BlueMind

This guide explains how to set up single sign-on (SSO) between VaultysHub and BlueMind using SAML 2.0 or OpenID Connect.

Prerequisites

BlueMind version 4.0 or higher
Administrator access to BlueMind
BlueMind SSO module enabled
Application configured in VaultysHub with SAML2 or OpenID Connect

Configuration with SAML 2.0 (Recommended)

Configuration in VaultysHub

1. Create the application

Log in to VaultysHub as an administrator
Go to Applications → Add
Create a new application:
- Name: BlueMind
- URL: https://bluemind.example.com
- Description: Complete collaborative messaging
- Icon: Choose the BlueMind icon

2. Configure SAML2

In the Authentication tab
Select SAML2
Configure the following settings:
- Entity ID: the Entity ID of the Service Provider provided by BlueMind (and not the URL of VaultysHub)
- ACS URL: https://bluemind.example.com/saml2/SSO
- Format NameID: emailAddress
- App ID: [appid] (automatically generated unique identifier)

3. Retrieve the metadata

Note the following URLs:

IdP Metadata: https://[your-vaultyshub].link.vaultys.org/api/saml2/metadata/[appid]
SSO URL: https://[your-vaultyshub].link.vaultys.org/api/saml2/sso/[appid]
Entity ID: https://[your-vaultyshub].link.vaultys.org/[appid]
X.509 Certificate: Download from VaultysHub

Single Logout from VaultysHub is not supported.

Configuration in BlueMind

1. Access the administration console

Log in to the BlueMind administration console
Go to Security → Authentication
Click on SAML Configuration

2. Configure the identity provider

Configure the SAML settings:

Entity ID: https://[your-vaultyshub].link.vaultys.org/[appid]
SSO URL: https://[your-vaultyshub].link.vaultys.org/api/saml2/sso/[appid]
Public certificate: Import the X.509 certificate from VaultysHub

3. Configure the attributes

BlueMind Attribute	SAML Attribute	Required
Email	`email`	Yes
First Name	`firstName`	No
Last Name	`lastName`	No

VaultysHub does not transmit user groups: BlueMind groups are managed directly in BlueMind.

Configuration with OpenID Connect

Configuration in VaultysHub

1. Configure OpenID Connect

In the BlueMind application
Authentication tab → OpenID Connect
Note:
- Client ID: bluemind-xxxxxx
- Client Secret: secret-xxxxxx
- App ID: [appid]

2. Redirect URLs

Add:

https://bluemind.example.com/auth/oidc/callback
https://bluemind.example.com/api/auth/oidc/callback

Configuration in BlueMind

In Security → Authentication → OpenID Connect
Configure:

{
  "provider": {
    "issuer": "https://[your-vaultyshub].link.vaultys.org/api/oidc/[appid]",
    "discovery_url": "https://[your-vaultyshub].link.vaultys.org/api/oidc/[appid]/.well-known/openid-configuration",
    "client_id": "bluemind-xxxxxx",
    "client_secret": "secret-xxxxxx",
    "scopes": ["openid", "profile", "email"]
  }
}

Configuration of domains and users

Multi-domain management

domains:
  - name: "example.com"
    authentication: "sso"
    default_quota: "10GB"
    services:
      - email
      - calendar
      - contacts
      - chat
  
  - name: "branch.example.com"
    authentication: "sso"
    default_quota: "5GB"
    services:
      - email
      - calendar

Automatic provisioning

{
  "provisioning": {
    "enabled": true,
    "create_on_first_login": true,
    "default_settings": {
      "mailbox_quota": "5368709120",
      "calendar_enabled": true,
      "contacts_enabled": true,
      "im_enabled": true,
      "videoconference_enabled": true
    }
  }
}

Configuration of BlueMind services

Messaging

mail_settings:
  imap:
    enabled: true
    port: 143
    ssl_port: 993
  
  smtp:
    enabled: true
    port: 25
    submission_port: 587
    ssl_port: 465
  
  webmail:
    theme: "corporate"
    default_view: "conversation"
    compose_format: "html"

