Different FQDNs for the WebUI account access?

Questions
1

Your question

The WebUI, with the “built-in” OIDC, seems to only redirect/work with the default hostname/domainname.

Do I seem to miss a documentation page? (At least Claude wasn’t showing me in any direction to the opposite)

I’d like to have a different (okay, tenant might be a differentiator, but not really) domain for the service/server, and a separate set for the user’s access to edit their stuff.

I understand that topics in this category are triaged by a bot first but a human reply will follow up. If I’d prefer a human-only reply, I’ll add the no-ai tag to my topic.

on

2

Let me look into the OIDC redirect/hostname configuration for the WebUI.

The key constraint is documented clearly: the WebUI’s built-in OAuth flow builds its discovery/callback URLs from a single base – either STALWART_PUBLIC_URL (if set) or defaultHostname. Because the OAuth callback URL must exactly match the registered redirect URI, you can only have one base URL for the OAuth flow at a time.

That said, here is what the docs do and don’t cover for your use case:

What you can do:

  • Set STALWART_PUBLIC_URL to the FQDN you want users to hit (e.g. https://account.example.com). This overrides what’s published in OAuth/OIDC/JMAP discovery documents, so that FQDN will work for the OAuth callback.
  • defaultHostname continues to be used for SMTP greetings, outbound headers, and TLS SANs, so you can keep it pointing at your mail server FQDN (e.g. mail.example.com).
  • Both FQDNs just need to point at the same Stalwart instance (or reverse proxy in front of it).

What the docs don’t describe is a way to have two simultaneously active OAuth base URLs (e.g. one for admins and a different one for user self-service), since the discovery document only exposes one issuer URL. The WebUI uses the custom stalwart://auth redirect URI scheme, so it isn’t an HTTP redirect in the traditional sense – but the issuer base URL is still singular.

In short: use STALWART_PUBLIC_URL to point at whichever FQDN you want to be the user-facing one, and keep defaultHostname for mail infrastructure purposes. Having two independent OAuth-capable FQDNs for the same instance simultaneously is not described in the current docs.

Relevant docs:

This is an automated reply from the Stalwart Help Bot. Other community members may follow up if this answer is incomplete or wrong.

3

0_o

Developers: Any plans to have that “internal” settings/configs? Perhaps part of the UI binding configurations?