Custom Scope Mapping not executed and mailcow_template claim missing (Mailcow Integration)

[df9ry]

Hello Authentik Community,

I am trying to integrate Mailcow (version 2025-03 or later) with Authentik (version 2026.2.2) using OIDC for Single Sign-On (SSO). Despite following the official documentation and numerous troubleshooting steps, I am unable to get the integration to work. I am hoping someone here might have encountered a similar issue and can provide guidance.

The Core Problem:
My main issue is that a custom Scope Mapping I created for the mailcow_template claim is not being executed. As a result, the required claim is missing from the access token, causing both the Mailcow connection test and the actual user login to fail.

What I've Verified:

• Scope Mapping Configuration:
• Name: mailcow-template-scope
• Scope Name: mailcow_template
• Expression: I have tried several variations, but none appear to be called.

# Attempt 1 (from docs)
context["access_token"]["mailcow_template"] = "default"
context["id_token"]["mailcow_template"] = "default"
return {}

# Attempt 2 (workaround)
request.context["access_token"]["mailcow_template"] = "default"
request.context["id_token"]["mailcow_template"] = "default"
return {}

Provider Configuration:

• The scope mailcow_template is correctly selected in the Advanced protocol settings of the Mailcow OAuth2/OpenID Provider.
• The option Include claims in id_token is enabled for the provider.
• Authorization flow is set to default-provider-authorization-implicit-consent.
• The Redirect URI is configured correctly and identically in both systems (https://mail.tega.internal).

Network & Connectivity:

Manual curl tests from the Mailcow container to the Authentik token endpoint (https://sso.tega.internal/application/o/token/) using client credentials are successful and return a valid access_token and id_token.

Token Inspection:

Decoding the returned access token on jwt.io reveals that the mailcow_template claim is not present.

Adding a logging statement to the scope mapping expression shows that the mapping is never triggered when a token is requested.

Mailcow Configuration:

• Endpoints in Mailcow are correctly set to https://sso.tega.internal/application/o/authorize/, /token/, and /userinfo/.
• The mailcow_template scope is included in the Client Scopes field.
• The required Attribut Mapping (attribute: default to template: Default) is configured.

What I Suspect:
The problem seems to be that the scope mapping is not triggered because the mailcow_template scope is not being processed by Authentik during the token generation step, despite being requested and configured. This might be related to a global Authentik setting (e.g., "Include custom claims in access tokens"), which I could not locate in the UI (under System -> Settings or Tenants), or a bug specific to Authentik 2026.2.2.

My Question:
Why is the custom scope mapping not being executed, and how can I ensure the mailcow_template claim is added to the access token? Are there any global settings or other configurations I might have missed that could prevent a custom scope mapping from running?

Thank you for any insights you can provide!

[Kornelius777]

Did you get anywhere with this request?
I'm currently experiencing a similar problem.

Kind regards!