Closed SnakeSK closed 2 months ago
Your client isn't actually sending a login command. Using the proxy doesn't mean you can send unauthenticated email; it just means that you can use SMTP's PLAIN
or LOGIN
options, rather than needing to use OAuth 2.0.
When we add credentials this comes up
2024-06-27 18:57:56,527: Running in a packaged/frozen environment - imported SSL certificates from `certifi`
2024-06-27 18:57:56,605: Initialising Email OAuth 2.0 Proxy (version 2024-05-25) from config file C:\Program Files (x86)\OAuth Proxy\emailproxy.config
2024-06-27 18:57:56,605: Starting SMTP server at 192.168.X.X:1587 (unsecured) proxying smtp.office365.com:587 (STARTTLS)
2024-06-27 18:57:56,605: Initialised Email OAuth 2.0 Proxy - listening for authentication requests. Connect your email client to begin
2024-06-27 18:58:08,886: Setting debug mode: True
2024-06-27 19:00:34,368: New incoming connection to SMTP server at 192.168.X.X:1587 (unsecured) proxying smtp.office365.com:587 (STARTTLS)
2024-06-27 19:00:34,368: Accepting new connection from 192.168.184.250:31241 to SMTP server at 192.168.X.X:1587 (unsecured) proxying smtp.office365.com:587 (STARTTLS)
2024-06-27 19:00:34,416: SMTP (192.168.184.250:31241-{192.168.X.X:1587}-smtp.office365.com:587) --> [ Client connected ]
2024-06-27 19:00:34,431: SMTP (192.168.184.250:31241-{192.168.X.X:1587}-smtp.office365.com:587) <-- b'220 VI1PR04CA0050.outlook.office365.com Microsoft ESMTP MAIL Service ready at Thu, 27 Jun 2024 17:00:33 +0000\r\n'
2024-06-27 19:00:34,431: SMTP (192.168.184.250:31241-{192.168.X.X:1587}-smtp.office365.com:587) <-- b'220 VI1PR04CA0050.outlook.office365.com Microsoft ESMTP MAIL Service ready at Thu, 27 Jun 2024 17:00:33 +0000\r\n'
2024-06-27 19:00:34,431: SMTP (192.168.184.250:31241-{192.168.X.X:1587}-smtp.office365.com:587) --> b'EHLO SRV3\r\n'
2024-06-27 19:00:34,431: SMTP (192.168.184.250:31241-{192.168.X.X:1587}-smtp.office365.com:587) --> b'EHLO SRV3\r\n'
2024-06-27 19:00:34,447: SMTP (192.168.184.250:31241-{192.168.X.X:1587}-smtp.office365.com:587) <-- b'250-VI1PR04CA0050.outlook.office365.com Hello [5.178.56.180]\r\n'
2024-06-27 19:00:34,447: SMTP (192.168.184.250:31241-{192.168.X.X:1587}-smtp.office365.com:587) <-- b'250-SIZE 157286400\r\n'
2024-06-27 19:00:34,447: SMTP (192.168.184.250:31241-{192.168.X.X:1587}-smtp.office365.com:587) <-- b'250-PIPELINING\r\n'
2024-06-27 19:00:34,447: SMTP (192.168.184.250:31241-{192.168.X.X:1587}-smtp.office365.com:587) <-- b'250-DSN\r\n'
2024-06-27 19:00:34,447: SMTP (192.168.184.250:31241-{192.168.X.X:1587}-smtp.office365.com:587) <-- b'250-ENHANCEDSTATUSCODES\r\n'
2024-06-27 19:00:34,447: SMTP (192.168.184.250:31241-{192.168.X.X:1587}-smtp.office365.com:587) <-- b'250-STARTTLS\r\n'
2024-06-27 19:00:34,447: SMTP (192.168.184.250:31241-{192.168.X.X:1587}-smtp.office365.com:587) <-- b'250-8BITMIME\r\n'
2024-06-27 19:00:34,447: SMTP (192.168.184.250:31241-{192.168.X.X:1587}-smtp.office365.com:587) <-- b'250-BINARYMIME\r\n'
2024-06-27 19:00:34,447: SMTP (192.168.184.250:31241-{192.168.X.X:1587}-smtp.office365.com:587) <-- b'250-CHUNKING\r\n'
2024-06-27 19:00:34,447: SMTP (192.168.184.250:31241-{192.168.X.X:1587}-smtp.office365.com:587) <-- b'250 SMTPUTF8\r\n'
2024-06-27 19:00:34,447: SMTP (192.168.184.250:31241-{192.168.X.X:1587}-smtp.office365.com:587) --> b'STARTTLS\r\n'
2024-06-27 19:00:34,478: SMTP (192.168.184.250:31241-{192.168.X.X:1587}-smtp.office365.com:587) <-- b'220 2.0.0 SMTP server ready\r\n'
