Re: Oauth support

Hi Ralf:

In message <[email protected]>,
Ralf Schlatterbeck writes:
>On Mon, Nov 28, 2022 at 09:42:33PM +0100, Nagy Gabor wrote:
>> Do roundup and mailgw support OAuth authentication for IMAP and SMTP?
>> If no, is there any working patchset to achieve Oauth support for
>> v2.1.0? (I saw some probably relevant patches on the devel ML.)
>
>Yes I've implemented this some days ago. See the latest version of
>roundup/scripts/roundup_mailgw.py
>and
>roundup/mailgw.py
>This is not yet released, though. I'm running it in production on a
>large tracker anyway :-) because MS will pull the plug on what they call
>legacy authentication soon.

Ralf, this only handles IMAP (well IMAPS) right? It doesn't make a
change to mailer.py to send email using SMTP authentication with
OAuth2 on a server.

I had patches to call an external mailer for mailer.py a few years
ago. As I remember they had an issue that I never fixed. Maybe these
external interfaces would be better handled by calling an external
application?

For IMAP/POP IIUC fetchmail 7 is supporting (begrudingly) oauth2.

For SMTP msmtp (https://git.marlam.de/gitweb/?p=msmtp.git)? Might be
able to do something around mutt
(https://www.redhat.com/sysadmin/mutt-email-oauth2) as well. For
Windows https://www.inveigle.net/cmail looks interesting.

Maybe:

  https://github.com/simonrob/email-oauth2-proxy

might be a possibility as well?

>I also have a script (currently not in the roundup repo) for requesting
>the initial tokens from a MS cloud.

Might https://github.com/pdobsan/mailctl work?  I know nothing about
it other than a reference from the msmtp page for arch linux
https://wiki.archlinux.org/title/Msmtp.

If we do start adding suport for native handling of smtp oauth2,
config.ini can support:

  [oauth2]
  # the client id(required)
  client_id = xyzzy

  # url, msmail default 
  token_endpoint = https://xyszzy.com/authv2/xyzzy

  # default oauth
  oauth_directory = oauth2

  # saved in an external file or placed inline
  client_secret = file://oauth/secret

the [mail] section could have use_oauth2 = true/false in
adddition to the password key to enable oauth2 and use the [oauth2]
link to the settings here. mailgw would just use these settings if the
oauth method was used.

Handing multiple providers (if/when needed) would be pretty straight
forward. Add an additional config.ini file similar to
extensions/config.ini and detectors/config.ini in the oauth_directory.
It could have sections:

  [gmail-in]

  [msmail-out]

  [fredsmail-in]

with the same keys as [oauth2] except for oauth_directory.
The Main config.ini would support:

  # configs is used for configuring multiple endpoints when/if we build it.
  # oauth_configs = gmail-in msmail-out

The smtp mailer would wither use_oauth2 = provider name or only use
the config set up under [oauth2]

Token files would be prefixed with the config name. E.G.
gmail-in_access_token, msmail-out_refresh_token
fredsmail-in_access_token. The [oauth2] settings would use
oauth2_token_file.

Then mailgw could just reference that config name:

  maingw tracker imaps_oauth username@server/oauth_config_name [mailbox]

(although I would have preferred username@server[/mailbox] but that
ship has sailed).

Have a great week.

--
				-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.