⭐ Why this plugin is unlike anything else available
A real email inbox — not Moodle messaging — inside the student dashboard
▸ Moodle's internal messaging system is separate from students' real email and is rarely checked. Student Email connects to the student's actual external email account via IMAP and displays their real inbox inside Moodle. Course communications, assessment notifications, and personal email appear in one place without leaving the LMS.
▸ No email data is stored by Moodle or LMS Labs. The plugin reads from the student's mail server in real time and displays it — no copy is kept in the Moodle database.
▸ Teachers can send course announcements that appear in both Moodle and the student's real inbox simultaneously. The announcement is sent once; it arrives in both places.
The problem with student emails
Personal email addresses create fragile, uncontrollable links between your students and your Moodle LMS. Here's what goes wrong — and why it keeps happening.
Student changes their personal email
A student updates their Gmail or Hotmail in Moodle profile settings. Now their Moodle account is tied to an address they may abandon, leaving no reliable institutional contact.
SSO login breaks after email change
If your Moodle uses Google or Microsoft SSO, the OAuth token is bound to the old email. When a student changes their personal address, SSO matching fails — they get 'account not found' or are silently provisioned a second orphaned account.
Orphaned duplicate Moodle accounts
After an email change, Google/Microsoft SSO creates a brand-new Moodle user. The student's enrolment history, grades, and certificates are trapped in the old account. Support tickets pile up.
Students forget which email they used
Students commonly have three or four email addresses — personal Gmail, an old address, a work address, and maybe a previous college address. They forget which one they registered with and can't log in.
No institutional email control
Without a provisioned college email, the RTO has no control over the communication channel. Emails go to student inboxes you don't manage — spam-filtered, bounced, or silently deleted.
Password resets go nowhere
When the 'forgot password' email goes to a personal address the student no longer checks, they're completely locked out. Trainer time is wasted resetting accounts manually.
Why SSO makes email changes especially dangerous
OAuth-based SSO (Google Workspace, Microsoft 365) matches the incoming identity token to a Moodle user by email address. When that address changes, the match breaks.
Student logs in via Google SSO
Moodle finds a user with email john.doe@gmail.com — login succeeds.
Student changes their Gmail address
They update their primary Google account email to john.d.smith@gmail.com or switch to an Outlook account entirely.
Next SSO login attempt
Google sends a token for john.d.smith@gmail.com. Moodle finds NO match — either rejects login or silently provisions a new, empty Moodle user with no enrolments, no grades, no history.
Support call
Student says 'I can log in but all my courses are gone'. Staff discover two Moodle accounts. Manual merge is time-consuming and error-prone. Multiply by 20 students per semester.
The Student Email Suite sidesteps this entirely. Students log in with a college email address you control — it never changes unless you change it, and SSO is never in the loop for that auth path.
The solution: institutional email ownership
Two plugins that work together. The Manager provisions and maintains cPanel mailboxes; the Auth plugin lets students log into Moodle using those mailbox credentials via IMAP.
local_studentemail · v1.5.34 · $5 USD
auth_studentemail · v1.3.7 · $5 USD
How login works — the resolution order
Student enters credentials
Username can be their college email (stu0001@students.college.edu.au) or their bare Moodle username
Plugin looks up provisioned email
Checks local_studentemail_accounts table for a matching email address
Found + active?
Verify password via IMAP against cPanel mail server in real-time. If correct → login granted
Found but suspended/archived?
Auth plugin returns 'invalid credentials' — student is blocked even if they have the right password
Not found
Plugin silently falls through to the next auth plugin in Moodle's chain (manual accounts, SSO, etc.) — staff log in normally
Student Email Manager — features
Everything you need to provision and maintain an institutional email address for every student, automatically.
Auto-provision on enrolment
The moment a student is enrolled in any course, a cPanel mailbox is created for them automatically. No manual steps, no delay.
Lifecycle management
Accounts auto-suspend on user suspension, auto-archive on deletion, and auto-restore on reactivation. The mailbox lifecycle mirrors the Moodle user lifecycle exactly.
Student 'My Email' portal
Students see their college email address and masked password with reveal/copy buttons in a dedicated navigation item. Direct link to Roundcube webmail included.
AES-256-CBC encrypted passwords
Provisioned mailbox passwords are stored encrypted at rest using a site-derived AES-256-CBC key with random IVs. Identical passwords produce different ciphertext.
Admin dashboard with live stats
Real-time counts of Total, Active, Missing, Suspended, Archived, and Error accounts. Per-student actions and bulk operations (Create Missing, Suspend Leavers, Download CSV).
Four email format options
Choose auto-number with prefix (stu0001), Moodle username, student ID, or firstname.lastname. Sequential numbers use Moodle's lock API to prevent race conditions on concurrent enrolments.
UAPI + XML API v2 fallback
Prefers cPanel's modern UAPI; automatically falls back to the legacy XML API v2 for older cPanel versions. Works with virtually any cPanel hosting environment.
Roundcube webmail link
Students are shown a direct link to your Roundcube webmail. Note: Roundcube CSRF protection blocks auto-POST SSO — credentials are displayed for manual entry, not auto-submitted.
What students see — the My Email portal
Student Email IMAP Auth — features
A production-grade IMAP authentication plugin tightly integrated with Student Email Manager.
