search

seunomosowon / TA-mailclient

This technology adapter add-on fetches emails for Splunk to index from mailboxes using either POP3 or IMAP, with or without SSL.
Apache License 2.0
9 stars 10 forks source link

Unable to configure TA-mailclient with modern Auth #38

Open wwwadou opened 1 year ago

wwwadou commented 1 year ago

We had the TA-mailclient v1.5.5 installed on our on prem environnement. As Microsoft company has announced that Basic Authentication will be deprecated. https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/deprecation-of-basic-authentication-exchange-online

So, within few days or weeks the Add-On TA-MAILCLIENT will be out of service because It only uses Basic Authentication and not Modern Auth to connect and to retrieve Mail. After communicating with Splunk Support it suggest me to check if you get any ideas / suggestions on how to solve this issue or is it a known bug or is it by design and is the TA not intended to run on modern auth.

tsunaryo commented 1 year ago

@wwwadou did you get a response from Splunk Support if there is a work around to Modern Auth?

hkelley commented 1 year ago

We had the same issue with TA-dmarc (see https://github.com/jorritfolmer/TA-dmarc/issues/240 ). The TA will need to be updated to use the Python package msal so that it can access O365 with modern auth.