[horde] IMP is marked as authenticated, but no credentials can be found in the session

[Andreas Mauser]

Hi,

After the Horde 6 upgrade (to the fresh stable releases: horde 6.1.0, core 3.2.0, imp 7.0.2), login reliably produced:

IMP is marked as authenticated, but no credentials can be found in the session.

'Root'(?) cause found and fixed. Summary below, plus a few questions on whether we solved it cleanly or just papered over a symptom.
Root cause in question:
Not session locking, not the DB, not the SessionHandler - it's horde/pack v2.0.0.
Horde_Pack_Driver_Igbinary::unpack() wraps igbinary_unserialize() in a set_error_handler() (introduced between alpha4 and beta1) that treats any E_WARNING as a hard failure - even when the object was reconstructed correctly.
The chain:

IMP_Imap_Config carries debug => /var/log/horde_imp.log.
During deserialization, fopen() on that path fails - /var/log is owned by root, www-data can't create anything there → E_WARNING.
The new error handler in horde/pack treats the warning as an error and discards the correctly unpacked object.
Horde_Session::getScoped() catches the exception and silently returns the raw packed byte string.
IMP_Factory_Imap::create() sees no object → builds an empty IMP_Imap → "no credentials".

Writing to the session was correct the whole time - only the verdict on read was wrong. That's why nothing was logged and the symptom sat three layers away from the cause. Proven via instrumentation: DEBUG_IGBINARY_RESULT error=true out_type=array - good result, "error" verdict anyway.
Fixes

composer-patch on horde/pack, restoring the alpha4 behavior: patches/horde-pack-igbinary-unpack-swallows-warnings.patch. (A version pin wasn't possible - horde/pack is only a transitive dependency.)
web/index.php (root URL showed "Please create conf.php"): the check tested web/horde/config/conf.php, which the installer never creates in proxy mode. Repointed to the actually-present path var/config/horde/conf.php.

Verified: IMAP login OK, inbox loads, dynamicInit HTTP 200, 0 credential errors in syslog, root URL boots Horde directly.
Open questions - clean fix or did we fix around it?

The actual trigger is the non-writable debug path /var/log/horde_imp.log. Wouldn't the correct fix be to point debug at a www-data-writable var/log/ (or disable it)? Then no warning arises at all - the pack patch only addresses the amplifier, not the trigger.
Treating a warning as an error in horde/pack (alpha4 → beta1) is a genuine upstream regression. Our patch is a carry. The issue against horde/pack is drafted - should we submit it?
Two divergent conf.php files: the administrative config/conf.php vs. the installer-managed var/config/horde/conf.php. The new core pipeline reads only the latter. We reconciled them - will they diverge again on future composer runs? Which one is authoritative?
web/index.php is a bundle file unchanged since 2023. Is the wrong check a known issue in proxy mode (→ upstream), or did we introduce a local divergence that will collide on the next update?

Side finding (left untouched): Horde_Shutdown::runTasks() only catches Exception, not Error.
Thanks - feedback especially on 1 and 3 would help, since that decides whether we need the pack patch long-term at all.

Best regards
Andreas


July 13, 2026 at 12:12 AM, "Andreas Mauser" <andreas at mauser.info mailto:andreas at mauser.info?to=%22Andreas%20Mauser%22%20%3Candreas%40mauser.info%3E > wrote:


> 
> Hallo,
> 
> Ich debugge einen Fehler in einer Horde-6-Webmail-Installation.                                                 
>                                                                                                                               
>   ## Symptom                                                                                                                  
>   Im Webmail (dynamische IMP-Ansicht) erscheint beim Laden des Posteingangs: 
>                                                  
>   - "Fehler beim Laden der Nachrichtenliste."                                                                                 
>   - "IMP is marked as authenticated, but no credentials can be found in the session."  
>                                        
>   Der Fehler ist intermittierend / tritt beim AJAX-Nachladen der Nachrichtenliste auf.                                        
>                                                                                                  
> 
> Kennt das von euch jemand? Es traf mich nach der letzten Horde Upgrade Session.
> 
> Liebe Grüße,
> 
> Andreas
> 
> -- 
> Horde mailing list
> Frequently Asked Questions: http://horde.org/faq/
> To unsubscribe, mail: horde-unsubscribe at lists.horde.org
> 

Mit freundlichen Grüßen,
Andreas

~ Andreas ist keine KI und kann Fehler machen ~