carbonio-auth problem

After change log level in envoy I see in logs

Feb 26 16:43:59 mail consul[259257]: [2024-02-26 16:43:59.092][259318][debug][filter] [source/common/tcp_proxy/tcp_proxy.cc:397] [C37] Creating connection to cluster carbonio-auth.default.dc1.internal.188d6156-507c-4a5a-e7d3-ffdd9089ceaf.consul
Feb 26 16:43:59 mail consul[259257]: [2024-02-26 16:43:59.092][259318][debug][upstream] [source/common/upstream/cluster_manager_impl.cc:1453] no healthy host for TCP connection pool
Feb 26 16:43:59 mail consul[259257]: [2024-02-26 16:43:59.092][259318][debug][connection] [source/common/network/connection_impl.cc:133] [C37] closing data_to_write=0 type=1
Feb 26 16:43:59 mail consul[259257]: [2024-02-26 16:43:59.092][259318][debug][connection] [source/common/network/connection_impl.cc:243] [C37] closing socket: 1

How to add host to TCP connection pool? 🙂

Can't work https://mail.SERVER.net/carbonio/settings/auth also.

In /opt/zextras/log/mailbox.log errors like SoapEngine - cannot dispatch request

com.zimbra.common.service.ServiceException: unknown document: GenerateOTPRequest

com.zimbra.common.service.ServiceException: unknown document: ListOTPRequest

com.zimbra.common.service.ServiceException: unknown document: AddCredentialRequest

Also in mail store node errors:

2024-02-27 12:59:05,284 WARN [qtp1004009692-50933] [] extensions - unable to find handler for extension: system failure: Extension HTTP handler not found at /metrics/auth

after check from Prometheus from monitoring node.

Anybody have a any ideas?

Anybody from Zextras read this forum? 0:-)

I have identical problems. Did you manage to solve this?

Did anyone solved this problem ? 
Chat works, files works, meeting room chat works but no voice, no video, problem with paths :

/zx/login/v3/account
/services/catalog/services
/zx/login/v3/config

console: 

~ $netstat -anp | grep 20008
tcp 0 0 127.78.0.1:20008 0.0.0.0:* LISTEN 4017/envoy
tcp 0 0 127.78.0.1:20008 0.0.0.0:* LISTEN 4017/envoy
tcp 0 0 127.78.0.1:20008 0.0.0.0:* LISTEN 4017/envoy
tcp 0 0 127.78.0.1:20008 0.0.0.0:* LISTEN 4017/envoy
tcp 0 0 127.78.0.1:20008 0.0.0.0:* LISTEN 4017/envoy
tcp 0 0 127.78.0.1:20008 0.0.0.0:* LISTEN 4017/envoy
tcp 0 0 127.78.0.1:20008 0.0.0.0:* LISTEN 4017/envoy
tcp 0 0 127.78.0.1:20008 0.0.0.0:* LISTEN 4017/envoy

amavis Running
antispam Running
antivirus Running
directory-server Running
mailbox Running
memcached Running
mta Running
opendkim Running
proxy Running
service webapp Running
service-discover Running
stats Running
config service Running

~ $curl 127.78.0.1:20008
curl: (56) Recv failure: Connection reset by peer

~ $ curl  127.78.0.1:20008/zx/login/v3/account
curl: (56) Recv failure: Connection reset by peer

I have some findings on this similar problem with a diagnosis with Claude Sonnet 4.6.  Not sure if there are any regulations or T&C surrounding this, but if its allowed, I'd like to share.  If we are not allow to post machine learning based results and posts, thats fine also.

Environment: Carbonio CE 26.3.2, carbonio-proxy 4.11.0-1jammy, single-node, Ubuntu 22.04.5.

I can reproduce the same carbonio-auth / Envoy / 127.78.0.1:20008 issue, but in my case it blocks SAML metadata generation.

Environment:

- Carbonio CE from the current official Ubuntu Jammy repository
- Ubuntu Server 22.04.5
- Single-server installation
- Clean lab VM installation following the official manual installation sequence
- Same behavior reproduced on production with the same package set

Relevant packages:

carbonio-message-dispatcher-ce 1.1.2-1jammy
carbonio-message-dispatcher-db 0.2.5-1ubuntu
carbonio-user-management 1.0.3-1jammy
carbonio-proxy 4.11.0-1jammy

Installation state:

- carbonio-bootstrap completed
- service-discover setup-wizard completed
- pending-setups -a completed
- no pending setup scripts left
- systemctl --failed shows 0 failed units
- zmcontrol status shows all main services running

Issue:

The endpoint:

https://<host>/zx/auth/samlMetadata?domain=<domain>

returns:

HTTP/2 502
Error 502 Connection to Upstream is Refused

This blocks SAML integration with Keycloak because the Carbonio SP metadata endpoint is not available.

Consul catalog has no carbonio-auth service:

curl -sk removed link | python3 -m json.tool

returns:

[]

Generated nginx config routes /zx/auth/ to carbonio-auth:

upstream carbonio-auth {
server 127.78.0.1:20008 fail_timeout=10s;
}

location ^~ /zx/auth/ {
proxy_pass http://carbonio-auth/zx/auth/;
}

service-discover config for carbonio-proxy also contains:

destination_name = "carbonio-auth"
local_bind_port = 20008

The Envoy listener exists:

127.78.0.1:20008 is listening and belongs to carbonio-proxy-sidecar.service.

But direct request to the listener fails:

curl -v --max-time 5 'http://127.78.0.1:20008/zx/auth/samlMetadata?domain=<domain>'

returns:

Empty reply from server

The same behavior is reproduced on our production Carbonio CE server with the same package set:

- catalog/service/carbonio-auth returns []
- 127.78.0.1:20008 is listening
- /zx/auth/samlMetadata?domain=<domain> returns HTTP/2 502

Question:

Is Carbonio Auth / SAML metadata generation supported in Carbonio CE with the current official package set?

If yes, which package or setup step is supposed to register the carbonio-auth service in Consul?

If no, it looks like generated nginx/service-discover configuration still includes a route to carbonio-auth even though the backend service is not present in CE. Please confirm whether this is an expected CE limitation or a packaging/config-generation bug.

I have a diagnostic report from a clean lab VM and can provide it if needed.