2024-06-27 19:00:34,478: SMTP (192.168.184.250:31241-{192.168.X.X:1587}-smtp.office365.com:587) <-> [ Starting TLS handshake ]
2024-06-27 19:00:34,697: SMTP (192.168.184.250:31241-{192.168.X.X:1587}-smtp.office365.com:587) [ Successfully negotiated SMTP server STARTTLS connection - re-sending greeting ]
2024-06-27 19:00:34,712: SMTP (192.168.184.250:31241-{192.168.X.X:1587}-smtp.office365.com:587) --> b'EHLO SRV3\r\n'
2024-06-27 19:00:34,759: SMTP (192.168.184.250:31241-{192.168.X.X:1587}-smtp.office365.com:587) <-> [ TLSv1.3 handshake complete ]
2024-06-27 19:00:34,791: SMTP (192.168.184.250:31241-{192.168.X.X:1587}-smtp.office365.com:587) <-- b'250-VI1PR04CA0050.outlook.office365.com Hello [5.178.56.180]\r\n'
2024-06-27 19:00:34,791: SMTP (192.168.184.250:31241-{192.168.X.X:1587}-smtp.office365.com:587) <-- b'250-SIZE 157286400\r\n'
2024-06-27 19:00:34,791: SMTP (192.168.184.250:31241-{192.168.X.X:1587}-smtp.office365.com:587) <-- b'250-PIPELINING\r\n'
2024-06-27 19:00:34,791: SMTP (192.168.184.250:31241-{192.168.X.X:1587}-smtp.office365.com:587) <-- b'250-DSN\r\n'
2024-06-27 19:00:34,791: SMTP (192.168.184.250:31241-{192.168.X.X:1587}-smtp.office365.com:587) <-- b'250-ENHANCEDSTATUSCODES\r\n'
2024-06-27 19:00:34,791: SMTP (192.168.184.250:31241-{192.168.X.X:1587}-smtp.office365.com:587) <-- b'250-AUTH LOGIN XOAUTH2\r\n'
2024-06-27 19:00:34,791: SMTP (192.168.184.250:31241-{192.168.X.X:1587}-smtp.office365.com:587) <-- b'250-8BITMIME\r\n'
2024-06-27 19:00:34,791: SMTP (192.168.184.250:31241-{192.168.X.X:1587}-smtp.office365.com:587) <-- b'250-BINARYMIME\r\n'
2024-06-27 19:00:34,791: SMTP (192.168.184.250:31241-{192.168.X.X:1587}-smtp.office365.com:587) <-- b'250-CHUNKING\r\n'
2024-06-27 19:00:34,791: SMTP (192.168.184.250:31241-{192.168.X.X:1587}-smtp.office365.com:587) <-- b'250 SMTPUTF8\r\n'
2024-06-27 19:00:34,791: SMTP (192.168.184.250:31241-{192.168.X.X:1587}-smtp.office365.com:587) <-- b'250-VI1PR04CA0050.outlook.office365.com Hello [5.178.56.180]\r\n250-SIZE 157286400\r\n250-PIPELINING\r\n250-DSN\r\n250-ENHANCEDSTATUSCODES\r\n250-AUTH PLAIN LOGIN\r\n250-8BITMIME\r\n250-BINARYMIME\r\n250-CHUNKING\r\n250 SMTPUTF8\r\n'
2024-06-27 19:00:34,791: SMTP (192.168.184.250:31241-{192.168.X.X:1587}-smtp.office365.com:587) --> b'AUTH login [[ Credentials removed from proxy log ]]\r\n'
2024-06-27 19:00:34,791: SMTP (192.168.184.250:31241-{192.168.X.X:1587}-smtp.office365.com:587) <-- b'334 UGFzc3dvcmQ6\r\n'
2024-06-27 19:00:34,791: SMTP (192.168.184.250:31241-{192.168.X.X:1587}-smtp.office365.com:587) --> b'[[ Credentials removed from proxy log ]]'
2024-06-27 19:00:34,791: SMTP (192.168.184.250:31241-{192.168.X.X:1587}-smtp.office365.com:587) --> b'AUTH XOAUTH2\r\n'
2024-06-27 19:00:34,806: SMTP (192.168.184.250:31241-{192.168.X.X:1587}-smtp.office365.com:587) <-- b'334 \r\n'
2024-06-27 19:00:35,197: Caught exception while requesting OAuth 2.0 credentials for account email@email.com: OSError(22, 'Invalid argument')
2024-06-27 19:00:35,197: SMTP (192.168.184.250:31241-{192.168.X.X:1587}-smtp.office365.com:587) --> b'*\r\n'
2024-06-27 19:00:40,213: SMTP (192.168.184.250:31241-{192.168.X.X:1587}-smtp.office365.com:587) <-- b'535 5.7.3 Authentication unsuccessful [VI1PR04CA0050.eurprd04.prod.outlook.com 2024-06-27T17:00:40.197Z 08DC954D1D4D8E17]\r\n'
2024-06-27 19:00:40,213: SMTP (192.168.184.250:31241-{192.168.X.X:1587}-smtp.office365.com:587) <-- b'535 5.7.8 Authentication credentials invalid. Email OAuth 2.0 Proxy: Login failed for account email@email.com - please check your internet connection and retry\r\n'
