## Configure EGroupware for SSO via SAML with Univention
### SAML IdP need to be enabled, see [UCS Manual about login](https://docs.software-univention.de/manual/5.0/en/central-management-umc/login.html#central-management-umc-login)
* ```ucs-sso.<domain>``` need to resolve to one or more primary or secondary domain controllers
* if you use LetsEncrypt, you should add the above domain to your certificate
* UCS config registry variable ```portal/auth-mode``` has to be set to ```saml```
* portal server needs to be restarted: ```systemctl restart univention-portal-server.service```
### EGroupware needs to be configured for SAML via Setup (```https://egw.example.org/egroupware/setup/```)
* Login into setup with user ```admin``` and the password from ```/var/lib/egroupware/egroupware-docker-install.log```
* [How does Single Sign-on work?](https://www.univention.com/blog-en/2021/08/how-does-single-sign-on-work-with-saml-and-openidconnect/)
* [Reconfigure UCS Single Sign On](https://help.univention.com/t/reconfigure-ucs-single-sign-on/16161)
* [Create an SSO Login for Applications to Groups](https://www.univention.com/blog-en/2020/07/sso-login-for-groups/)
* [Adding a new external service provider](https://docs.software-univention.de/manual/5.0/en/domain-ldap/saml.html#domain-saml-additional-serviceprovider)
### Configure EMail access without password
> EGroupware normally use the session password to authenticate with the mail-server / Dovecot. If you use SSO (single sign on), EGroupware does not know your password and therefore can not pass it to the mail server.
* login via ssh as user root to your mailserver
* note the password from /etc/dovecot/master-users (secretpassword in the example below)
```
dovecotadmin:{PLAIN}secretpassword::::::
```
* add the following line to your /etc/dovecot/global-acls
> Currently, there are two bugs, you need to work around:
> 1. EGroupware checks the above user/password as an IMAP user, so you need to additionally create him as UCS user with mail, in order to be able to store the dialog.
> 2. The account you use for testing, must NOT have any additional personal mail accounts, as you get an error in that case, when you open the mail app.
