XOAUTH2 support

Hello,

I wonder if it would be possible to add a very minimal XOAUTH2 support.

This has been discussed before, and I completely agree with all the skepticism
in the thread, e.g.:

   https://marc.info/?l=getmail&m=149194578031871&w=2

The resulting setup is indeed no more secure than a config file with 0600
permissions and requires a lot of hoop-jumping.


That said, sometimes one is forced to use GMail when working at a company
that uses a locked-down GSuite that only permits XOAUTH2.


I have a working setup that requires the patch below.  The setup is like this:

# gettoken.py gets an XOAUTH2 access token. Web login is only needed the first
# time and when the refresh token expires:
.getmail/gettoken.py

# tokens.json stores client_id, client_secret, access_token, refresh_token. The
# client_id and client_secret have to be obtained once in a bureaucratic Google
# Apps registration process:
.getmail/tokens.json

# The actual getmail config file:
[retriever]
type = SimpleIMAPSSLRetriever
server = imap.gmail.com
username = none@some_gsuite_address.invalid
use_xoauth2 = True
password_command = ("/home/stefan/.getmail/gettoken.py",)


gettoken.py is short and could in theory be integrated into getmail, but
perhaps it is cleaner to rely on the external password command.


Below is the required patch for the external password command.  It is very
likely embarassingly incomplete but works for IMAP.

===============================================================================
diff -ur getmail-5.5/getmailcore/_retrieverbases.py getmail-5.5-patched/getmailcore/_retrieverbases.py
--- getmail-5.5/getmailcore/_retrieverbases.py  2017-12-18 22:22:56.000000000 +0100
+++ getmail-5.5-patched/getmailcore/_retrieverbases.py  2018-03-17 18:44:27.180760184 +0100
@@ -1695,6 +1695,10 @@
                         'login_cram_md5', self.conf['username'],
                         self.conf['password']
                     )
+                elif self.conf['use_xoauth2']:
+                    auth = 'user=%s\1auth=Bearer %s\1\1' % (self.conf['username'],
+                                                            self.conf['password'])
+                    self.conn.authenticate('XOAUTH2', lambda _: auth)
                 else:
                     self._parse_imapcmdresponse('login', self.conf['username'],
                                                 self.conf['password'])
diff -ur getmail-5.5/getmailcore/retrievers.py getmail-5.5-patched/getmailcore/retrievers.py
--- getmail-5.5/getmailcore/retrievers.py       2017-12-18 22:22:56.000000000 +0100
+++ getmail-5.5-patched/getmailcore/retrievers.py       2018-03-16 23:16:54.502538732 +0100
@@ -388,6 +388,7 @@
         # .authenticate(), so we can't do this yet (?).
         ConfBool(name='use_cram_md5', required=False, default=False),
         ConfBool(name='use_kerberos', required=False, default=False),
+        ConfBool(name='use_xoauth2', required=False, default=False),
     )
     received_from = None
     received_with = 'IMAP4'
@@ -437,6 +438,7 @@
         # .authenticate(), so we can't do this yet (?).
         ConfBool(name='use_cram_md5', required=False, default=False),
         ConfBool(name='use_kerberos', required=False, default=False),
+        ConfBool(name='use_xoauth2', required=False, default=False),
         ConfString(name='ssl_cert_hostname', required=False, default=None),
     )
     received_from = None
@@ -479,6 +481,7 @@
         # .authenticate(), so we can't do this yet (?).
         ConfBool(name='use_cram_md5', required=False, default=False),
         ConfBool(name='use_kerberos', required=False, default=False),
+        ConfBool(name='use_xoauth2', required=False, default=False),
         ConfString(name='envelope_recipient'),
     )
     received_from = None
@@ -529,6 +532,7 @@
         # .authenticate(), so we can't do this yet (?).
         ConfBool(name='use_cram_md5', required=False, default=False),
         ConfBool(name='use_kerberos', required=False, default=False),
+        ConfBool(name='use_xoauth2', required=False, default=False),
         ConfString(name='envelope_recipient'),
         ConfString(name='ssl_cert_hostname', required=False, default=None),
     )
===============================================================================



Stefan Krah