diff --git a/build.sh b/build.sh
index 1a6050149a22cb53434842f249f0e1a7afb800af..c7ef27f70ac1ce8715666bfa0b0a6a8d652c371e 100755
--- a/build.sh
+++ b/build.sh
@@ -41,6 +41,7 @@ APACHE_MODULES_ENABLE="
         rewrite
         setenvif
 	sso
+	unique_id
 "
 
 # Apache modules that are enabled by default by the Debian package,
@@ -105,6 +106,9 @@ for d in temp logs ; do
     chmod 700 /var/www/webmail/$d
 done
 
+# Create config mountpoint
+mkdir -p /etc/roundcube
+
 # Install Chaperone (minimalistic init service).
 pip3 install chaperone
 rm -fr /root/.cache/pip
diff --git a/conf/apache2/mods-available/sso.conf b/conf/apache2/mods-available/sso.conf
new file mode 100644
index 0000000000000000000000000000000000000000..cbbbaf87dbdc941f4d09107549f90d01c0c6d0e2
--- /dev/null
+++ b/conf/apache2/mods-available/sso.conf
@@ -0,0 +1,3 @@
+SSOPublicKeyFile /etc/sso/public.key
+SSOLoginServer login.${DOMAIN}
+SSODomain ${DOMAIN}
diff --git a/conf/apache2/sites-available/webmail.conf b/conf/apache2/sites-available/webmail.conf
index 8267cb4b2a643c7a8b1d1900502a687dd8bc19b5..f839ca53b97ac1e2443f6c287c6853a9cba5c81c 100644
--- a/conf/apache2/sites-available/webmail.conf
+++ b/conf/apache2/sites-available/webmail.conf
@@ -17,5 +17,11 @@
                 Require all granted
         </Directory>
 
+        <Location />
+                AuthType SSO
+                SSOService ${SHARD_ID}.webmail.${DOMAIN}/
+                require group users
+        </Location>
+
 </VirtualHost>
 
diff --git a/start.sh b/start.sh
index 2d694b5fe2bf4b6f759301eaa4d4f7c1eee8ddba..ac9db80470ea1e9c373cf6e8c1b82c3f6e1283a4 100644
--- a/start.sh
+++ b/start.sh
@@ -10,16 +10,11 @@
 CONFIG_DIR=/etc/roundcube
 TARGET_DIR=/var/www/webmail
 
-# Main configuration files.
-MAIN_CONFIG_FILES="config.inc.php db.inc.php"
-
 # Name of the MySQL database to use.
 MYSQL_DB="ai_roundcube"
 
 install_config() {
-    for f in ${MAIN_CONFIG_FILES} ; do
-        install -o root -g root -m 644 ${CONFIG_DIR}/${f} ${TARGET_DIR}/config/$f
-    done
+    install -o root -g root -m 644 ${CONFIG_DIR}/config.inc.php ${TARGET_DIR}/config/config.inc.php
 
     # For each known plugin, look for a NAME.config.inc.php file in
     # the config directory: if found, copy it to the plugin directory