How Collabora Online and Mattermost integration works
A self-hosted Mattermost team that wants to open office attachments without downloading them needs an editor that runs in the browser and works with files where Mattermost already keeps them. The supported route is the WOPI protocol, carried by the open source Mattermost plugin for Collabora Online. In this design Mattermost acts as the WOPI host, holding the file and enforcing access checks, while Collabora Online acts as the WOPI client that renders and edits it. No custom connector is assumed, so the work is configuration of a supported plugin, not code your team has to maintain. You install the plugin from the System Console, point it at your Collabora server, and choose which file types open in the editor.
Three parties exchange traffic when a user opens an attachment. The user's browser loads the editor from the Collabora server and also talks to Mattermost to start the session. The Collabora server then calls back to Mattermost over WOPI to fetch the file and, when someone saves, to send the changes back. The Collabora server must therefore reach the Mattermost URL on the network path it uses, and the browser must reach the Collabora server. These two reachability paths are the first things to test. A Mattermost site that works in a browser behind a reverse proxy or on a private address can still fail for the editor if the Collabora server cannot make the same callback.
Before you enable the plugin, settle three decisions. First, confirm that the Mattermost site URL and the Collabora server URL use the same protocol and that both sides trust each other's certificates. Second, decide who should be able to open and edit files, and confirm that Mattermost channel and file permissions still govern access, so the editor opens only what the user could already see. Third, check which file formats and plugin version match your Mattermost server version, because Mattermost ships a new server version each month and the plugin must be re-checked at every upgrade. Confirm supported formats with the Collabora Online product page and the plugin's own documentation.
What you need before you connect Mattermost to Collabora
The integration depends on three running pieces: a Mattermost server, a Collabora Online server that the Mattermost plugin can reach, and a System Console administrator who can install and configure the plugin. Each card below is a decision or check to settle before you open the plugin settings, because most failed connections trace back to one of them.
Mattermost version and deployment type
Record the exact Mattermost server version and whether it runs as a single binary with PostgreSQL or as a high availability cluster. Mattermost publishes server binaries on the 16th of each month, and support windows differ between releases, so confirm the version is still supported before you add anything to it. Check that the plugin lists your version as compatible in its repository before installing.
Supported Collabora Online branch
Use a Collabora Online server on a release branch that Collabora still maintains, and confirm the point release includes current security fixes. The 25.04 branch was still receiving point releases in 2026, and 26.04 was announced on July 23, 2026. Ask whether your server is the free CODE edition, which Collabora does not recommend for production, or a supported subscription.
Reachable Collabora server path
The Mattermost server must reach the Collabora Online server over the network, and browsers must reach it too, since documents open in the user's browser. Confirm that firewalls, reverse proxies and any IP restrictions allow traffic in both directions on the ports you chose. Keep the Collabora server close to the Mattermost server network path so that document loads are not slowed by an unnecessary hop.
HTTPS with trusted certificates
Serve both Mattermost and Collabora Online over HTTPS with certificates that users' browsers trust, including the internal certificate authority if you run one. Browsers block mixed content and refuse untrusted endpoints, so an HTTP Collabora URL or a self-signed certificate will stop documents from opening even when the plugin is configured correctly. Check the chain on each host before you start the configuration.
Stable DNS names for both servers
Assign each service its own fully qualified domain name and make sure the names resolve from the Mattermost server, from the Collabora server and from user workstations. Avoid changing the names later, because the Collabora server URL is stored in the plugin settings and a renamed host forces a reconfiguration. Record which name is internal only and which is published to users.
System Console administrator account
Name the person who will install the plugin and enter the Collabora server URL, and confirm they hold a System Console administrator role. Plugin installation and configuration happen in that console, so a regular member account cannot complete the setup. Agree on who approves later changes to the Collabora URL, file type list or certificate, since those changes affect every user who opens documents.
Configuring the plugin step by step
This sequence connects Mattermost to a Collabora Online server you run, enables the file types you choose, and confirms that a test attachment opens and saves in the browser editor. Each step ends with a check, so you know the integration works before users depend on it.