Login with college email as username
Students can type their full provisioned email address (stu0001@students.college.edu.au) as their Moodle username. No need to remember a separate Moodle username ever again.
Real-time IMAP verification
Passwords are verified live against the cPanel IMAP server on every login. No password sync required — if they change their mailbox password in cPanel, it works immediately in Moodle.
Active-account-only gate
Suspended or archived students cannot log in even with a correct password. The gate reads directly from local_studentemail's account table — no extra configuration.
Silent staff fallthrough
Staff and admins who have no provisioned email are completely unaffected. The plugin silently passes them through to Moodle's normal auth chain — zero disruption.
Multi-host failover
Accepts a comma-separated list of IMAP hostnames tried in order. If the primary IMAP server is temporarily down, the plugin automatically tries the next host.
Configurable SSL/TLS + novalidate-cert
Choose SSL, TLS, or plain. Enable 'novalidate-cert' for cPanel servers using self-signed certificates. Modern Let's Encrypt cPanel servers should leave this off.
Login resolution order
1) Check provisioned email → IMAP verify with college email. 2) Block if suspended/archived. 3) Fall through with bare Moodle username for staff. No ambiguity.
Replaces auth_imap + custom auth
A single plugin replaces the need for a separate moodlehq/moodle-auth_imap installation plus any custom provisioned-account auth glue. Clean, supported, tested.
Frequently asked questions
QDoes this replace Google or Microsoft SSO?
No — it works alongside it. Students with a provisioned college email use IMAP auth (college email + mailbox password). Staff and admins who use Google/Microsoft SSO are unaffected because the plugin silently falls through to the next auth method for users without a provisioned email.
QWhat happens if a student changes their personal email in their Moodle profile?
Nothing breaks. The provisioned college email is separate from the Moodle profile email field. Students log in with their college email credentials; their profile email is only used for non-login notifications. You can lock the profile email field site-wide if you want to prevent confusion.
QCan students still log in if their personal email changes or SSO breaks?
Yes — that's the whole point. Because authentication is now via IMAP against the college mailbox (not OAuth against a personal email provider), email changes on Gmail or Microsoft have zero effect on Moodle login.
QHow does a student find out their college email address and password?
If welcome emails are enabled in the plugin settings, an automatic email is sent to the student's personal email address (the one entered in their Moodle profile) the moment their college account is created. It contains their college email address, password, and a link to log in. After that first email, the personal address is not used again. Admins can resend this at any time using the 'Resend Creds' button in the Student Email Manager dashboard.
QWhat if a student forgets their college email password?
An admin can click 'Reset PW' in the Student Email Manager dashboard to generate a new password and display it on screen. Use 'Resend Creds' to automatically email the updated credentials to the student's personal email. The student can also use the 'Forgot password' flow on the Moodle login page if that is enabled.
QDoes logging into Moodle automatically log students into webmail as well?
No — Moodle and Roundcube webmail are separate applications with separate sessions. There is no automatic single sign-on between them. What does work: the student clicks 'My Email' in Moodle, hits the Copy button next to their password (no need to even reveal it), opens Roundcube in the new tab, and pastes it in. The whole thing takes about 10 seconds. The password is the same for both systems, so there is nothing to remember — just copy and paste.
QWhy can't the plugin automatically log students into Roundcube?
Roundcube 1.4 and later enforce CSRF token validation on their login endpoint. Any form submitted from outside Roundcube without a valid server-generated token is rejected with 'Request time expired' — this is correct security behaviour. Roundcube is also not an OAuth2 or SAML provider, so federated login is not available without installing a separate Roundcube plugin that modifies its server-side code.
QWhat happens to the cPanel mailbox when a student leaves?
When the Moodle user is suspended, the cPanel mailbox is automatically suspended (they can't receive or send but the data is preserved). When the user is deleted from Moodle, the mailbox is archived. If the user is reinstated, the mailbox and its password are automatically restored.
QDo we need the PHP imap extension?
Yes — auth_studentemail uses PHP's imap_open() to verify credentials live against the IMAP server. Most shared hosting environments have this extension. Check with your host or run phpinfo() to confirm imap is loaded.
QCan we use this with only Student Email Manager and not the auth plugin?
Yes. Student Email Manager is standalone — it provisions and manages mailboxes and gives students the 'My Email' portal. The IMAP auth plugin is optional but recommended if you want students to log in with their college email credentials.
QWhat if two students enrol at exactly the same moment?
Student Email Manager uses Moodle's built-in lock API when assigning sequential email numbers. Two simultaneous enrolments will queue safely — one gets number N, the other gets N+1 with no collision.
QCan I assign a specific email address to a student instead of letting the plugin generate one?
Yes. Create the mailbox in cPanel first with the exact address you want (e.g. jane.smith@students.college.edu.au), then go to the Student Email Manager dashboard in Moodle, find the student, and click 'Link Existing'. Enter the email address and save. From that point everything works identically to an auto-provisioned account — IMAP login, the My Email portal, lifecycle management, all of it.
QCan staff and admins also get provisioned email accounts?
Only Moodle users who are enrolled as students in at least one course trigger provisioning. Admin and manager roles are not provisioned automatically. If you want staff email via cPanel, that's done manually in cPanel — the auth plugin's staff fallthrough will still work.