Re: Is there any 'xoauth2' login wrapper support for v5 of current getmail for ms o365 in the works?

To all interested on this list,

The script "getmail-gmail-xoauth-tokens" originally contributed
for use with gmail, has worked fine for me to retrieve mail from 
ms365 when used the procedure outlined by Pieter Jacques.

I followed Pieter's instructions as he layed them out below and at 
first I got error messages when I issued the command line at step 2
in his instructions.

Eventually, after overlooking it for a while, I saw that the file 
msoft.json was not being found when issuing the command.  Pieter 
wrote "PATH-TO-MSOFT.JSON" and I had just put the filename since it 
was in my present working directory.  So I tried issued the command 
again using the full path from root "/" and it worked perfectly.

Subsequently, I heard from another user who was having similar 
trouble.  He asking if I was able to get it to work and I told him 
what I had done and sent him my msoft.json file and he got it to 
work also but I think he said he did it without using the full path, 
though he may have been on mac os whereas I'm on debian linux.

So I don't know if that was the key to my getting it to work for me 
or not.  It's possible that I had simply made other errors and/or 
typos and it was just coincidence that it worked when I used the 
full path in the commandline but I'm not sure.  I thought I might 
be able to resolve this uncertainty before writing to the list but, 
for various reasons, I never was able to, so I don't know for sure 
what the key was.

What I can say is that the script "getmail-gmail-xoauth-tokens" 
when used following the procedure outlined by Pieter Jacques worked 
for me at my university as it did for him, and the 2 factor 
authentication also worked fine.

If anyone else tries and has trouble I may be able to help.

Donald MacDougall

On Sun, 9 Jan 2022, Pieter Jacques wrote:

> Donald,
> 
> My situation seems identical to yours:  a university email system that
> uses Microsoft Office365 with Duo 2-factor authentication, and which now
> requires xoauth2.  I got this working with Stefan Krah's
> getmail-gmail-xoauth-tokens as follows.
> 
> First of all, for this to work your University must allow xoauth2 access
> from Thunderbird.  Probably most universities do allow Thunderbird,
> since it's very popular.  An interesting point here is that the xoauth2
> client ID and client secret for Thunderbird are not exactly "secret".
> Since Thunderbird is open source, anyone can download the Thunderbird
> source code and extract the ID and secret.  (Try googling "thunderbird
> oauth2providers.jsm")
> 
> Follow the instructions on the "getmail-5.6 XOAUTH2 configuration for
> gmail" web page, with the following changes:
> 
> 1) Instead of the suggested gmail.json file, create a "msoft.json" file,
> using this template:
> 
> {"scope": "offline_access https://outlook.office365.com/IMAP.AccessAsUser.All",
>   "response_type": "code",
>   "client_id": "INSERT THUNDERBIRD CLIENT ID",
>   "client_secret": "INSERT THUNDERBIRD CLIENT SECRET",
>   "redirect_uri": "http://localhost",
>   "token_uri": "https://login.microsoftonline.com/common/oauth2/v2.0/token",
>   "auth_uri": "https://login.microsoftonline.com/common/oauth2/v2.0/authorize",
>   "user": "[email protected]"}
> 
> 2) Next do "getmail-gmail-xoauth-tokens --init PATH-TO-MSOFT.JSON
> 
> 3) This will output a URL.  Mouse-copy that URL into a browser and open
> the URL.  This should take to your university's login procedure,
> complete with Duo.  Enter login information as required.
> 
> 4) Once you complete entering the login information your browser will
> give an "Unable to connect" error.  This is expected.  DO NOT CLOSE THE
> BROWSER WINDOW.  Instead, look in the URL box, which should look
> something like
>     "localhost/?code=3DA-LONG-STRING&session_state=3DANOTHER-STRING"
> 
> 5) Mouse copy the "A-LONG-STRING" part of that, and paste it into the
> "Enter verification code" prompt from getmail-gmail-xoauth-tokens.
> 
> This should result in an updated msoft.json file that will allow getmail
> to fetch email from Microsoft Office365 with xoauth2 authentication.
> 
> - Pieter
> 
> 
> On Sat, 8 Jan 2022, dmacdoug wrote:

> On Fri, Nov 12, 2021 at 12:06:45PM -0600, Charles Cazabon wrote:
>> Urs Rau <[email protected]> wrote:
> ...
>>>
>>> But for that we would need to find a xoauth2 =A1plugin=A2 that
>>> supports ms o365 with modern authentication as well as running
>>> on an old and end of life version of python.
>>
>> I don't actually use xoauth2, but getmail has some support for 
>> it.   The getmail-gmail-xoauth-tokens helper script it uses
>> should still work?  I don't know for sure as I don't use Gmail.
>>
>> If you find xoauth2 support is broken, please report it.  No 
>> one  else has mentioned it IIRC.
>>
> ...
>>
>>> Has anybody worked out a way to expand the xoauth2 functionality
>>> from Stefan Krah to work with ms o365 and not just gmail?
>>
>> No one has contributed support for it, I think.  The docs ask
>> people who can make it work with other providers provide that
>> info to me for inclusion.
>>
>> Charles
>
> I'm wondering if the OP or anyone else has made any further
> headway on using XOAUTH2 with Getmail to download email from
> MS Office365 IMAP server since this inquiry was posted or,
> alternatively, found it to not be possible?
>
> I tried it a couple of years ago without success, but now my
> university is going to require it starting Jan. 20th, so if I
> can't make it work I'll have to find some alternative way to
> get my email.
>
> Additionally they are going to require two factor authentication
> using a company called Duo.  I'm not sure how this could be made
> to work with getmail, so perhaps all is futile.  Any observations
> would be appreciated.
>
> Donald
>