oauth2 for office365 - Githubissues

jan-spurny commented 1 year ago

I'm trying to get sylpheed working with office365 IMAP4, but so far I'm stuck - as I understand it, I have to create oauth2.ini file with specific data for microsoft's outlook/office365, but I don't know how - I see how it probably should look in oauth2.ini.sample file, but I really don't know how to fill it to get it working with office365 IMAP. Can someone help me?

I'm using devel version 3.8.0beta compiled from source on Debian GNU/Linux 10. And up until yesterday, sylpheed was working with office365 and PLAIN AUTH just fine, but now it seems they require oath2 so I have no choice.

rmrmg commented 1 year ago

I have the same problem with gmail. Is there any manual how to configure oauth2?

Settyness commented 1 year ago

A google query of "sylpheed" "oauth2" nets the Sylpheed home page and this GitHub repository. Any guidance for how to get OAuth2 up and running would be greatly appreciated as I am dying to quit using Thunderbird.

bdst64 commented 1 year ago

I got it to work last fall after first making it work with sylpheed-claws and then copying the authentication data into oauth2.ini. One problem is that sylpheed has to be registered with the MS Azure server, so you'll have to ask whoever is running this server for your access to do that. They'll give you the "client-id" in the oauth2-file below.

Another caveat is that unlike sylpheed-claws, automatic token renewal hasn't been implemented in sylpheed. This means that every now and then you'll have to manually authenticate again to receive a new token. I hope this will be fixed with the next release of sylpheed because it is rather annoying.

Here is my oauth2.ini-file:

[@.DOMAIN.edu] auth_uri=https://login.microsoftonline.com/common/oauth2/v2.0/authorize token_uri=https://login.microsoftonline.com/common/oauth2/v2.0/token redirect_uri=http://127.0.0.1:8888 client_id=36dcdd5c-XXXX-XXXX-XXXX-XXXXXXXXXXXX client_secret= scope=offline_access https://outlook.office.com/POP.AccessAsUser.All https://outlook.office.com/IMAP.AccessAsUser.All https://outlook.office.com/SMTP.Send local_port=8888

semioticrobotic commented 1 year ago

Has anyone documented this further? Or made more progress with this? I'm specifically looking for instructions for configuring GMail OAuth2.

bdst64 commented 1 year ago

I am afraid there is not much more to say. It's a rather manual process that depends on the precise setup since sylpheed does not seem to be officially registered as an app with MS Azure. The key is to get the client_id for the MS Azure server. Is that where you are stuck?

semioticrobotic commented 1 year ago

I am afraid there is not much more to say. It's a rather manual process that depends on the precise setup since sylpheed does not seem to be officially registered as an app with MS Azure. The key is to get the client_id for the MS Azure server. Is that where you are stuck?

Thanks for your response, @bdst64! As I mentioned, I'm looking for assitance with Google OAuth2 setup, though I assume your advice holds true in this case, as well.

At this point my questions are:

How do I obtain the client id an key for a Google Workspace?
Where do I place the oauth2.ini file when I've configured it?
What actions must I then take from the Sylpheed GUI to change connection method to OAuth?

bdst64 commented 1 year ago

Client ID: Does this apply to your setup? https://support.google.com/cloud/answer/6158849?hl=en
The oauth2.ini-file goes in your local .sylpheed folder.
Change "Authentication method" in your account preferences under "Receive" to OAuth2. I have a POP3-setup, but IMAP should be similar. Leave the account password under "Basic" blank, as far as I remember.

semioticrobotic commented 1 year ago

Thanks, @bdst64. This helps a great deal. Provided I can obtain proper client ids, etc. (I'm at the mercy of the organization's managers here), I plan on giving this a try.

Settyness commented 1 year ago

Here is my oauth2.ini-file:

Where on Earth did you find the parameters and format for this INI file? I've been searching everywhere looking for information, and while some of the parameters are searchable, this particular template eludes me. It doesn't come with my installation of Sylpheed.

I followed the instructions at Google Answers and got about this far:

[@.gmail.com] auth_uri=https://accounts.google.com/o/oauth2/auth token_uri=https://accounts.google.com/o/oauth2/token client_id=xxxxxxxxxxxx-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.apps.googleusercontent.com client_secret=xxxxxx-xxxxxxxxxxxxxxxxxxxxxxxxxxxx scope=https://mail.google.com

But there is zero feedback when attempting to connect to the mail domain, so I have no idea what I'm doing wrong or doing right. I select Gmail account during account creation within Sylpheed, but in account preferences, OAuth2 is not selected for receive/send authentication method and selecting them seems to do nothing. I'm pretty lost here.

bdst64 commented 1 year ago

It's been a while, but as far as I remember I got the oauth2.ini template and most other information straight from Sylpheed 3.8beta1 (https://sylpheed.sraoss.jp/en/download.html) . I have no experience using Gmail through this setup though.

