Forgot to attach my sogo.conf:

{
    WOPort = 127.0.0.1:20000;
    WOPidFile = /var/run/sogo/sogo.pid;
    WOLogFile = /var/log/sogo/sogo.log;
    WOMaxUploadSize = 51200;
    SOGoMaximumMessageSizeLimit = 51200;
    WOWorkersCount = 5;
    SOGoMaximumPingInterval = 3540;
    SOGoMaximumSyncInterval = 3540;
    SOGoInternalSyncInterval = 60;
    WOWatchDogRequestTimeout = 60;
    SOGoMaximumSyncWindowSize = 100;
    SOGoMaximumSyncResponseSize = 512;
    SxVMemLimit = 500;
    SOGoXSRFValidationEnabled = YES;
    NGImap4DisableIMAP4Pooling = NO;
    SOGoProfileURL = "mysql://...";
    OCSFolderInfoURL = "mysql://...";
    OCSSessionsFolderURL = "mysql://...";
    OCSEMailAlarmsFolderURL = "mysql://...";
    OCSCacheFolderURL = "mysql://...";
    OCSStoreURL = "mysql://...";
    OCSAclURL = "mysql://...";
    SOGoLanguage = English;
    SOGoLoginModule = Mail;
    SOGoForceExternalLoginWithEmail = YES;
    SOGoMailCustomFromEnabled = YES;
    SOGoIMAPServer = "imap://127.0.0.1:143";
    SOGoMailAuxiliaryUserAccountsEnabled = YES;
        SOGoSMTPServer = "smtp://127.0.0.1:587/?tls=YES&tlsVerifyMode=allowInsecureLocalhost";
        SOGoMailingMechanism = smtp;
    SOGoSMTPAuthenticationType = PLAIN;
        SOGoSieveServer = "sieve://127.0.0.1:4190/?tls=YES&tlsVerifyMode=allowInsecureLocalhost";
        SOGoSieveScriptsEnabled = YES;
    SOGoVacationEnabled = YES;
    SOGoForwardEnabled = YES;
    SOGoSieveFolderEncoding = UTF-8;
    SOGoMemcachedHost = 127.0.0.1;
    SOGoTimeZone = "America/New_York";
    SOGoFirstDayOfWeek = 1;
    SOGoRefreshViewCheck = every_5_minutes;
    SOGoMailReplyPlacement = below;
    SOGoExternalAvatarsEnabled = NO;
    SOGoGravatarEnabled = NO;
    SOGoEnableEMailAlarms = YES;
    SOGoAppointmentSendEMailNotifications = YES;
    SOGoFoldersSendEMailNotifications = NO;
    SOGoACLsSendEMailNotifications = YES;
    SOGoNotifyOnExternalModifications = YES;
    SOGoPasswordChangeEnabled = YES;

    SOGoUserSources = (
        {
            type = sql;
            id = users;
            viewURL = "mysql://...";
            canAuthenticate = YES;
            userPasswordAlgorithm = ssha512;
            prependPasswordScheme = YES;
            isAddressBook = YES;
            displayName = "Domain Address Book";
            listRequiresDot = NO;
            SOGoEnableDomainBasedUID = YES;
            DomainFieldName = "domain";
            ModulesConstraints = {
                Mail = { c_webmail = y; };
                Calendar = { c_calendar = y; };
                ActiveSync = { c_activesync = d; };
            };
        },
        {
            displayName = "Mailing Aliases";
            type = sql;
            id = aliases;
            viewURL = "mysql://...";
            canAuthenticate = NO;
            isAddressBook = YES;
            listRequiresDot = NO;
            SOGoEnableDomainBasedUID = YES;
            DomainFieldName = "domain";
        },
        {
            displayName = "Mailing Lists";
            type = sql;
            id = maillists;
            viewURL = "mysql://...";
            canAuthenticate = NO;
            isAddressBook = YES;
            listRequiresDot = NO;
            SOGoEnableDomainBasedUID = YES;
            DomainFieldName = "domain";
        },
    );
}

I also tried to add imap account with 'sogo-tool' like below, but same error:

/usr/sbin/sogo-tool user-preferences set defaults user@domain.com AuxiliaryMailAccounts '{"AuxiliaryMailAccounts": [{"password": "xxx", "userName": "imapaccount", "identities": [{"email": "another-user@domain.com", "signature": "test signature", "fullName": "my full name"}], "encryption": "tls", "serverName": "my-imap-server-hostname", "name": "my name"}]}'

As the log entry tells, it's prohibited by design. From commit 68ddcd7045:

// We first check if we're trying to establish an IMAP connection to localhost
// for an account number greater than 0 (default account). We prevent that
// for security reasons if admins use an IMAP trust.

Excuse me, why is using localhost as imap server a security concern/issue? That means user can not add any account under same domain as the Auxiliary User Account.

Actually i use FQDN as imap server address, but /etc/hosts maps it to 127.0.0.1 which is expected.

And what is "an account number greater than 0 (default account)"?
Seems it's for some IMAP server but not Dovecot? Maybe we should introduce a new parameter for this case to:

• With SOGoMailAuxiliaryUserAccountsEnabled = YES, user can add use any imap server, including localhost or 127.0.0.1.
• With new parameter <X> = YES, user can not use localhost and 127.0.0.1 as imap server address.

IMAP trusts are configured when using SSO. We could disable this host constraint when CAS or SAML is enabled.