If you have just updated grommunio Web and no one can log in through the browser any more,
this is probably what you are looking at. In the Keycloak log:
type="LOGIN_ERROR", clientId="grommunio-web", userId="null",
error="invalid_redirect_uri", redirect_uri="https://mail.example.com/web/index.php"
Mail delivery, IMAP and ActiveSync keep working — mobile clients never notice. Only the web
login is dead, for every user at once.
Quick fix
Add one line to /etc/gromox/keycloak.json, with your own host name:
"redirect-url": "https://mail.example.com/web"
No Keycloak change, no restart, no service reload — PHP reads that file on every request, so the
next login attempt already works. Keep a copy of the file first; it also holds the client secret.
What happened
grommunio Web 3.19.473 derives its OAuth callback from SCRIPT_NAME and appends /index.php,
so it now asks Keycloak to redirect to https://<host>/web/index.php. The grommunio-web client
created from the grommunio-auth template registers "redirectUris": ["/web"] only, and Keycloak
requires an exact match — so the authorization request is refused before anyone gets a login
form. Earlier versions built the callback from the request URI, which produced /web and matched.
A fresh installation hits the same thing, since the template still ships /web.
If you would rather fix it in Keycloak
Adding the exact URI /web/index.php to the client's Valid redirect URIs in the admin console
works just as well. Use the exact path, not /web/*: Keycloak has had two redirect-URI
validation bypasses this year (CVE-2026-3872, CVE-2026-7504) that only affect clients carrying a
wildcard, and RFC 9700 asks for exact matching for that reason.
Whichever you pick, write down that it has to come out again once this is fixed upstream — but
do not remove it before that, or the login breaks a second time.
Reported
https://github.com/grommunio/grommunio-web/issues/152 — with the regression window, the commit
that introduced it and the template mismatch. Posting it here as well so the error string is
findable for anyone who is already stuck.
