mguessan / davmail

DavMail POP/IMAP/SMTP/Caldav/Carddav/LDAP Exchange and Office 365 Gateway - Synced with main subversion repository at
http://davmail.sourceforge.net
GNU General Public License v2.0
582 stars 86 forks source link

Interactive Auth seems to succeed, but Davmail fails to get mail #259

Open gadgethm opened 1 year ago

gadgethm commented 1 year ago

Not sure if this is a bug or what, but when using davmail at my organization, I'm able to get the interactive pop up working. However, after completing the MFA steps, the interactive window is closed, no auth error is reported, but Thunderbird is unable to get any mail from the IMAP server.

The last debug log line after this sequence of events is the following: https://davmail.sourceforge.net/xref/davmail/exchange/auth/O365InteractiveAuthenticatorFrame.html#L237

From looking at the url response using the O365Manual mode, its clear that &session_state is not included, and the response only contains the 'code=' section. This also explains why I don't get any errors, since it appears the authentication succeeded, but davmail doesn't recieve a 'session_state=' alphanumeric, and so therefore the isAuthenticated flag is never set to true.

Some details about my use-case: My organization uses a different url from the standard, and I have set up a custom application ID in active directory for oauth2. Davmail has the correct tenant and application ID, as well as the proper redirect url. I know these settings work since I'm currently using them in evolution-ews to get email (though I would prefer to switch to thunderbird)

mguessan commented 1 year ago

I received a similar feedback from another user, and the issue was that the code was not an O365 code but a duo authentication code. Please make sure the url containing the code starts with your redirectUri

gadgethm commented 1 year ago

That would make sense, given that we use an outside application for authentication (in this case, okta). I have confirmed that the url containing the code does indeed start with the redirectUri (which makes sense, since the last debug message I see is Location starts with redirectUri, check code)