Roundcube Auto Login from CWP User Panel – IMAP authentication fails after token

[ernlund]

Hi,

I'm experiencing an issue with the automatic login to Roundcube when opening Webmail through the CWP User Panel.

The problem:

When I open Roundcube using the Webmail link in the CWP User Panel, the automatic login works initially. However, after approximately 1–2 minutes, Roundcube starts reporting IMAP authentication errors.

If I open Roundcube directly and log in manually using the mailbox email address and password, everything works correctly, even after remaining logged in for more than five minutes.

What I have investigated:

I have checked the Dovecot logs and found that:

The initial IMAP authentication through CWP Auto Login succeeds.

Subsequent IMAP authentication attempts also succeed initially.

After approximately two minutes, authentication starts failing.

The timing corresponds almost exactly to the expiration of the token used by CWP Auto Login.

I also checked the Dovecot SQL configuration and found that it uses the following logic:

IF(token_validity >= NOW(), token, password)

This means Dovecot accepts the temporary token only until its validity expires. After that, it falls back to the normal mailbox password.

The Roundcube session, however, appears to continue using the original temporary token after it has expired.

I have confirmed this by comparing the token validity timestamp in the postfix.mailbox database with the Dovecot authentication logs. The first failed login occurred just a few seconds after the token expired.

Environment:

Control panel: CentOS Web Panel (CWP)1.30.12

Roundcube: 1.6.21

Dovecot: MySQL authentication using the CWP mailbox database

IMAP host in Roundcube: localhost:143

My questions:

Has anyone else experienced IMAP authentication failures when using Roundcube through the CWP User Panel's automatic Webmail login?

Is the short validity period of the temporary Auto Login token intentional?

Is there a mechanism to renew or refresh the token while the Roundcube session is still active?

Is this a known issue, and is there a recommended fix?

Manual login directly through Roundcube works without any problems. The issue only occurs when using the automatic login from the CWP User Panel.

I would appreciate any feedback or suggestions.

Thanks!