Issue Description
I got logged out of Starwart today because I had the download URL set to latest. With a 30 day check. Therefore, with the release of version 1, the web UI got updated and we got locked out. “Sign in is not configured with the identity provider…”
If other users have the same URL for downloading the web UI, this problem will reoccur. I would have thought Latest would check for breaking changes, but anyway. This is the sequence we followed to get it back
- Server: Stalwart 0.16.23
- WebUI configuration: Automatic updates every 30 days
- Original download URL: releases/latest/download/webui.zip
- Problem: Login failed with the OAuth client metadata error, including over direct HTTPS connections.
- Resolution: Pinned the WebUI to v1.0.11 and executed Action/UpdateApps through stalwart-cli.
Expected Behavior
If there’s a breaking change, then the download shouldn’t install the wrong webUI
Actual Behavior
It would appear the error was because we had the wrong version for the web UI matched to the stalwart version.
Stalwart Version
v0.16.x
Installation Method
Binary (Linux)
Database Backend
SQLite
Blob Storage
SQLite
Search Engine
Internal
Directory Backend
Internal
I have reviewed the documentation and FAQ and confirm that my issue is NOT addressed there.
on
I have searched this support forum (open and closed topics) and confirm this is not a duplicate.
on
I understand that topics in this category are triaged by a bot first but a human reply will follow up. If I’d prefer a human-only reply, I’ll add the no-ai tag to my topic.
on
Your analysis matches what the docs describe. The fix you used is also the right one for a 0.16 server.
A 0.16 server needs a WebUI 1.x bundle. A bundle from releases/latest/download/webui.zip now points at the 2.x release, and that is the one meant for Stalwart 1.0. The two don’t match. Stalwart 1.0 only loads a bundle that contains an application manifest, and the 2.x bundles have one while the 1.x bundles don’t. The 2.x WebUI therefore doesn’t work against a 0.16 server, which probably explains the “Sign in is not configured with the identity provider” error. Your 30-day autoUpdateInterval made the server drop its stored copy and download the new bundle from latest.
The server never checks bundle versions or breaking changes. It stores whatever the resourceUrl serves and downloads it again when the stored copy expires or when an UpdateApps action runs. A latest URL therefore follows whichever release is newest, whether or not it suits your server.
Your workaround was correct. Pin resourceUrl to a release that matches your server version, then run the UpdateApps action to force a download. In 0.16 that means a 1.x WebUI release such as the v1.0.11 you used.
The long-term fix is to upgrade to Stalwart 1.0. The upgrade migration replaces the official 1.x bundle URL with the official 2.x one automatically. It keeps custom URLs and warns about them in its report. After you upgrade, the default resourceUrl is https://github.com/stalwartlabs/webui/releases/download/v2/webui.zip. That URL tracks the 2.x line, so it is safer than latest.
Upgrade guide: Overview | Stalwart
Related docs:
Your suggestion that latest should check compatibility is a design question. I couldn’t find anything in the docs saying that behaviour exists, so a human will need to follow up on that part.
This is an automated reply from the Stalwart Help Bot. Other community members may follow up if this answer is incomplete or wrong.
That latest URL started pointing at WebUI 2.x when 1.0 shipped, and WebUI 2 only works with a 1.0 server, which is why the sign-in broke on 0.16.23. 0.16.27 guards against exactly this: it treats the releases/latest/download/webui.zip URL as the pinned v1.0.11 bundle and refuses to load any bundle newer than major version 1, with a log message telling you which URL to set.
Pinning to v1.0.11 was the right fix. I’d still move to 0.16.27, since the 1.0 upgrade starts from that release anyway. When you migrate, stalwart-migrate replaces the official WebUI 1.x URL with the 2.x one, so you don’t have to remember to change the pin back.