Unauthorized Error And Unable to retrieve Resulting URL and access tokens

[tejavivek]

Iam getting white page but I was unable get tokens or not able retrieve the resulting Url as you can see in above image

[tarickb]

TBH the OAuth failures from Microsoft are pretty inscrutable to me, and I've always had a hard time debugging them, so I can't offer much help here. Try making sure you're specifying the right combination of client ID, client secret, and tenant ID? Sometimes the secret and tenant are required, sometimes they're not, and I don't fully understand why.

[tejavivek]

Hey I love your work but do you think there is any other mistakes I would be making? and I Have tried every possible combinations client ID, and client secret and tenant ID giving all of them. I think you are the only one who can help me please help me thank you.

[ridebadger]

I am receiving the same output. We have a GCC tenant. Using this script:

sudo sasl-xoauth2-tool get-token --client-id=(client ID from AAD App) --tenant=(tenant ID from AAD App) outlook /var/spool/postfix/etc/tokens/username@domain.onmicrosoft.com

[tarickb]

I wonder if you're both being hit by #64 -- can you try this patch for sasl-xoauth2-tool? It'll let you not specify a client secret, because it sounds like you may not need to.

[ridebadger]

Would you please elaborate how to "try this patch"? I am using Ubuntu 2204 with the apt package. Do I need to build from source? Thanks.

[tarickb]

No need to rebuild from source, you're just modifying the token tool (which is in Python):

$ mkdir /tmp/sasl-xoauth2
$ cp /usr/bin/sasl-xoauth2-tool /tmp/sasl-xoauth2/
$ cd /tmp/sasl-xoauth2/
$ wget -O - 'https://gist.github.com/tarickb/b3f23f3066fc94cd0e9edcc0ed14a9a6/raw/5ed48b6f055eb1bbae35a4d457ecdef798cd0da8/sasl-xoauth2-tool%2520patch%2520for%2520Outlook%2520secrets' | patch -p1

Once that's done:

/tmp/sasl-xoauth2/sasl-xoauth2-tool get-token ...

[ridebadger]

I tried the patch and got the same messages except the following:

original: File "/usr/bin/sasl-xoauth2-tool", line 206, in subcommand_get_token get_token_outlook(

patched: File "/tmp/sasl-xoauth2/sasl-xoauth2-tool", line 204, in subcommand_get_token get_token_outlook(

Don't know if that helps.

[tarickb]

Can you please paste exactly what you tried and the resulting errors/messages?

[ridebadger]

sudo /tmp/sasl-xoauth2/sasl-xoauth2-tool get-token --client-id=long-number --tenant=long-number outlook /var/spool/postfix/etc/tokens/username@domain.onmicrosoft.com

Traceback (most recent call last): File "/tmp/sasl-xoauth2/sasl-xoauth2-tool", line 309, in main() File "/tmp/sasl-xoauth2/sasl-xoauth2-tool", line 302, in main args.func(args) File "/tmp/sasl-xoauth2/sasl-xoauth2-tool", line 204, in subcommand_get_token get_token_outlook( File "/tmp/sasl-xoauth2/sasl-xoauth2-tool", line 184, in get_token_outlook tokens = outlook_get_initial_tokens(client_id, client_secret, tenant, code) File "/tmp/sasl-xoauth2/sasl-xoauth2-tool", line 164, in outlook_get_initial_tokens resp = urllib.request.urlopen( File "/usr/lib/python3.10/urllib/request.py", line 216, in urlopen return opener.open(url, data, timeout) File "/usr/lib/python3.10/urllib/request.py", line 525, in open response = meth(req, response) File "/usr/lib/python3.10/urllib/request.py", line 634, in http_response response = self.parent.error( File "/usr/lib/python3.10/urllib/request.py", line 563, in error return self._call_chain(args) File "/usr/lib/python3.10/urllib/request.py", line 496, in _call_chain result = func(args) File "/usr/lib/python3.10/urllib/request.py", line 643, in http_error_default raise HTTPError(req.full_url, code, msg, hdrs, fp) urllib.error.HTTPError: HTTP Error 401: Unauthorized

I am running the script and submitting the url on the same server. Thanks.

[tarickb]

Are you specifying a client secret when the tool prompts you for one, or are you leaving it blank?

[ridebadger]

Success! Left the client secret prompt blank and received no errors. Also, there is a file in /var/spool/postfix/etc/tokens/

Cool!

[tejavivek]

What should I do ?

[tarickb]

I don't understand what you're trying to do? Once patched, there's no need to patch the script again.

Also, I've released version 0.21 of sasl-xoauth2, which contains a fix for this issue. If you update to that version you can just use sasl-xoauth2-tool normally.

[tejavivek]

Hey sorry i was able to retrieve token