Grommunio Web App Passkey Plugin

eryx

Hi everyone,

if you're interested, I've created a plugin for the Grommunio Web App to also support Passkeys. If you also use my 2FA plugin than this will not be used anymore as the passkeys would have precedence.

Here is the GitHub repo. Feel free ton contribute or leave comments.

https://github.com/eryx12o45/grommunio-web-passkey-plugin

DVCon

Hi,

Thank you for writing this plugin. I would love to use it with my Yubikey.
Maybe I missed something. But I'm unable to get it to work on my appliance. After copying it to the plugin folder, I get the Error 500 when loggin in.
The nginx log shows this

2025/08/24 10:47:22 [error] 1732#1732: *5944 FastCGI sent in stderr: "PHP message: PHP Fatal error: Uncaught Error: Failed opening required '/usr/share/grommunio-web/plugins/passkey/php/vendor/autoload.php' (include_path='.:/usr/share/php8:/usr/share/php/PEAR') in /usr/share/grommunio-web/plugins/passkey/php/plugin.passkey.php:3 Stack trace: #0 /usr/share/grommunio-web/server/includes/core/class.pluginmanager.php(388): include_once() #1 /usr/share/grommunio-web/index.php(153): PluginManager->initPlugins() #2 {main} thrown in /usr/share/grommunio-web/plugins/passkey/php/plugin.passkey.php on line 3" while reading response header from upstream, client: xxx.xxx.xxx.xxx, server: _, request: "GET /web/ HTTP/2.0", upstream: "fastcgi://unix:/run/php-fpm/php-grommunio-web-fpm.sock:", host: "xxx.xxx.xx"

Can you tell me, if there is a missing requirement or if I did something wrong?

Thanks.

eryx

DVCon Hmm looks like the composer install didn't run, can you have a look in the usr/share/grommunio-web/plugins/passkey/php/ directory if there is a vendor folder?

DVCon

eryx
No, there isn't a vendor folder.
I also tried your 2FA plugin afterwards. That runs without issues. And there is also a vendor folder in the php folder.

TylerDurden

Will the plugin also work if LDAP authentication is enabled?

eryx

I see, ok then I will make sure to check in the correct stuff. I will send an update once this is done! Thanks for the feedback. Regarding LDAP I unfortunately do not know as I don't have ldap users in my system. If you can feel free to try it out and contribute :-)

eryx

@DVCon I've added the missing files, please try again. I hope it works this time

DVCon

@eryx
I got a bit further than before.
grommunio web loads. And I can go into the plugin settings. But I am unable to create a passkey. With a Yubikey, I get a message that the passkey was saved. Then I get an HTTP 500. It's the same with KeepassXC plugin.

2025/08/27 17:52:20 [error] 1759#1759: *191579 FastCGI sent in stderr: "PHP message: PHP Fatal error: Uncaught Error: Class "Webauthn\Server" not found in /usr/share/grommunio-web/plugins/passkey/php/class.passkeymodule.php:367 Stack trace: #0 /usr/share/grommunio-web/plugins/passkey/php/class.passkeymodule.php(398): PasskeyModule->getWebAuthnServer() #1 /usr/share/grommunio-web/plugins/passkey/php/class.passkeymodule.php(173): PasskeyModule->validateAttestationResponse() #2 /usr/share/grommunio-web/plugins/passkey/php/class.passkeymodule.php(63): PasskeyModule->registerPasskey() #3 /usr/share/grommunio-web/server/includes/core/class.jsonrequest.php(59): PasskeyModule->execute() #4 /usr/share/grommunio-web/grommunio.php(147): JSONRequest->execute() #5 {main} thrown in /usr/share/grommunio-web/plugins/passkey/php/class.passkeymodule.php on line 367" while reading response header from upstream, client: xxx.xxx.xxx.xxx, server: _, request: "POST /web/grommunio.php?subsystem=webapp_1756309821753 HTTP/2.0", upstream: "fastcgi://unix:/run/php-fpm/php-grommunio-web-fpm.sock:", host: "xxx.xxx.xx"

It happens with and without LDAP

eryx

DVCon Ok I will try to check this later and fix this, thanks for the feedback

eryx

@DVCon OK, I've updated all dependencies and rewrote the whole login mechanism. The version that is now in GitHub is also running on my own server, so hopefully this will also work for you.

DVCon

@eryx
Thank you for checking the plugin again. 🙂
I was now able to register a passkey with my Android phone and with KeepassXC. And I was able to log into a system with and without LDAP.
The only thing that did not work was registering a passkey for my Yubikey. I can see it in the plugin. But it isn't written to the key. I guess the issue is outside of the plugin.

As I locked myself out a couple of times, is there a way to deactivate the plugin for a user without directly editing the websettings json file?

eryx

@DVCon thanks for the feedback and great to hear this. Unfortunately I do not know a way. I've also had this and had to trick the system by editing the plugin/passkey/php/login.php to set the correct setting and forward to the login page (so hard disable the authentication) to then edit things within the settings part. You can change a setting in the config.php and hard disable the plugin but I think then also you cannot access the gui in to configure things :-(