Authenticates users via a trusted reverse proxy that sets an HTTP header
with the authenticated user's e-mail address (e.g. Authelia, Caddy,
Traefik, Nginx auth_request).
Unlike the existing proxy-auth plugin, no master IMAP user is required.
Users enter their own IMAP password once; it is stored encrypted and
reused for all future logins.
Features:
- Works with any standard IMAP server
- Credentials stored encrypted per-user (APP_SALT + SSO email)
- Session identity tracking via cookie to handle user switches
- Loop-guard cookie prevents redirect loops on failed auto-login
- Additional accounts (e.g. Gmail) continue to work normally
- Configurable header name and redirect URL
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