Calendar and contacts

{
  "calendar": {
    "default_sharing": "free_busy",
    "working_hours": {
      "start": "09:00",
      "end": "18:00",
      "days": ["mon", "tue", "wed", "thu", "fri"]
    }
  },
  "contacts": {
    "corporate_directory": true,
    "ldap_sync": false,
    "carddav_enabled": true
  }
}

Chat and video conferencing

chat_settings:
  xmpp:
    enabled: true
    domain: "chat.example.com"
    conference_domain: "conference.chat.example.com"
  
  video:
    provider: "jitsi"
    jitsi_url: "https://meet.example.com"
    default_room_settings:
      require_password: false
      enable_lobby: true
      record_enabled: false

Integration with clients

Thunderbird Configuration

<!-- Autodiscover for Thunderbird -->
<clientConfig version="1.1">
  <emailProvider id="bluemind.example.com">
    <domain>example.com</domain>
    <displayName>BlueMind - Example</displayName>
    <displayShortName>BlueMind</displayShortName>
    <incomingServer type="imap">
      <hostname>bluemind.example.com</hostname>
      <port>993</port>
      <socketType>SSL</socketType>
      <authentication>OAuth2</authentication>
      <username>%EMAILADDRESS%</username>
    </incomingServer>
    <outgoingServer type="smtp">
      <hostname>bluemind.example.com</hostname>
      <port>587</port>
      <socketType>STARTTLS</socketType>
      <authentication>OAuth2</authentication>
      <username>%EMAILADDRESS%</username>
    </outgoingServer>
  </emailProvider>
</clientConfig>

Mobile Configuration (ActiveSync)

{
  "activesync": {
    "enabled": true,
    "url": "https://bluemind.example.com/Microsoft-Server-ActiveSync",
    "require_ssl": true,
    "device_policy": {
      "require_password": true,
      "min_password_length": 6,
      "require_encryption": true,
      "allow_simple_password": false,
      "max_failed_attempts": 10,
      "remote_wipe_enabled": true
    }
  }
}

BlueMind API with SSO

API Client with SSO authentication

import requests
from datetime import datetime

class BlueMindAPI:
    def __init__(self, base_url, sso_token):
        self.base_url = base_url
        self.session = requests.Session()
        self.session.headers.update({
            'Authorization': f'Bearer {sso_token}',
            'Content-Type': 'application/json'
        })
    
    def get_user_info(self, email):
        """Retrieve user information"""
        response = self.session.get(
            f'{self.base_url}/api/user/{email}'
        )
        return response.json()
    
    def create_calendar_event(self, user_email, event_data):
        """Create a calendar event"""
        response = self.session.post(
            f'{self.base_url}/api/calendar/{user_email}/events',
            json=event_data
        )
        return response.json()
    
    def send_email(self, email_data):
        """Send an email via the API"""
        response = self.session.post(
            f'{self.base_url}/api/mail/send',
            json=email_data
        )
        return response.json()

BlueMind Webhooks

// Endpoint for BlueMind webhooks
app.post('/webhook/bluemind', async (req, res) => {
  const { event, data } = req.body;
  
  switch(event) {
    case 'user.login':
      await logUserAccess(data);
      break;
    
    case 'mail.received':
      await processIncomingMail(data);
      break;
    
    case 'calendar.event.created':
      await syncCalendarEvent(data);
      break;
    
    case 'contact.updated':
      await updateContactInCRM(data);
      break;
  }
  
  res.status(200).send('OK');
});

Configuration Testing

Log out of BlueMind
Go to https://bluemind.example.com
Click on SSO Login
Authenticate via VaultysHub
Check access to messaging

2. IMAP/SMTP test with SSO

# Test IMAP with OAuth2
openssl s_client -connect bluemind.example.com:993 -crlf
A01 AUTHENTICATE XOAUTH2 [base64_encoded_token]

# Test SMTP with OAuth2
openssl s_client -connect bluemind.example.com:587 -starttls smtp
AUTH XOAUTH2 [base64_encoded_token]