Confirm the Collabora server answers over HTTPS
Before touching Mattermost, confirm that the Collabora Online server is reachable at its public HTTPS address with a valid certificate. Your Collabora administrator should provide the discovery address and the certificate chain. Open the address from a browser on a network outside the server's own hosts, and confirm that the page loads without certificate warnings. Done means the server answers over HTTPS from the same network path your Mattermost users will use.
Verify network access from the Mattermost server
The Mattermost server itself must reach the Collabora server, because the WOPI requests that open and save documents originate from the Mattermost side. Check firewall rules, proxy settings and any allow list that restricts WOPI traffic, and add the Mattermost server's outbound address where needed. Confirm with your network team which addresses are used for outbound traffic, since NAT can change what Collabora sees. Done means a connection test from the Mattermost host to the Collabora address succeeds.
Install the plugin from the System Console
As a Mattermost system administrator, open the System Console and go to the plugin management area. Install the open source Collabora Online plugin from the marketplace if your server can reach it, or upload the plugin bundle if your environment is air-gapped or restricted. Confirm the plugin version is compatible with your Mattermost server version by checking the plugin's documentation, since server releases move on a monthly cycle. Done means the plugin appears in the installed list and its status shows as enabled.
Enter the Collabora server URL and WOPI settings
Open the plugin's settings page in the System Console and enter the Collabora server URL exactly as your administrator provided it, using HTTPS. Enter any WOPI-related options the plugin exposes, such as the discovery location or host restrictions, and confirm the plugin's own documentation for each field, since field names vary between plugin releases. Save the settings and check the server log for configuration warnings. Done means the plugin saves the settings without validation errors and reports the Collabora server as reachable.
Choose which file types open in the editor
Decide which attachment types should open in Collabora Online. Collabora's product page lists OpenDocument formats, Microsoft formats including docx, xlsx and pptx, plus PDF, RTF, CSV and Visio, but the plugin may support only a subset, so confirm the list with the plugin documentation. Start with the formats your teams use most, and leave others to download. Save the selection and record it in your rollout notes. Done means the enabled file types are listed in the settings and match what you intend to offer.
Test with a sample attachment in a test channel
Create a private test channel with two test accounts and upload a sample .docx file that contains a heading, a table and an image. Open the attachment from the channel and confirm that the editor loads in the browser without errors or blank panes. Make an edit, save it, and reopen the file to check that the change persists. Repeat with an .xlsx and a .pptx file. Done means all three files open, save and reload correctly, and the browser console shows no blocking errors.
Test editing across two accounts
With the two test accounts, open the same sample document at the same time and check how the editor behaves when both users are present. Confirm whether the plugin and your Collabora version support co-editing, and note any difference in how changes appear. Also confirm that a user without access to the channel cannot open the file by its link. Record the results and any issues. Done means you have a written result for concurrent access and permissions, and you have resolved or documented each issue.
Roll out to users and monitor
Enable the plugin for the wider user group, or announce the change to teams that will use it first, and tell users which file types open in the browser. Watch the Collabora server's logs and resource use during the first working days, and check for failed opens in the Mattermost server logs. Ask your Collabora provider how to size the server for your expected concurrent editing, because load depends on your usage. Done means users can open and save attachments, and you have a recorded baseline of normal load.
Which attachment types open in Collabora Online
Limit the plugin to the file types your team actually exchanges, and confirm before rollout which of those types the Mattermost plugin maps to an editor. Collabora Online handles OpenDocument formats and Microsoft formats including docx, xlsx and pptx, plus PDF, RTF, CSV and Visio files, according to the Collabora Online product page. That list describes what the Collabora server can process in general. It does not tell you which attachment extensions the Mattermost plugin will send to Collabora, so check the plugin's own documentation and its configuration for the supported extensions. Treat any format you have not seen in that documentation as unconfirmed.
Viewing and editing are different permissions with different risks. A format may open read-only in the browser while still failing or losing formatting once someone edits it, and some types may only be previewed. For each format your teams rely on, such as Word, Excel and PowerPoint files from Microsoft Office, run a test with a representative file from your own archive. Open it as a viewer and as an editor, make a change, save, download the result and compare it with the original in the desktop application your staff use. Record which formats pass, which need a workaround, and which should stay with a desktop application.
