Grommunio a Feature-Rich Drop-in-Replacement for Microsoft Exchange

Exchanging Exchange

Microsoft's Exchange Team published a blog post on August 8, 2024, about decommissioning Exchange Server 2016. Although the intention was definitely not to make people switch to an open source groupware, the announcement was enlightening:

Exchange 2016 is approaching the end of extended support and will be out of support on October 14th, 2025. If you are using Exchange Server 2019, you will be able to in-place upgrade to the next version, Exchange Server Subscription Edition (SE), so Exchange Server 2016 will need to be decommissioned at some point. If you plan to stay on-premises, we recommend moving to Exchange 2019 as soon as possible. [1]

A long list of todos and caveats follows, including reboots after upgrade. No wonder Microsoft's general strategy toward its cloud (Microsoft 365 and Azure) is worrying users, including many groupware administrators who are currently looking for other options. Not so long ago, Australian vendor Atlassian took a similar approach, attempting to force their customers – users of Confluence, Trello, and Jira – into the vendor-owned cloud. Like Atlassian customers, now more and more Exchange administrators are checking the market, and vendors of open source alternatives are reporting growing numbers of customers.

However, what's equally stirring up the groupware market is security and data protection. Over the past few years, several severe issues popped up in or around Microsoft Exchange or its Azure Cloud. After Chinese hackers stole a master key to Microsoft's Azure cloud, the US government did not spare harsh words, calling out Microsoft for "shoddy security, insincerity" and "cascades of security failures" [2].

MAPI: The Curse of Exchange Protocols

Under the pressure of new European Union regulations such as the General Data Protection Regulation (GDPR) or the Cyber Resilience Act (CRA), it's no wonder customers are browsing alternatives. As long as you're only dealing with Linux and open source clients, you will be perfectly happy to use standard open protocols – from IMAP to POP (mail) and from CalDAV (calendars) to CardDAV (contacts). Your client of choice will be Mozilla Thunderbird or KDE's Kontact, whose protocols will work fine with mobile devices, too.

However, if your users need or want Windows clients with Microsoft Outlook or a bit more sophisticated support for smartphones, then the situation is different. Outlook and Exchange communicate over a large set of APIs and protocols usually known as the Exchange protocol stack, and in most companies, Outlook is deeply integrated into a number of special applications needed for daily work. Only a few other groupware products can achieve similar features, open source or otherwise.

Vendors usually try to tackle that issue with Outlook plugins, changes to the Windows registry file, or both, but adminstrators tend to dislike any changes to the client's configuration, and both plugins and registry changes have caused problems in the past.

grommunio: Native Support for Outlook

Grommunio [3] is a startup from Austria that promises a "drop-in replacement" for Microsoft Exchange. No Outlook plugin, no registry entry, no changes to clients, and no need to sit at and click on a client's desktop during migration – so the Vienna company claims. The goal is for every Windows system and almost every smartphone (including Apple clients) to connect seamlessly through standard tools available on every modern system and talk exactly the way they would to Exchange servers. Grommunio's customers confirm that grommunio performs as advertised; Deutsche Telekom is even selling grommunio as part of its Open Source Collaboration Open Telekom Cloud [4].

A Full Stack Re-Engineered

The grommunio developers chose a completely different approach: Instead of plugins and workarounds, they have been (re-)implementing more than 50 protocols and APIs of the Exchange stack in open source and have published all of their work on GitHub. Thus, a grommunio server speaks exactly the Exchange language its Outlook clients expect – natively, but in open source. (See the "From the FSFE and EU" box.)

Because grommunio behaves as an Exchange server would, you simply have no need for a risky plugin or quirky registry entries. Not only is grommunio open source, it also builds on a huge set of trustworthy, renowned, and proven equally stable and secure open source software in the back end.

In tedious work spanning more than four years, reading thousands of pages of specifications from Microsoft and testing and occasionally correcting and amending them (Microsoft was always helpful and cooperative), the grommunio developers managed to create an open source server application (gromox) within grommunio that speaks Exchange protocols natively, with a wide range of clients.

Accomplishing that feat took not only a lot of time but also patience, as grommunio's lead developer Jan Engelhardt demonstrated in his presentation at FOSDEM'24 in Brussels (Figure 1), where he went into many, sometimes funny, details of his work [6].

Many Windows and Exchange administrators know the Messaging Application Programming Interface (MAPI), but that term is "somewhat ambiguous," explains Engelhardt. "It is used for concepts as well as for the data mode, programming interfaces, and network protocols on the wire." The grommunio website continues:

Thanks to Microsoft, all documentation is freely available, the specifications amount to "132+ documents on 8400+ pages, in addition to the Internet mail protocols (i.e. RFC 5322, 5545, etc.) that must be supported anyway."

Engelhardt and his team at grommunio dived deep into these documents and also helped to fix some problems. This is how grommunio became a contributor to the open stack of specifications used by Microsoft and all its customers. [7]

MAPI and Exchange isn't the only language grommunio speaks (Figure 2). Autodiscovery is used for client configuration (just enter your email address and DNS and the server will do the rest for you); Exchange Active Sync (AES) syncs and controls your mobile phones; and Exchange Web Services (EWS) in the world's first open source implementation that connects not only Apple clients but also Linux programs such as Evolution, Thunderbird, and KDE Kontact with the grommunio server [8]. Also, grommunio Meet (a Jitsi implementation), grommunio Chat (Mattermost), grommunio Files (Nextcloud), Archive, Antispam, and directory management (LDAP, Samba) are all integrated and based on standard tools like Postfix and NGINX.