2024-06-27 19:00:40,213: SMTP (192.168.184.250:31241-{192.168.X.X:1587}-smtp.office365.com:587) --> b'MAIL FROM:<email@email.com>\r\n'
2024-06-27 19:00:40,213: SMTP (192.168.184.250:31241-{192.168.X.X:1587}-smtp.office365.com:587) --> b'MAIL FROM:<email@email.com>\r\n'
2024-06-27 19:00:45,243: SMTP (192.168.184.250:31241-{192.168.X.X:1587}-smtp.office365.com:587) <-- b'530 5.7.57 Client not authenticated to send mail. Error: 535 5.7.3 Authentication unsuccessful [VI1PR04CA0050.eurprd04.prod.outlook.com 2024-06-27T17:00:45.228Z 08DC954D1D4D8E17]\r\n'
2024-06-27 19:00:45,243: SMTP (192.168.184.250:31241-{192.168.X.X:1587}-smtp.office365.com:587) <-- b'530 5.7.57 Client not authenticated to send mail. Error: 535 5.7.3 Authentication unsuccessful [VI1PR04CA0050.eurprd04.prod.outlook.com 2024-06-27T17:00:45.228Z 08DC954D1D4D8E17]\r\n'
2024-06-27 19:00:45,243: SMTP (192.168.184.250:31241-{192.168.X.X:1587}-smtp.office365.com:587) <-- [ Server disconnected ]
2024-06-27 19:00:45,243: SMTP (192.168.184.250:31241-{192.168.X.X:1587}-smtp.office365.com:587) --> [ Client disconnected ]
Thanks for posting the additional context. Initially, I thought this might be a case where the proxy's cautious approach to security makes it harder to debug (I'd benefit from seeing what is the actual content of the [[ Credentials removed from proxy log ]]
lines in order to rule that out).
However, I then noticed that you have put quotes around the jwt_certificate_path
and jwt_key_path
values. This is not required. Please could you remove the quotes and try again?
Thank you for understanding. I did not manually remove anything, I just censored the IP and email address, it is in the logs as you see it pasted.
But without quotes we are getting somewhere, I was fighting the authorization windows since the popup is in IE, it wont let me go past the MFA skip prompt (we have exception for this account to not to require MFA from certain locations, however the registration still pops up), after checking the external authorization, I had to view the source to copy the URL. I copied the url, I had to click to continue the script execution and finally after submitting I was authorised :)
I just hope this wont have to be done often. Have you thought about implementing a device login? Or Edge/Chrome WebView? https://login.microsoftonline.com/common/oauth2/deviceauth
If you need any more info I am available :)
Thanks for following up – I'm glad you were able to resolve this. I have updated the sample configuration file to point to the configuration file format documentation and explicitly note that quoting of values is not required. Hopefully this will help avoid other people making this mistake.
The proxy has very little control over the authentication/authorisation process – this is up to the provider. However (with the caveat that this depends on your Entra configuration), I'd expect this to have to be done very infrequently – many months apart, if not even less often.
There are known issues with the web browser popup in some configurations, and these are beyond the scope of the proxy to fix. But you could always try one of the other authorisation options if needed.
Hello,
we are trying to authenticate against M365 Server. Created new app registration with following permissions![image](https://github.com/simonrob/email-oauth2-proxy/assets/79028652/33663902-50ec-4cdf-9c91-b006022a7921)
Configuration is as follows (we dont need IMAP or POP, just SMTP
In the log we are getting
Any clue what to set up next? Thank you