Current considered solution is Authelia.

According to the documentation, it can be deployed either over bare metal (good, since we use LXCs), or over K8s.

The documentation references multiple deployment scenarios:

• Local
• Lite
• Full (with HA)

Open Authentication v2.0 database - Dovecot

https://documentation.open-xchange.com/7.10.2/middleware/mail/dovecot/oauth_2.0_with_postfix_and_dovecot.html

Roundcube supports the XOAUTH2 mechanism starting from version 1.5

Configuring Roundcube to use Oauth2

A maintained plugin exists (https://www.dokuwiki.org/plugin:oauth).

: test the configuration and paste a sample here

An Apache module is available in the Debian repositories, starting from Debian Jessie.

https://packages.debian.org/sid/libapache2-mod-auth-openidc

https://github.com/zmartzone/mod_auth_openidc

: test the configuration and paste a sample here