Keep the test list in writing and tie it to the plugin configuration you approve. When a new format is needed later, repeat the same viewing and editing checks before enabling it for a channel or team. Ask the plugin maintainer and your Collabora server operator who owns this list, since a format accepted by the server may still be excluded or handled differently by the plugin, and fidelity can change between Collabora Online releases.
How Mattermost users, files and permissions map to the editor
This table traces how a Mattermost user, channel and file attachment become the WOPI requests that Collabora Online answers. Read each row as a handoff between Mattermost, the plugin and the editor. The main takeaway is that Collabora relies on the WOPI host to authorize each session, so every access check must be confirmed in the plugin and in Mattermost before rollout.
| Element | How it maps | What to confirm in your environment |
|---|---|---|
| User identity | The Mattermost account that opens a file passes its identity through the WOPI host, which issues an access token for that session. | Confirm which identifier the plugin sends (user ID or email) and how SSO or AD/LDAP accounts are matched. |
| Channel membership | Access to an attachment normally follows the channel that holds the post, so a removed member should lose new opens. | Confirm whether the plugin rechecks membership on each WOPI request or only when an editing session starts. |
| Edit rights | Viewing and editing are separate WOPI permissions that the host grants for each session. | Confirm whether edit rights follow channel roles or are granted separately, and who can change that setting. |
| Attachment to WOPI file ID | Each attachment is exposed to the editor under an identifier in the WOPI file path, which the plugin resolves to the stored file. | Confirm the ID scheme and whether the ID stays the same after an edit or a repost of the file. |
| Save path | Edits return to Mattermost through the WOPI save call and are written to the file store the server uses. | Confirm whether saves create a new version or overwrite the attachment, and test with a second channel member. |
| Collabora server URL | The plugin points users to the Collabora discovery URL, and the WOPISrc parameter identifies the document on each request. | Confirm the URL uses HTTPS, matches the Mattermost site address and is reachable from browsers and the Mattermost server. |
| Routing across Collabora servers | With several Collabora pods, the load balancer must send every request for one WOPISrc to the same pod. | Confirm your load balancer can route on WOPISrc before you set replica counts. |
| Supported file types | Collabora handles Office, OpenDocument, PDF and CSV files, but the plugin decides which extensions open in the editor. | Confirm the plugin's extension list against your attachment types and test fidelity on your own files. |
Security settings for Mattermost and Collabora traffic
The Mattermost plugin sends file traffic between two servers you run, so the controls that matter sit at the boundary between them. Each card below covers one setting or check that protects documents as they move between Mattermost, the Collabora server and the browser. Work through them in order before users are invited to edit.
Restrict WOPI requests to Collabora addresses
Only the Collabora server should be able to call the WOPI endpoints on your file host, so requests from anywhere else should be rejected. Collect the outbound addresses of your Collabora servers, including any NAT or load balancer in front of them, and allow-list only those. Confirm the exact allow-list setting in the Mattermost plugin and Collabora documentation for your versions, and test that a request from an unlisted address fails.
Use HTTPS for both URLs
Mattermost and the Collabora server should both be reached over HTTPS, and the Collabora URL should use the same protocol as the Mattermost site. Mixed HTTP and HTTPS paths let tokens and document content cross the network unprotected, and browsers may block mixed content. Check the certificate chain for the Collabora hostname that Mattermost uses, and confirm that the Mattermost site URL in the System Console matches the hostname users see.
Limit who can edit, not just view
Viewing and editing should be separate permissions. Decide which Mattermost teams, channels or user groups may open attachments in the editor, and which may edit them, and keep read-only access as the default for everyone else. Check what the plugin exposes to each group, and test with a user from a restricted channel before enabling editing more widely.
Keep Collabora packages patched
Collabora publishes security advisories for Collabora Online, and the server package must be updated when a fix ships. Subscribe to the release notes for the branch you run, record the installed version on each Collabora host, and set a schedule for applying point releases. Also confirm that package signing keys are current for your RPM or DEB repository so updates install from a trusted source.
