requireClientRegistration with WebUI (Obsolete docs?)

Questions
1

Your question

I’m trying to use the requireClientRegistration: true setting on the OidcProvider singleton with the Stalwart WebUI.

The docs Dynamic Registration | Stalwart mention having to create an OAuthClient with clientID: webadmin and redirectUris: ["stalwart://auth"] in this scenario. Which leads to user accounts not being able to login on e.g. https://mail.domain.tld/account.
They just get a red error “Token exchange failed: 400 Bad Request” and the browser console shows response {"error":"invalid_request"} for the POST to https://mail.domain.tld/auth/token

Instead I had to create an OAuthClient with clientID: stalwart-webui and redirectUris: ["https://mail.domain.tld/account/oauth/callback", "https://mail.domain.tld/admin/oauth/callback"].

If desired I can prepare a PR to the website repo.

Stalwart version: 0.16.8 (Docker)

I understand that topics in this category are triaged by a bot first but a human reply will follow up. If I’d prefer a human-only reply, I’ll add the no-ai tag to my topic.

on

2

You’ve correctly identified that the documentation is out of date. Here’s what the source code actually shows:

The current WebUI uses stalwart-webui as its client ID, not webadmin. The redirect URI is dynamically constructed as {origin}{basePath}/oauth/callback, which for a standard deployment would produce URLs like https://mail.domain.tld/account/oauth/callback and https://mail.domain.tld/admin/oauth/callback – exactly what you found.

Specifically, in src/services/auth/oauth.ts:

const CLIENT_ID = (import.meta.env.VITE_OAUTH_CLIENT_ID as string) || 'stalwart-webui';
// ...
function getRedirectUri(): string {
  const basePath = getBasePath();
  return `${window.location.origin}${basePath}/oauth/callback`;
}

So when requireClientRegistration: true is set, the correct OAuthClient to register is:

Field Value
clientId stalwart-webui
redirectUris ["https://mail.domain.tld/account/oauth/callback", "https://mail.domain.tld/admin/oauth/callback"]

The docs page at Dynamic Registration | Stalwart still references webadmin and stalwart://auth, which is stale. Your observation is correct and a documentation correction is needed.

A human staff member will follow up on the doc update.

This is an automated reply from the Stalwart Help Bot. Other community members may follow up if this answer is incomplete or wrong.

3

Thanks for the report, the documentation has been updated.