simonrob / email-oauth2-proxy

An IMAP/POP/SMTP proxy that transparently adds OAuth 2.0 authentication for email clients that don't support this method.
Apache License 2.0
785 stars 84 forks source link

Missing a step somewhere - Gmail Workspace Account Authentication #231

Closed pfeiff77 closed 6 months ago

pfeiff77 commented 6 months ago

I have tried on Windows, Ubuntu and via python and I still get the same errors and I am sure I am just missing something really simple. I am not getting any prompts to authorize the oAuth either via cli or on the app.

In the logs I am getting the following but trying to track it down is not giving me any leads.

Doing SMTP to Google using the port 2465 that is in the config file. I am using my workspace account which is of my own domain but it is going through Google of course.

Here are the log entries:

<-- b'530-5.7.0 Authentication Required. For more information, go to\r\n' <-- b'530-5.7.0 Authentication Required. For more information, go to\r\n' <-- b'530-5.7.0 https://support.google.com/mail/?p=WantAuthError kd3-20020a05622a268300b0042e09c6b82dsm2181889qtb.24 - gsmtp\r\n'

Doing some searching is not coming up with anything. I do have the project in my workspace for the API and have the client_id and client_secret

I don't have an @gmail entry in my config file but something like the example below. I've also tried the advance google entry as well and no joy.

[myuser@mydomain]

Hopefully it is something simple that i am missing.

Thanks.

simonrob commented 6 months ago

Are you using a service account or a normal Gmail setup? If you're struggling to get set up it's always worth starting with the simplest method and getting that working first.

pfeiff77 commented 6 months ago

Thanks for getting back to me. I am using just the standard gmail setup using my workspace account. No service account. I created the project in google and even did web and desktop app ones and copied the ids over but no joy.

For the config entry under the account entry I have tried using my email address and also just the @domain part for the info in the brackets.

Does the entry need to be @gmail.com? My domain of course isn't a @gmail.com.

I've tried using telnet to do a test to the smtp server and all the commands but the proxy just doesn't try to authenticate. I could try using another of my normal @gmail.com accounts but I do think it would still give me the same results. Nothing in my firewall is blocking the attempts to google or anything along those lines.

simonrob commented 6 months ago

What SMTP login method are you using? (If you can tell me the actual commands you're using via telnet, even better)

pfeiff77 commented 6 months ago

Hi Simon,

I got it to work and it was of course a ME issue and not the script.

Just for the readers this is the long winded solution to my issue.

1) I wanted to make sure my project in Google was working so following Google's test of OAuth via python I was able to get a prompt for verification of my login.

2) I was not using the correct SMTP commands via telnet for my test to your proxy server. The commands I was using was for a normal ASCII server. I had to encode my login and password via base64. Once I did that the proxy server prompted me with the web login for Google I did my authentication and had no issues after that sending mail via the proxy server with my SMTP server setup. I had to adjust my emailproxy.config once or twice but in the end got it right.

For information purposes using telnet:

telnet <your ip/dns name of your proxy server> 2465 ( am using google ) EHLO AUTH LOGIN Your server should return 334

and then hit enter. Example: eW91cmVtYWlsQHlvdXJkb21haW4uY29t Server should return 334 and then hit enter. Example: TXlTdXBlclNlY3JldFBhc3N3b3JkSGVyZQ== If all goes well you should get Authentication succeeded ( text may vary ) Once that happened I got the prompted from the Proxy to sign into Google.
simonrob commented 6 months ago

Thanks for following up – this is what I suspected might be happening, so I'm glad you found the cause.

Just for the record: none of the SMTP AUTH methods use plaintext usernames or passwords – base64 encoding is required in all cases. RFC 4954 has some examples that might be useful.