Grommunio Web App Passkey Plugin

eryx

Hi everyone,

if you're interested, I've created a plugin for the Grommunio Web App to also support Passkeys. If you also use my 2FA plugin than this will not be used anymore as the passkeys would have precedence.

Here is the GitHub repo. Feel free ton contribute or leave comments.

https://github.com/eryx12o45/grommunio-web-passkey-plugin

DVCon

Hi,

Thank you for writing this plugin. I would love to use it with my Yubikey.
Maybe I missed something. But I'm unable to get it to work on my appliance. After copying it to the plugin folder, I get the Error 500 when loggin in.
The nginx log shows this

2025/08/24 10:47:22 [error] 1732#1732: *5944 FastCGI sent in stderr: "PHP message: PHP Fatal error: Uncaught Error: Failed opening required '/usr/share/grommunio-web/plugins/passkey/php/vendor/autoload.php' (include_path='.:/usr/share/php8:/usr/share/php/PEAR') in /usr/share/grommunio-web/plugins/passkey/php/plugin.passkey.php:3 Stack trace: #0 /usr/share/grommunio-web/server/includes/core/class.pluginmanager.php(388): include_once() #1 /usr/share/grommunio-web/index.php(153): PluginManager->initPlugins() #2 {main} thrown in /usr/share/grommunio-web/plugins/passkey/php/plugin.passkey.php on line 3" while reading response header from upstream, client: xxx.xxx.xxx.xxx, server: _, request: "GET /web/ HTTP/2.0", upstream: "fastcgi://unix:/run/php-fpm/php-grommunio-web-fpm.sock:", host: "xxx.xxx.xx"

Can you tell me, if there is a missing requirement or if I did something wrong?

Thanks.

eryx

DVCon Hmm looks like the composer install didn't run, can you have a look in the usr/share/grommunio-web/plugins/passkey/php/ directory if there is a vendor folder?

DVCon

eryx
No, there isn't a vendor folder.
I also tried your 2FA plugin afterwards. That runs without issues. And there is also a vendor folder in the php folder.

TylerDurden

Will the plugin also work if LDAP authentication is enabled?

eryx

I see, ok then I will make sure to check in the correct stuff. I will send an update once this is done! Thanks for the feedback. Regarding LDAP I unfortunately do not know as I don't have ldap users in my system. If you can feel free to try it out and contribute :-)

eryx

@DVCon I've added the missing files, please try again. I hope it works this time

DVCon

@eryx
I got a bit further than before.
grommunio web loads. And I can go into the plugin settings. But I am unable to create a passkey. With a Yubikey, I get a message that the passkey was saved. Then I get an HTTP 500. It's the same with KeepassXC plugin.

2025/08/27 17:52:20 [error] 1759#1759: *191579 FastCGI sent in stderr: "PHP message: PHP Fatal error: Uncaught Error: Class "Webauthn\Server" not found in /usr/share/grommunio-web/plugins/passkey/php/class.passkeymodule.php:367 Stack trace: #0 /usr/share/grommunio-web/plugins/passkey/php/class.passkeymodule.php(398): PasskeyModule->getWebAuthnServer() #1 /usr/share/grommunio-web/plugins/passkey/php/class.passkeymodule.php(173): PasskeyModule->validateAttestationResponse() #2 /usr/share/grommunio-web/plugins/passkey/php/class.passkeymodule.php(63): PasskeyModule->registerPasskey() #3 /usr/share/grommunio-web/server/includes/core/class.jsonrequest.php(59): PasskeyModule->execute() #4 /usr/share/grommunio-web/grommunio.php(147): JSONRequest->execute() #5 {main} thrown in /usr/share/grommunio-web/plugins/passkey/php/class.passkeymodule.php on line 367" while reading response header from upstream, client: xxx.xxx.xxx.xxx, server: _, request: "POST /web/grommunio.php?subsystem=webapp_1756309821753 HTTP/2.0", upstream: "fastcgi://unix:/run/php-fpm/php-grommunio-web-fpm.sock:", host: "xxx.xxx.xx"

It happens with and without LDAP

eryx

DVCon Ok I will try to check this later and fix this, thanks for the feedback

eryx

@DVCon OK, I've updated all dependencies and rewrote the whole login mechanism. The version that is now in GitHub is also running on my own server, so hopefully this will also work for you.

DVCon

@eryx
Thank you for checking the plugin again. 🙂
I was now able to register a passkey with my Android phone and with KeepassXC. And I was able to log into a system with and without LDAP.
The only thing that did not work was registering a passkey for my Yubikey. I can see it in the plugin. But it isn't written to the key. I guess the issue is outside of the plugin.

As I locked myself out a couple of times, is there a way to deactivate the plugin for a user without directly editing the websettings json file?

eryx

@DVCon thanks for the feedback and great to hear this. Unfortunately I do not know a way. I've also had this and had to trick the system by editing the plugin/passkey/php/login.php to set the correct setting and forward to the login page (so hard disable the authentication) to then edit things within the settings part. You can change a setting in the config.php and hard disable the plugin but I think then also you cannot access the gui in to configure things :-(

Sumi

Hi eryx,

I'm having a problem with your Passkey plugin.
The plugin itself seems to be working fine; there were no errors during creation.
The problem is that it fails to register.
For example, a key was created in Bitwarden, but it doesn't seem to be working.

Could you please fix this problem?

I've included a few more photos so you can see what's happening.

Thank you.

eryx

Hi @Sumi,

sorry just saw the post. I will have a look asap.

eryx

@Sumi I've updated all components (latest version is on my github) and also tried the build plugin on my server and everything works. I was able to register a new passkey and also use this. also delete it afterwards.

Sumi

Thanks i will try

Sumi

Unfortunately, I'm still having the same problem.
I followed the installation instructions on the GitHub page.
I left the config file at its default settings.
But the message is still the same: it can't register the passkey.
And it's already entered in Bitwarden.

Tested in follow Browser:
Opera (Linux/Arch)
Chrome (Linux/Arch)
Firefox (Linux/Arch)
Microsoft Edge on Windows10

All the Same Problem.
Im using a Reverse Proxy for my Webinterface is this the problem?

Because I always use a reverse proxy so that I can publish my certificate via the URL.

UPDate:
i have solved the Problem for me.
Set the RP_ID and it works.

However, it seems that it's not working correctly with Bitwarden. It was created, and Bitwarden confirms that it was created, but when logging in, I only have the option to select it via a hardware key.

eryx

@Sumi thanks for testing and finding this. I will add it to the README that this needs to be filled out.

Unfortunately I do not have bitwarden to test this

crpb

for testing i can recommend https://vault.vaultwarden.net/#/signup

i only have self-hosted instances but it works with any official bitwarden client/browser-addon

Sumi

crpb

Ok thanks, i have at moment "Bitwarden Lite" Docker running but i will migrate to Valutwarden then i will test again.