3. Client tests

Thunderbird: Automatic configuration via Autodiscover
Outlook: ActiveSync and OAuth2 support
Mobile: BlueMind iOS/Android apps with SSO

Troubleshooting

Error "SAML authentication failed"

Problem: SAML authentication fails

Solution:

Verify that the Entity ID is https://[your-vaultyshub].link.vaultys.org/[appid]
Check the format of the X.509 certificate
Check the logs: /var/log/bluemind/core.log
Test with SAML-tracer (browser extension)

Error "User not found"

Problem: SSO user not found

Solution:

Verify that automatic provisioning is enabled
Ensure that the email matches the BlueMind domain
Check the email attribute in the SAML assertion

Group synchronization issue

Problem: Groups are not correctly mapped

Solution: VaultysHub does not transmit groups (neither in SAML nor in OpenID Connect). Manage group membership directly in BlueMind.

ActiveSync error with SSO

Problem: ActiveSync does not work with SSO

Solution:

Generate an application password for ActiveSync
Use OAuth2 if supported by the client
Configure modern authentication in Exchange/ActiveSync

Security

Recommended configuration

{
  "security_settings": {
    "enforce_sso": true,
    "session_timeout": "8h",
    "tls_version": "1.2",
    "cipher_suites": [
      "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
      "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
    ],
    "antivirus": {
      "enabled": true,
      "engine": "clamav",
      "scan_on_receive": true
    },
    "antispam": {
      "enabled": true,
      "threshold": 5.0,
      "quarantine": true
    },
    "audit": {
      "log_authentication": true,
      "log_email_access": true,
      "retention": "365d"
    }
  }
}

Compliance

GDPR: Compliant with hosting in France
Encryption: TLS 1.2+ for communications
Legal archiving: Native support
DLP: Data loss prevention rules

Prerequisites​

Configuration with SAML 2.0 (Recommended)​

Configuration in VaultysHub​

1. Create the application​

2. Configure SAML2​

3. Retrieve the metadata​

Configuration in BlueMind​

1. Access the administration console​

2. Configure the identity provider​

3. Configure the attributes​

Configuration with OpenID Connect​

Configuration in VaultysHub​

1. Configure OpenID Connect​

2. Redirect URLs​

Configuration in BlueMind​

Configuration of domains and users​

Multi-domain management​

Automatic provisioning​

Configuration of BlueMind services​

Messaging​

Calendar and contacts​

Chat and video conferencing​

Integration with clients​

Thunderbird Configuration​

Mobile Configuration (ActiveSync)​

BlueMind API with SSO​

API Client with SSO authentication​

BlueMind Webhooks​

Configuration Testing​

1. Web login test​

2. IMAP/SMTP test with SSO​

3. Client tests​

Troubleshooting​

Error "SAML authentication failed"​

Error "User not found"​

Group synchronization issue​

ActiveSync error with SSO​

Security​

Recommended configuration​

Compliance​

Resources​

Prerequisites

Configuration with SAML 2.0 (Recommended)

Configuration in VaultysHub

1. Create the application

2. Configure SAML2

3. Retrieve the metadata

Configuration in BlueMind

1. Access the administration console

2. Configure the identity provider

3. Configure the attributes

Configuration with OpenID Connect

Configuration in VaultysHub

1. Configure OpenID Connect

2. Redirect URLs

Configuration in BlueMind

Configuration of domains and users

Multi-domain management

Automatic provisioning

Configuration of BlueMind services

Messaging

Calendar and contacts

Chat and video conferencing

Integration with clients

Thunderbird Configuration

Mobile Configuration (ActiveSync)

BlueMind API with SSO

API Client with SSO authentication

BlueMind Webhooks

Configuration Testing

1. Web login test

2. IMAP/SMTP test with SSO

3. Client tests

Troubleshooting

Error "SAML authentication failed"

Error "User not found"

Group synchronization issue

ActiveSync error with SSO

Security

Recommended configuration

Compliance

Resources