Roundcube Multi-Domain: "AUTHENTICATE PLAIN: Authentication Failed"

Decision: separate the Webmail host from the mailbox domain

Webmail host

The HTTP name used to open Roundcube, such as mail.example.net. It selects a host-specific configuration file.

Mailbox domain

The domain in the IMAP account principal, such as example.net. It does not automatically include the mail. host label.

SMTP settings

smtp_host, smtp_user, and smtp_pass apply when sending. They are not evidence for an IMAP AUTHENTICATE storage failure.

What Roundcube 1.6.17 does

The official multi-domain guide says an enabled include_host_config loads the file matching the HTTP host and merges only that file's options over the main configuration. A mapping array can assign each Webmail host to a named file.

In Roundcube 1.6.17, username_domain has two different behaviors. If the submitted login contains no @, Roundcube appends the configured domain. If the login already contains a domain, Roundcube leaves it unchanged unless username_domain_forced is true. That forced option is false by default.

This makes a full login at a Webmail host domain materially different from either a local-part login or a full address at the mailbox domain. A URL such as mail.example.net can select the right config while user@mail.example.net is still the wrong IMAP principal for a mailbox whose real address is user@example.net.

The host-specific file starting with $config = []; is not by itself proof that the main config was erased. The 1.6.17 loader includes the file, then merges its resulting array over the accumulated settings. Host files should still contain only the values that differ, as the official guide recommends.

Run the first bounded test

1. Prove the affected HTTP host loaded the expected file. A harmless domain-specific product_name is a visible signal; protected effective-config inspection is stronger.
2. Keep username_domain equal to the mailbox domain expected by IMAP.
3. Sign out and start a fresh private session. Submit either the local part alone or the complete expected mailbox address.
4. Do not submit a full address at the Webmail host domain unless that is genuinely the backend account principal.
5. Refresh the mailbox once so the later reconnect path is tested, not only the first page transition.

// Host-specific file: include only values that differ.
$config['product_name'] = 'Domain 2 Webmail';
$config['imap_host'] = 'tls://imap-host-for-domain-2:143';
$config['username_domain'] = 'mailbox-domain-for-domain-2';

// Optional policy, not a first reflex:
// $config['username_domain_forced'] = true;

Enable forced replacement only when every login on that Webmail host should be rewritten to the configured mailbox domain. Otherwise, use the local part or the already correct full mailbox address.

If the first page opens but refresh fails

After a successful login, Roundcube stores the normalized username, storage host, port, TLS mode, and encrypted password in the session. Its later storage reconnect reads those same session fields and calls the IMAP connection again. Compare the initial and reconnect evidence inside one narrow private request window.

Different username domain

A login hook, stale session, or unintended domain transformation changed the authentication principal. Fix that boundary before rotating a password.

Different host or TLS mode

The request selected a different host-specific config or retained stale session state. Reproduce from a fully signed-out session.

Same identity, later rejection

Inspect backend account policy, connection limits, password state, and the bounded IMAP response. This is no longer a host-name mapping hypothesis.

Use logging privately and briefly

Roundcube 1.6.17 documents log_logins for successful and failed login records and imap_debug for the IMAP conversation. Start with the smallest protected evidence. If IMAP conversation logging is required, enable it for one controlled attempt, restrict access to the log, then disable it.

$config['log_logins'] = true;

// Only for one protected diagnostic window:
$config['imap_debug'] = true;

A safe public update needs only categorical evidence: host config matched or missed, submitted login shape, append-only or forced domain mode, initial or reconnect failure, and whether the backend accepted the expected mailbox-domain principal. Do not publish the raw log.

Reduce unrelated authentication hooks last

The reported configuration enables many bundled plugins, including authentication-related examples. Roundcube's shipped autologon plugin identifies itself as a sample and registers startup and authenticate hooks. If the direct username-domain test does not explain the result, reproduce with only the plugins actually required by the deployment, then add authentication plugins back deliberately.

This is a secondary isolation step. A normal request without the sample plugin's trigger is not proof that the plugin caused the failure.

Evidence required before calling it fixed

1. Each Webmail request host selects exactly one intended host-specific file.
2. The effective IMAP host and mailbox domain are known without exposing their values publicly.
3. The submitted login becomes the principal expected by the IMAP backend.
4. A fresh login succeeds and a later mailbox refresh reconnects without storageerror.
5. The same regression is repeated once for every intended domain.
6. Outbound SMTP is tested separately; IMAP success is not message submission or delivery evidence.