Settyness commented 1 year ago

It's been a while, but as far as I remember I got the oauth2.ini template and most other information straight from Sylpheed 3.8beta1 (https://sylpheed.sraoss.jp/en/download.html) .

How foolish of me to give up when I couldn't find the .ini template in my provided package. I should've just checked the direct download in the first place! My bad.

Finally got this working after a little tinkering. Steps to consider for people who might search and find this:

Be sure to add yourself as a test user in the Oauth consent screen section
Do not use "Create new account..." in Sylpheed, the Gmail option does not default to Oauth2 and for some reason, setting it after the account fails to connect seems to make it never work... no output in the log. Instead, create a Gmail account in the wizard as a reference and then delete it before manually creating your Gmail accounts via "Edit accounts..." and select Oauth2 for Send/Recieve before the initial connection.

I'm very happy to be using Sylpheed again. Thanks for your help, @bdst64.

presentfactory commented 1 year ago

I got this to work for Outlook if anyone is trying to do that. It's a bit of a confusing process though, most of which is outlined in a more verbose way here.

Tldr though of the process I did:

First create an oauth2.ini in ~/.sylpheed-2.0/ with something like this in it (taken from the sample, note you may need to replace *@outlook.com with something like *@live.com or *@hotmail.com if you're not using outlook.com as your email's domain):

[*@outlook.com]
auth_uri=https://login.microsoftonline.com/common/oauth2/v2.0/authorize
token_uri=https://login.microsoftonline.com/common/oauth2/v2.0/token
redirect_uri=http://localhost:8089/
client_id=<enter client id here>
client_secret=<enter client secret here>
scope=offline_access https://outlook.office.com/POP.AccessAsUser.All https://outlook.office.com/IMAP.AccessAsUser.All https://outlook.office.com/SMTP.Send
local_port=8089

After that to get the client ID/secret, do these steps via Microsoft Azure:

Follow this process to start the Application Registration process.
When registering a new application select "Accounts in any organizational directory and personal Microsoft accounts" as the supported account types (for some reason Personal accounts only doesn't seem to have the right permissions or something).
Set the Redirect URI to "Web" and fill in whatever is in your ini file (http://localhost:8089/ in this case).
Press the Register button, it should take you to the Application's overview page. Copy the Application (client) ID and paste this into the ini file for the client_id field.
On the left panel click Certificates & Secrets, then click New Client Secret.
Set the secret lifetime to whatever (you'll likely need to renew it at some point) and some description and click Add.
On the page you're given after this, copy the secret from the "Value" field and paste it into the client_secret field in the ini file. Be careful not to leave this page until you do this, the secret is only visible right after you create it and will be inaccessible afterwards if you navigate away.

Once all this is set up Sylpheed should open up your browser when it tries to authenticate when say sending an email.

For more troubleshooting syl-auth-helper --debug youremail@whatever.com is also useful to run (this is essentially what the client will run, with the addition of debug output from it).

Hopefully this gets easier some day, OAuth is just complete insanity, or at least Microsoft's implementation of it is.

jodo13 commented 5 hours ago

Windows 7 SP 1 Sylpheed 3.8b1

I did the above, but for [*@hotmail.com] and... no luck.

All the process goes fine. Sylpheed opens the browser, I login, I accept, it gets redirected to localhost, the browser displays I can close it as all was fine and... Sylpheed reconnects to the Microsoft servers and this is the error:

IMAP4> 2 AUTHENTICATE XOAUTH2 IMAP4< + ** LibSylph-WARNING: [23:22:57] Could not get OAuth2 token.

** Could not get OAuth2 token. IMAP4> 3 LOGOUT IMAP4< 2 NO AUTHENTICATE failed.

If all went fine... why can't it find the token?

Where is the token stored?

Is it stored or is just per Sylpheed session in memory?

By the way

syl-auth-helper --debug youremail@whatever.com

The above just opens the browser to login at Microsoft.

Is supposed to be a log?. Where?

Any hint of how to fix this?

Thank you, regards.

sylpheed-mail / sylpheed

oauth2 for office365 #3