+        $this->assertSame([['group_too_many_members', 'All', 1000]], $group->warnings);
+    }
+
+    public function testMembershipsAreVisibleToTheMailboxAndItsManagers(): void
+    {
+        $this->lookup->method('membershipsOf')->willReturn([['id' => 7, 'name' => 'Sales']]);
+        $this->lookup->method('sendAsOf')->willReturn(['sales@example.org']);
+        $this->templates->method('effective')->willReturn(['a@example.org' => 'Staff']);
+        $expected = ['groups' => [['id' => 7, 'name' => 'Sales']], 'template' => 'Staff', 'send_as' => ['sales@example.org']];
+
+        $this->assertSame($expected, $this->service(FakeContext::user('a@example.org', []))->membershipsOf('A@example.org'));
+        $this->assertSame($expected, $this->service(self::domainAdmin())->membershipsOf('a@example.org'));
+        $this->assertSame([], $this->service(FakeContext::user('b@example.org', []))->membershipsOf('a@example.org'));
+        $this->assertSame([], $this->service(self::domainAdmin())->membershipsOf('c@other.org'));
+    }
+}

tests/php/MailboxGroup/Service/IdpSyncServiceTest.php

@@ -0,0 +1,49 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Mailcow\Tests\MailboxGroup\Service;
+
+use Mailcow\MailboxGroup\Model\Group;
+use Mailcow\MailboxGroup\Repository\GroupRepository;
+use Mailcow\MailboxGroup\Repository\LookupRepository;
+use Mailcow\MailboxGroup\Service\ChangeEffects;
+use Mailcow\MailboxGroup\Service\IdpSyncService;
+use PHPUnit\Framework\TestCase;
+
+class IdpSyncServiceTest extends TestCase
+{
+    public function testOnlyIdpMembershipsAreReplaced(): void
+    {
+        $group = Group::fromRow(['id' => 7, 'domain' => 'example.org', 'name' => 'Sales']);
+        $group->members = ['a@example.org' => 'manual', 'b@example.org' => 'idp', 'c@example.org' => 'idp'];
+        $repo = $this->createMock(GroupRepository::class);
+        $repo->method('find')->with(7)->willReturn($group);
+        $repo->expects($this->once())->method('update')->with($this->callback(fn(Group $g): bool =>
+            $g->members === ['a@example.org' => 'manual', 'c@example.org' => 'idp', 'd@example.org' => 'idp']))->willReturn([]);
+        $lookup = $this->createMock(LookupRepository::class);
+        $lookup->method('regularMailboxes')->willReturnCallback(fn(array $u): array => array_values(array_diff($u, ['room@example.org'])));
+        $effects = $this->createMock(ChangeEffects::class);
+        $effects->method('apply')->willReturn([]);
+
+        $result = (new IdpSyncService($repo, $lookup, $effects))
+            ->syncGroupMembers(7, ['A@example.org', 'c@example.org', 'd@example.org', 'room@example.org']);
+
+        $this->assertSame(['d@example.org'], $result['added']);
+        $this->assertSame(['b@example.org'], $result['removed']);
+        $this->assertSame(['room@example.org'], $result['skipped']);
+    }
+
+    public function testNothingIsWrittenWithoutChanges(): void
+    {
+        $group = Group::fromRow(['id' => 7]);
+        $group->members = ['a@example.org' => 'idp'];
+        $repo = $this->createMock(GroupRepository::class);
+        $repo->method('find')->willReturn($group);
+        $repo->expects($this->never())->method('update');
+        $lookup = $this->createMock(LookupRepository::class);
+        $lookup->method('regularMailboxes')->willReturn(['a@example.org']);
+
+        (new IdpSyncService($repo, $lookup, $this->createMock(ChangeEffects::class)))->syncGroupMembers(7, ['a@example.org']);
+    }
+}