Review data leaving the network for AI
A newer Collabora release adds an optional AI assistant across Writer, Calc and Impress that is off by default. If you turn it on, document content may be sent to the AI provider you configure, which can be an external service or one you host. Before enabling it, confirm which provider is selected, whether it is hosted inside your infrastructure, and what content and metadata it receives. Keep it disabled on any server handling documents that cannot leave your network.
Common failures when Mattermost cannot open files in Collabora
This table lists the failures operators most often hit when Mattermost cannot open attachments in Collabora Online, with the likely cause, the fix and the check to run first. Work down the rows in order, since a wrong Collabora URL or mixed protocol often produces symptoms that look like a certificate or allow list problem. Confirm each setting against your own Mattermost and Collabora configuration, because exact System Console labels and behavior depend on the plugin version you run.
| Symptom | Likely cause | Fix and checks to run |
|---|---|---|
| Editor frame never loads and the file opens as a blank page | The Collabora server URL in the plugin settings is wrong, or the path to the discovery endpoint does not resolve from the Mattermost server | Confirm the Collabora base URL in the plugin configuration, then open the Collabora discovery endpoint from the Mattermost host itself. Check DNS resolution and any proxy rules that rewrite the path. |
| Editor loads on some pages but fails in others, or the browser reports mixed content | Mattermost is served over HTTPS but the Collabora URL uses HTTP, or the reverse, so browsers block the frame | Use the same protocol for the Collabora server URL as for Mattermost, preferably HTTPS. Check the browser console for blocked mixed content warnings and correct the URL scheme. |
| Opening a file returns an error from the Collabora side and no document appears | The WOPI host is not on the Collabora allow list, so Collabora refuses requests from the Mattermost address | Find the address Collabora sees for Mattermost, including any NAT or reverse proxy hop, and add it to the WOPI allow list. Check the Collabora logs for the rejected host and retest with one file. |
| Browser shows a certificate warning or the editor fails only on certain hosts | The certificate on the Collabora server or the Mattermost server is not trusted by the client or by the server making the callback | Verify the full certificate chain on both servers with a TLS client from the Mattermost host. Install the internal certificate authority in the trust store used by Mattermost, then restart the service and retest. |
| A given file type shows a download prompt or cannot be opened for editing | That format is not enabled in the Collabora configuration or the plugin does not map its extension to an editor | Compare the file extension against the formats Collabora supports and the types enabled in your plugin settings. Test each format you plan to allow with a sample file before rollout. |
| Editor opens but the toolbar or file actions behave differently after a Mattermost upgrade | The plugin version does not match the Mattermost server version, so the plugin API calls fail | Check the installed plugin version against the Mattermost server version in the System Console, and update the plugin to a release built for your server. Review the plugin changelog before upgrading the server. |
| Some users see the editor and others do not after a change | A permission or channel-level setting differs between users, or a cached plugin configuration is still active | Test with two accounts in the same channel, compare their roles, and restart the plugin or server after saving settings. Confirm that the Collabora server still accepts requests from the Mattermost address. |
Questions teams ask before connecting Mattermost to Collabora
How much does it cost to connect Mattermost to Collabora Online?
The cost comes from four parts: the Collabora edition and support level, the Mattermost plan and deployment, testing across file types, and network and certificate work. Collabora's pricing page lists a Business plan at 3 euros per user per month for up to 99 users, including long term support, a service level agreement, signed security updates and customer portal access. Enterprise, for 100 or more users, is quoted with volume discounts. Mattermost does not publish prices. Its Professional, Enterprise and Enterprise Advanced plans are prepaid annual subscriptions based on seat licenses, and buyers contact sales for a quote. The free CODE edition is not recommended for production. Ask each vendor for a written quote that states the seat count, term and included support.
How long does a Mattermost and Collabora integration take?
The timeline depends on whether Collabora and Mattermost are already running, how many file types must be tested, and how quickly network and certificate changes are approved. No fixed duration applies to every environment, so ask for a schedule in the written scope. Installing the plugin from the System Console is usually a small admin task once the Collabora server is reachable. Testing and rollout take longer. Plan around release cadence too: Mattermost releases server binaries on the 16th of each month, and v11.7 is an Extended Support Release supported until 2027-05-15. Collabora publishes point releases on each branch, so pin a version and schedule updates in advance.