Demo, Docker, and Installation

A grommunio demo on its website, Linux packages for many distributions, and ISO images for download and installation can help you get started. Docker images are available, as well, and all sources can be found on GitHub. SUSE already has RPMs in their repositories (zypper se gromox). The ISO images from the company's website are based on openSUSE Leap and can be installed in any virtualization.

Figure 3 shows a fresh grommunio installation on a KVM Libvirt system in virt-manager, with the help of the grommunio console user interface. The tool that guides you through the installation is also available after a login; on console 1, press F2 to see the menu-based configuration utility.

If you're running the grommunio example from the ISO files, you will have the full power of SUSE Linux underneath, including network setup with YaST or the like. No matter which distribution you are using, the grommunio configuration files will always reside in /etc/gromox (Figure 4).

Administration

Administering grommunio can be done through Files, the console user interface (CUI), the API, or the web interface (Figure 5). The Admin API for PowerShell (AAPIPS) gives you a grommunio PowerShell interface. Keycloak supplies single sign-on in Active Directory environments, as well (with Simple and Protected Generic Security Service Application Program Interface (GSSAPI) Negotiation (SPNEGO) support). Grommunio Web features OpenID Connect, including support for two-factor authentication (2FA) and Web Content Accessibility Guideline (WCAG) 2.1 compliance.

Grommunio is also the world's first groupware with a multitenant-enabled LDAP server. Administrators of extensive hosted environments, especially, will appreciate that they can configure complex setups with a few mouse clicks: All configuration for the multitenancy needed in large-scale setups can be done in grommunio's admin user interface.

By specifying a separate LDAP back end for their organizations, administrators can establish independent yet seamless integration with individual user's back ends, a configuration especially needed in hosted environments. This immediate, organization-level integration allows hosters and customers to maintain enterprise policies without the otherwise common sync or replica issues and removes many inconvenient steps in authentication and user management.

Clients and Features

For many users, Outlook on their smartphone will be the number one client platform on which they interact with grommunio, and they won't notice any differences. A user also can use both the web application (Figure 6) and the grommunio desktop application (Figure 7) created with the help of the Electron framework.

The cross-platform Electron makes the desktop app look exactly the same on any platform, creating a consistent user experience and a safe environment independent of a browser. The only difference is that the desktop app runs as a standalone application and has its own menubar where you can select the grommunio server to which you want to connect – making the desktop app a multiaccount client. The client is available for Windows and Apple clients, and packages exist for a variety of Linux systems (Debian, RPM, AppImage, and tar.gz).

grommunio Next Brings Microsoft Graph

The grommunio developers still aren't done. Their roadmap is ambitious, with plans for the implementation of artificial intelligence (AI) and Microsoft Graph, for which the team is already delivering tech previews.

Grommunio Next [9] is the first open source Graph API web application to provide all the familiar productivity features you need (Figure 8). It is the future main web application for access to your mail, calendar, contacts, tasks, notes, and more.

For those of you who haven't heard of Microsoft Graph yet, it's a unified API platform [10] that connects various Microsoft 365 services, providing a seamless way to access and manage data across tools such as Outlook, Teams, SharePoint, Office (Microsoft 365), OneDrive, and more. With Microsoft Graph, developers can build applications that interact with user data and organizational resources, such as email, files, calendars, and user profiles.

The Graph API offers a single endpoint which streamlines access to information from the entire Microsoft 365 ecosystem, removing the need to work with multiple separate APIs.

Graph is kind of a meta-API that allows you to address single fields in an Excel document for read and write with a simple API command. Naturally, such a behemoth of an API is very complex and takes a great deal of time to design and develop. The importance of this task, says Microsoft, lies in Graph's ability to integrate a wide range of data and services, offering organizations a holistic view of their operations.

Real-Time Data

By allowing access to data in real time, Microsoft Graph enables applications to automate workflows, enhance collaboration, and improve productivity. For example, an application can pull calendar information to schedule meetings, manage cloud storage by interacting with OneDrive, or monitor organizational insights. It supports enterprise needs for security and compliance, because developers can access data while maintaining the same governance and control policies applied within Microsoft 365 and can help enable AI and automation.

Many analysts see Graph as the future back end for all Microsoft applications, so it's no surprise that many companies are working to integrate it into their products. Grommunio is the first groupware vendor to do so. A tech preview of grommunio Next [11] is already available for testing, and it shows a webmail and groupware client for the browser that is connected to the grommunio server by Microsoft Graph. Again, grommunio's implementation of Graph is the first open source implementation for groupware.

AI and More

Another big topic the grommunio developers are addressing is AI, but on a reasonable scale. The integrated AI tools rather focus on helping the user than on creating hallucinated content. Grommunio Antispam 3.9.0 (released in July 2024) includes GPT-based spam detection, and upcoming are AI-based assistants for email summary generation (available 2024Q4) and for functions such as autotasking in grommunio Web (2025Q1).

Summary

Grommunio offers a fresh new start for open source groupware, and it serves as a real alternative for Microsoft Exchange. With its variety of certifications and compliance with a long list of regulations, customers with strong security and data protection needs will especially benefit from the switch. The version released in August brought certification from the German Federal Office for Information Security (Bundesamt für Sicherheit in der Informationstechnologie (BSI), which is somewhat similar to the US National Institute of Standards and Technology (NIST)).

Accessibility, according to WCAG 2.1 has been on board for some time, and there's more in the pipeline. According to the website, grommunio scales: The vendor claims to be faster than Exchange and more efficient than any other open source groupware. Seems like it's time for a test run.