tarickb / sasl-xoauth2

SASL plugin for XOAUTH2
Other
72 stars 20 forks source link

Token login test and refresh fail for non-consumer tenant on Office365 #54

Closed khers closed 1 year ago

khers commented 1 year ago

I followed your instructions and got most everything setup. I had to pass --tenant=organizations to obtain my initial token. Now when I try and run the test tool it fails on the token:

2022-11-18 11:26:27: TokenStore::Refresh: attempt 1
2022-11-18 11:26:27: TokenStore::Refresh: token_endpoint: https://login.microsoftonline.com/consumers/oauth2/v2.0/token
2022-11-18 11:26:27: TokenStore::Refresh: request: client_id=facd6cff-a294-4415-b59f-c5b01937d7bd&client_secret=&grant_type=refresh_token&refresh_token=redacted
2022-11-18 11:26:27: TokenStore::Refresh: code=400, response={"error":"invalid_grant","error_description":"AADSTS7000012: The grant was obtained for a different tenant.\r\nTrace ID: c13ac28e-b465-49a1-b644-8e67f7cc3600\r\nCorrelation ID: 79748e50-3efa-4f07-8224-36c7be9db5dd\r\nTimestamp: 2022-11-18 16:26:27Z","error_codes":[7000012],"timestamp":"2022-11-18 16:26:27Z","trace_id":"c13ac28e-b465-49a1-b644-8e67f7cc3600","correlation_id":"79748e50-3efa-4f07-8224-36c7be9db5dd"}
2022-11-18 11:26:27: TokenStore::Refresh: request failed
Token refresh failed.

The token end point should be (for this token) https://login.microsoftonline.com/organizations/oauth2/v2.0/token but I don't see where I can configure this.

khers commented 1 year ago

Also, sending mail via this relay fails as well with the following in my journal:

Nov 18 11:33:59 lappy-486 postfix/smtp[1998383]: 514F427C0149: SASL authentication failed; cannot authenticate to server smtp.office365.com[52.96.69.50]: bad protocol / cancel
Nov 18 11:33:59 lappy-486 sasl-xoauth2[1998383]: auth failed: 2022-11-18 11:33:59: TokenStore::Refresh: request failed
Nov 18 11:33:59 lappy-486 sasl-xoauth2[1998383]: set log_full_trace_on_failure to see full 14 line(s) of tracing.
khers commented 1 year ago

NVM, PEBKAC

If I set the token endpoint appropriately in the config file it works