SOGo 6 Evaluation: A Technical Deep Dive

DevOps Certification Study Plan - Free PDF Download

Download the free DevOps Certification Study Plan PDF - 12-week study calendar for LPI DevOps Tools Engineer, CKAD, CKA, and Terraform Associate.

Three Bugs That Blocked OpenCloud OIDC Login — A Debugging War Story

How three independent bugs — a missing LDAP EQUALITY rule, an invisible disabled filter, and a misconfigured OIDC role driver — stacked to block every OpenCloud login, and what it took to find them.

TL;DR: SOGo 6 is a complete rebuild of the classic SOGo groupware suite, replacing the GNUstep/Objective-C stack with a modern Next.js 16 + Flask/Python 3.14 architecture. This fork packages it with Stalwart mail server and OpenLDAP, implements every major roadmap feature, and adds SSO, MFA, app passwords, calendar/contact sharing, and a CardDAV sync engine — all backed by >1,800 passing tests.

Why SOGo 6?

SOGo has been a staple of the self-hosted groupware landscape for years, but SOGo 5's GNUstep/Objective-C foundation made it difficult to extend, containerize, and maintain. SOGo 6 is a ground-up rewrite that addresses these pain points directly:

• Frontend: Next.js 16, React 19, TypeScript, Tailwind CSS v4
• Backend: Python 3.14, Flask, PostgreSQL, Redis
• Authentication: LDAP with SQL user source support planned
• Deployment: Multi-stage Docker builds, non-root containers, health checks

The result is a stack that feels modern, containerizes cleanly, and is straightforward to extend.

Architecture

The stack runs seven Docker services orchestrated via Docker Compose:

┌─────────────┐     ┌──────────────┐     ┌─────────────┐
│  SOGo6 UI   │────▶│SOGo6 Server │────▶│ PostgreSQL  │
│ Next.js 16  │     │ Flask/Python │     │             │
│ :3000       │     │ :5000        │     │             │
├─────────────┤     ├──────────────┤     ├─────────────┤
│ NGINX       │     │              │     │   Redis     │
│ :443        │     │              │     │             │
├─────────────┤     ├──────────────┤     ├─────────────┤
│  Stalwart   │◀────│              │     │  OpenLDAP   │
│ IMAP/SMTP   │     │              │     │             │
└─────────────┘     └──────────────┘     └─────────────┘

Core SOGo 6 Features

All original SOGo 6 roadmap features are complete:

• Mail — send, read, folder management, search, bulk operations, Sieve filters, vacation auto-replies, forwarding, delivery notifications
• Calendar — full CRUD, events, tasks, reminders, free/busy lookups, external iCal sync, recurrence
• Contacts — address books, contacts with photo/birthday/anniversary fields, distribution lists, collected addresses
• Admin Panel — user CRUD via LDAP, domain configuration, system settings, session management, audit logs
• Multi-language — complete i18n for English, German, French, and Spanish (~2,100 translated strings each)
• Production Dockerfiles — multi-stage builds, non-root users, health checks, secrets management

New Features Added

Beyond the original roadmap, this fork adds significant enterprise-grade functionality:

Authentication & Security

SSO (OIDC + SAML2) — Full OpenID Connect Relying Party and SAML2 Service Provider implementation. OIDC supports discovery, token exchange, RS256/384/512 and ES256/384/512 signature validation, and RP-initiated logout. SAML2 supports AuthnRequest XML generation, HTTP-Redirect and HTTP-POST bindings, SP metadata publishing, and auto-provisioning on first login.

MFA/TOTP — Time-based one-time passwords generated via pyotp, with QR code provisioning URIs integrated directly into the login flow. Code verification happens within the existing POST /login endpoint rather than a separate challenge flow, keeping the UX simple.

App Passwords — sogo-ap-<64-hex> tokens with bcrypt hashing, exposed via a full CRUD + verify API endpoint. Designed for Thunderbird, Outlook, and other desktop/mobile clients that can't perform interactive MFA.

Password Recovery — Full lifecycle with SHA-256 hashed tokens, rate-limited endpoints, and SMTP relay via Stalwart. The recovery flow is three steps: check → re-authenticate → LDAP update.

Auth Hardening — Redis-backed brute-force protection (per-user-account tracking), per-IP rate limiting (20 requests/minute), security headers (CSP, HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy), and CORS hardening.

Collaboration

Calendar Sharing — Database-backed share tables with an ACL engine supporting VIEW, MODIFY, and DELETE permissions. A frontend share dialog lets users manage access without admin intervention.

Contact Sharing — Similar DB-backed shares with VIEW and MODIFY ACLs. Shares are enforced at both the API and UI layers.

CardDAV Sync Engine — An SSRF-protected HTTPS fetcher that connects to external CardDAV servers, performs vCard diff-by-UID, and executes insert/update/delete pipelines. Redis locking prevents concurrent sync conflicts, and sync status is exposed via the API.

Administration & Observability

Theme Settings — HSL color scheme, logo URL, and custom CSS are stored in PostgreSQL and served via a live public CSS endpoint. No redeployment needed for visual changes.

Rules CRUD — Sieve mail filter rules are stored in PostgreSQL with a full admin CRUD API, replacing the need for direct Sieve file manipulation.

Observability — Prometheus /metrics endpoint (request count, duration, errors), structured JSON logging, and an enhanced health endpoint that checks PostgreSQL, LDAP, Redis, and Stalwart connectivity.

CI/CD — GitHub Actions pipeline with build, backend test suite, Playwright E2E tests (23 scenarios), k6 load tests (3 suites), and a CardDAV sync benchmark.

Test Coverage

Deployment

The stack is fully Docker Compose-based. A single setup command gets you running:

git clone https://github.com/tobias-weiss-ai-xr/sogo6-stalwart-openldap-dockerized
cd sogo6-stalwart-openldap-dockerized
bash sogo6/scripts/setup.sh
docker compose up -d
bash sogo6/scripts/init-sogo6.sh

Two environments are supported:

• Production (docker compose up -d) — multi-stage builds, hardened containers, TLS termination
• Development (docker compose -f docker-compose.dev.yaml up -d) — hot-reloading, MailHog for email testing, pgAdmin, Redis Insight, Prometheus/Grafana

What's Next

The original source repository is at github.com/tobias-weiss-ai-xr/sogo6-stalwart-openldap-dockerized. The SOGo mailing list (users@sogo.nu) is the best place for community discussion.

Areas where feedback would be especially valuable:

1. The OIDC/SAML SSO implementation — how it compares to internal plans or existing deployments
2. The MFA/TOTP login flow — whether a separate challenge endpoint would be preferable
3. Interest in upstreaming the sharing infrastructure (calendar + contact ACL engines) into the main SOGo 6 project

Tools Used

This evaluation and the accompanying fork were developed with assistance from Mistral AI (model Mistral Medium 3.5 128B, accessed via hessian.ai and hosted at TU Darmstadt) for code generation, debugging, and architectural guidance. Many thanks to both Mistral AI and hessian.ai.