For the customer interface of Silversun, I wanted to use RC as the internal web mail application and therefore had to embed it into my system. To avoid that the customer has to log in twice (customer interface and Roundcube), I had to simulate the login request with a PHP script.

Updates

November 2008: After the comment of Matias, I reviewed the code and fixed some issues. Now it should work properly even with the newest Roundcube version (0.2-beta). The class file itself contains installation instructions. Please read them carefully.

March 2009: Just tested the script with version 0.2.1 and it works like a charm, at least for my installation.

December 2009: Diego just confirmed (via e-mail) that the script also works for 0.3.1 without modification.

May 2010: I just tested the scripts with Roundcube 0.4-beta, and it still works without modification. I also added the section Debugging make it easier to figure out what’s wrong.

March 2011: After Alex’ comment, I adjusted a small part of the script. It should now also work with Roundcube 0.5.1. It now handles the new request token correctly. The pre-0.5.1 script is still available for download here: RoundcubeLogin.pre-0.5.1.class.php

Prepare RC

To perform the Roundcube login via a web site, it is necessary to turn off the check_ip/ip_check option in the main.inc.php file, because our script (= server IP address) will send the login data and pass it to RC instead of the user’s browser (= user IP address).

The RoundcubeLogin class

This small class only consists of four functions and it shouldn’t be necessary to modify it in order to get the login to work.

• RoundcubeLogin.class.php
  Provides the functionality to login, logout and check the login status.
• rclogin.php
  A small script to test if everything works as expected.

The class provides four public methods:

• login($username, $password)
  Perform a login to the Roundcube mail system.
  Note: If the client is already logged in, the script will re-login the user (logout/login). To prevent this behaviour, use the isLoggedIn()-function.
  Returns: TRUE if the login suceeds, FALSE if the user/pass-combination is wrong
  Throws: May throw a RoundcubeLoginException if Roundcube sends an unexpected answer (that might happen if a new Roundcube version behaves differently)
• isLoggedIn()
  Checks whether the client/browser is logged in and has a valid Roundcube session.
  Returns: TRUE if the user is logged in, FALSE otherwise.
  Throws: May also throw a RoundcubeLoginException (see above).
• logout()
  Performs a logout on the current Roundcube session.
  Returns: TRUE if the logout was a success, FALSE otherwise.
  Throws: May also throw a RoundcubeLoginException (see above).
• redirect()
  Simply redirects to Roundcube.

Sample usage

The script below demonstrates how the class can be used. If the client is already logged in, it simply redirects the browser to the Roundcube application. If not, it performs a login and then redirects to Roundcube.

<?php
 
include "RoundcubeLogin.class.php";	
 
# Create RC login object.
# Note: The first parameter is the URL-path of the RC inst.,
#       NOT the file-system path
# e.g. http://host.com/path/to/roundcube/ --> "/path/to/roundcube"
$rcl = new RoundcubeLogin("/roundcube/", $debug);
 
try {
   # If we are already logged in, simply redirect
   if ($rcl->isLoggedIn())
      $rcl->redirect();
 
   # If not, try to login and simply redirect on success
   $rcl->login("some-email-address", "plain-text-password");
 
   if ($rcl->isLoggedIn())
      $rcl->redirect();
 
   # If the login fails, display an error message
   die("ERROR: Login failed due to a wrong user/pass combination.");
}
catch (RoundcubeLoginException $ex) {
   echo "ERROR: Technical problem, ".$ex->getMessage();
   $rcl->dumpDebugStack(); exit;
}
 
?>

Debugging

If you’re having problems with the RoundcubeLogin.class.php class itself, try using the rclogin.php-file for debugging: open the file in your browser (http://myhost/roundcube/rclogin.php), and take a look at the output. The RoundcubeLogin-class performs a series of request/response cycles and parses the output to figure out if you’re logged in.

Known issues:

1. No Roundcube installation found at ‘…’
   This error message is thrown if the path-value in the RoundcubeLogin constructur was not set correctly. It must be set to the part of the URL that represents the path, e.g. in case of http://myhost/roundcube/ you must create the object like this:

   $rcl = new RoundcubeLogin("/roundcube/");

2. Unable to determine login-status due to technical problems.
   This error can occur in the methods login(), logout() and isLoggedIn(). The RoundcubeLogin-class expects Roundcube to send certain headers in response to the login/logout-requests. If those headers could not be found, this error is thrown. Possible reasons are:
   • New RC version
   • Cookies must be enabled
   • ip_check/check_ip option in the main.inc.php must be false
3. Unable to determine the login status. Unable to continue due to technical problems.
   This error occurs if the script cannot determine if you are logged in or not, because the returned HTML code neither contains the login-form (= logged out) nor the message DIV (= logged in). This might happen if Roundcube changed the HTML-code.

I’m open for suggestions

Please feel free to post your comment or suggestions. That’s the only way to ensure that it works with all versions.