Dovecot Proxy with mysql passdb and oauth2 authentication: upgrade from 2.3.21 to 2.4.3 does not work

Hi,

I am running a Dovecot IMAP/POP3 proxy in my test environment using the latest version, 2.3.21, installed from the Dovecot repository.
It functions as a pure IMAP/POP3 proxy for 7 different IMAP backends (currently always Dovecot 2.3.21).

The proxy retrieves all its information from a MySQL database mainly the ip-address to which backend he should pass the connection and forwards all 
authentication information to the backend. This has always worked without any issues so far.

Now I'm trying to upgrade the proxy from 2.3.21 to 2.4.3.
I tried to convert my 2.3.21 configuration to 2.4.3 with your very helpfull tool from https://dovecot.org/upgrader/.

But now when I try to start dovecot I get the followong error in my logs:

...
2026-04-07T12:00:57.692994+02:00 imap-dev dovecot: auth: Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth
2026-04-07T12:00:57.695908+02:00 imap-dev dovecot: auth: Debug: Module loaded: /usr/lib/dovecot/modules/auth/libdriver_mysql.so
2026-04-07T12:00:57.696532+02:00 imap-dev dovecot: auth: Fatal: Cannot initialize oauth2: Missing oauth2_introspection_mode setting
2026-04-07T12:00:57.697569+02:00 imap-dev dovecot: master: Error: service(auth): command startup failed, throttling for 4.000 secs
...

As I just said, the server only works as a proxy (no mailboxes hosted on itself, etc).

Have you any idea how I can solve this issues?

Below my current .deb packages installed and "doveconf -n" from 2.4.3.

Many thanks in advance
Urban

-----------------------
# dpkg -l |grep dovecot
ii  dovecot-core                  2:2.4.3-1+debian12             amd64        secure POP3/IMAP server - core files
ii  dovecot-imapd                 2:2.4.3-1+debian12             amd64        secure POP3/IMAP server - IMAP daemon
ii  dovecot-ldap                  2:2.4.3-1+debian12             amd64        secure POP3/IMAP server - LDAP support
ii  dovecot-lmtpd                 2:2.4.3-1+debian12             amd64        secure POP3/IMAP server - LMTP server
ii  dovecot-managesieved          2:2.4.3-1+debian12             amd64        secure POP3/IMAP server - ManageSieve server
ii  dovecot-mysql                 2:2.4.3-1+debian12             amd64        secure POP3/IMAP server - MySQL support
ii  dovecot-pop3d                 2:2.4.3-1+debian12             amd64        secure POP3/IMAP server - POP3 daemon
ii  dovecot-sieve                 2:2.4.3-1+debian12             amd64        secure POP3/IMAP server - Sieve filters support
------------------------

# 2.4.3-1+debian12 (c1b22ef978): /etc/dovecot/dovecot.conf
# Pigeonhole version 2.4.3-1+debian12 (99939e07)
# OS: Linux 6.1.0-31-amd64 x86_64 Debian 12.13
# Hostname: imap-dev.domain.com
dovecot_config_version = 2.4.3
auth_cache_negative_ttl = 0
auth_cache_size = 128 M
auth_cache_ttl = 0
auth_debug = yes
auth_debug_passwords = yes
auth_failure_delay = 5 secs
auth_mechanisms = plain login oauthbearer xoauth2
auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_%@
auth_username_translation = %@
dovecot_storage_version = 2.4.0
login_log_format_elements = user=<%{user}> method=%{mechanism} rip=%{remote_ip} lip=%{local_ip} mpid=%{mail_pid} %{secured} %{ssl_security}
managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags 
copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext
protocols = imap sieve
sql_driver = mysql
ssl_min_protocol = TLSv1
verbose_proctitle = yes
namespace inbox {
   inbox = yes
   mailbox Drafts {
     special_use = "\\Drafts"
   }
   mailbox Junk {
     special_use = "\\Junk"
   }
   mailbox Sent {
     special_use = "\\Sent"
   }
   mailbox "Sent Messages" {
     special_use = "\\Sent"
   }
   mailbox Trash {
     special_use = "\\Trash"
   }
}
passdb sql {
   default_password_scheme = PLAIN
   query = SELECT NULL AS password, 'y' AS nodb, SUBSTRING_INDEX(SUBSTRING_INDEX(param, '[', -1), ']', 1) AS host, '%{user}' AS destuser, 'Y' AS 
nologin, 'Y' AS nopassword, 'Y' AS proxy, '%{mechanism}' AS proxy_mech FROM mail_username WHERE user = '%{user}' AND allow_login = 'y' AND 
('%{protocol}' = 'imap' OR '%{protocol}' = 'sieve');
}
mysql devdb1.domain.com {
   dbname = mailconfig_dev
   password = # hidden, use -P to show it
   user = imap-dev
}
sieve_script personal {
   driver = file
   path = ~/sieve
}
service imap-login {
   process_min_avail = 2
   restart_request_count = unlimited
   vsz_limit = 512 M
}
service managesieve-login {
   inet_listener sieve {
     port = 4190
   }
}
service pop3-login {
   process_min_avail = 2
   restart_request_count = unlimited
   vsz_limit = 256 M
}
service tcpwrap {
   unix_listener login/tcpwrap {
     group = $SET:default_login_user
     mode = 0600
     user = $SET:default_login_user
   }
}
ssl_server {
   cert_file = /etc/letsencrypt/live/domain.com/fullchain.pem
   dh_file = /etc/dovecot/dh.pem
   key_file = /etc/letsencrypt/live/domain.com/privkey.pem
   prefer_ciphers = server
}
protocol imap {
   imap_capability = IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE
   login_greeting = Domain-Dev IMAP Server ready.
}
protocol pop3 {
   login_greeting = Domain-Dev POP3 Server ready.
   pop3_enable_last = yes
   pop3_uidl_format = %{uid | substr(0, 8)}%{uidvalidity | substr(0, 8)}
}



_______________________________________________
dovecot mailing list -- [email protected]
To unsubscribe send an email to [email protected]