Can our own team connect Mattermost to Collabora without a partner?
A team with Mattermost administration skills, Linux experience and reverse proxy knowledge can install and configure the plugin itself. The harder work is verification: opening real documents from your own channels, confirming TLS, and checking that each server can reach the other. You will need someone who administers Mattermost, someone who manages DNS and certificates, someone who controls firewall rules, and a tester who knows which documents matter. DeployOpen plans, implements, integrates, hardens and documents self-hosted platforms inside your infrastructure. Most engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts. Ongoing support, upgrades and testing are available as retainers.
Which file types can Mattermost users open in Collabora Online?
Collabora Online supports OpenDocument formats and Microsoft formats including docx, xlsx and pptx, plus PDF, RTF, CSV and Visio files, according to Collabora's product page. Support in the Collabora server does not confirm that the Mattermost plugin opens every one of these types, so check the plugin's documentation for its supported list. Then test representative files from your own channels:
- Word documents with tables, comments, tracked changes and embedded images
- Spreadsheets with formulas, charts and large ranges
- Presentations with custom fonts, animations and speaker notes
- PDF and legacy files that your teams still share
What network and certificate work does the connection need?
The browser must reach the Collabora server, and the Collabora server must reach Mattermost to fetch and save files through WOPI. Both sides need certificates that clients trust. Nextcloud's administration guidance recommends using the same protocol for the Collabora URL as for the host, preferably HTTPS, and restricting WOPI requests to the Collabora server addresses. Apply the same principles here, then confirm which allow-list and proxy settings the Mattermost plugin supports. Also review ports, DNS names, internal routing for servers that reach Mattermost through a load balancer, and how certificates renew. Document each rule so that a later change does not break editing silently.
Is Collabora Online safe to run for Mattermost file editing?
Collabora publishes security advisories for Collabora Online, so the answer depends on how quickly you apply them. The 25.04 release notes record that 25.04.7.5, released January 29, 2026, fixed CVE-2026-23623, and that package signing keys were updated for RPM and DEB users. Subscribe to advisories, test each point release, and set a patch window. Keep the server inside your own infrastructure, limit access to the WOPI path, use TLS, and avoid CODE for production. Ask your security team to review the integration's access model before go-live, including who can open and edit documents in each channel.
Do we need Mattermost Enterprise to run Collabora editing with high availability?
Mattermost high availability, with redundant application servers, database servers and load balancers, is available only on Enterprise and Enterprise Advanced. It also requires shared file storage on Amazon S3, an S3-compatible service or a NAS mounted on each node, because local storage will not work correctly and risks corrupting files. Collabora scaling is a separate question. The official Helm chart disables horizontal pod autoscaling because scaling breaks collaborative editing, and load balancers must route by the WOPISrc parameter so everyone editing one document reaches the same pod. Confirm your availability target with both vendors before choosing plans and topology.
How DeployOpen scopes and delivers this integration
DeployOpen agrees the scope in writing before any work starts. The written scope names the Mattermost server or servers that will open documents, the Collabora Online server that will serve them, the file types to be tested, and the user groups who will view and who will edit. It also lists what your team provides, such as administrator access to the System Console, a test Mattermost instance, DNS records and TLS certificates. Deliverables and the timeline are set out in the same document, so both sides know what done means before the first configuration change.
The build starts with the Collabora server. DeployOpen plans where it runs, how Mattermost reaches it over HTTPS, and how the Collabora server reaches back to Mattermost for WOPI requests. The open source plugin is then installed from the System Console and pointed at the Collabora server URL. Testing covers every agreed file type in viewing and editing modes, with accounts from each permission group. It also checks the edge cases that cause most rework: channel membership changes, archived channels, files posted by guest accounts, and attachments that are opened by users who should only view them.
Each delivery ends with documentation: the configuration as built, the test matrix and results, known limits for each file type, and the steps to disable the integration if it must be rolled back. Mattermost publishes a new server build on the 16th of each month, and Collabora Online releases its own branches, so the plugin and Collabora version should be rechecked after upgrades. DeployOpen offers ongoing support and upgrades under a retainer, priced separately from the project. Ask for the retainer's response expectations and included upgrade testing in writing before you sign.
