Enhancement: Add support for OAUTH2 authentication #421

Activity

1. bbottema commented on Dec 25, 2022

   

   bbottema

   on Dec 25, 2022

   Owner

   More actions

   OAuth2... how? This is an SMTP library, it connects and authenticates with SMTP servers. I'm not sure where OAth2 comes into the picture here.
2. bbottema

   added

   invalid

   need-user-input

   on Dec 25, 2022
3. neoxpert commented on Jan 4, 2023

   

   neoxpert

   on Jan 4, 2023

   Last edited by neoxpert

   More actions

   I guess this might be important as it is now required when connecting /authenticating to smtp.office365.com if not changes for a mailbox (which is not always possible, especially if a customer does not want to pass on the actuall password to external solutions in the future). At least the server response states 250-AUTH LOGIN XOAUTH2 and plain login using username and password does not work anymore. Also gmail does accept OAuth2 authentication.

   So the question would be how to achieve this type of authentication with simple-java-mail assuming that there is a working OAuth2 token at hand.
4. bbottema commented on Jan 4, 2023

   

   bbottema

   on Jan 4, 2023

   Last edited by bbottema

   Owner

   More actions

   Interesting! Apparently, this was already possible in Sun JavaMail.

   First of all, to start testing this in order to develop this feature, there are a few steps to get stuff working (took a while to figure this out):

   1. Create a new Google API Project with new consent screen and OAuth client credentials, as described at github.com/nfo/gmail_xoauth.
   2. Now generate a new OAuth2 token using this new Google API and to do that you need an app that will invoke the consent screen in the browser for the actual login. Unfortunately the oauth2.py Python script from that repo is old and broken, but luckily you can find new working instructions here, which uses a newer Python script from getmail6.
   3. Then with this OAth2 token string, go to yet another project, gmail_xoauth, and open the Java oauth2 module, configure Sun JavaMail dependencies and all and run OAuth2Authenticator.java with the IMAP commented out in the static void main. With a valid OAuth2 token this should run and finish without errors.
5. bbottema

   added

   Priority-Low

   security

   major feature

   and removed

   invalid

   need-user-input

   on Jan 4, 2023
6. bbottema

   added 2 commits that reference this issue on Jan 4, 2023

   #bbottema/simple-java-mail#421: add OAUTH2 support (you still need to…

   ...

   f9bac09

   #421: Added support for OAUTH2 using Google's XOAUTH2 reference imple…

   ...

   793278a
7. bbottema

   added this to the 7.6.0 milestone on Jan 5, 2023
8. bbottema

   added a commit that references this issue on Jan 5, 2023

   #421: Added support for OAUTH2 using Google's XOAUTH2 reference imple…

   ...

   e60027b
9. bbottema commented on Jan 5, 2023

   

   bbottema

   on Jan 5, 2023

   Last edited by bbottema

   Owner

   More actions

   I just discovered JavaMail / Jakarta Mail already supported it out of the box, without using Google's version.

   • https://javaee.github.io/javamail/OAuth2

   Guess I'll have to start over :|
10. bbottema

    changed the title [-]OAuth2 Support[/-] [+]Enhancement: Add support for OAUTH2 authentication[/+] on Jan 5, 2023
11. bbottema commented on Jan 5, 2023

    

    bbottema

    on Jan 5, 2023

    Last edited by bbottema

    Owner

    More actions

    OAUTH2 authentication is now supported with the release of 7.6.0!

    It's super simple, just use TransportStrategy.OAUTH2 (which is based on TransportStrategy.SMTP_TLS) and use your OAuth2 token as password.

    MailerBuilder
      .withSMTPServer("server host", 587, "username", yourOAuth2Token)
      .withTransportStrategy(TransportStrategy.SMTP_OAUTH2)
      .buildMailer()
      .sendMail(email);

    Of course, the real challenge now is how are you going to get that OAuth2 token? That varies from platform to platform.

    🎉React with 🎉3Reacted by Rohan Nagar, CyChris and Redion Xhepa
12. bbottema

    closed this as completedon Jan 5, 2023
13. venkatesh-i2i commented on Jul 25, 2024

    

    venkatesh-i2i

    on Jul 25, 2024

    Last edited by venkatesh-i2i

    More actions

    Hi @bbottema i am trying to use the TransportStrategy.SMTP_OAUTH2
    i am gmail oauth and only the send scope is enabled

    i getting Exception saying
    Caused by: jakarta.mail.AuthenticationFailedException: 334 eyJzdGF0dXMiOiI0MDAiLCJzY2hlbWVzIjoiQmVhcmVyIiwic2NvcGUiOiJodHRwczovL21haWwuZ29vZ2xlLmNvbS8ifQ==
    ;
    nested exception is:
    jakarta.mail.AuthenticationFailedException: OAUTH2 asked for more
    Could you help if possible
14. bbottema commented on Aug 26, 2026

    

    bbottema

    on Aug 26, 2026

    Owner

    More actions

    Current 9.x usage for a long-lived mailer (verified against 9.3.2):

    OAuth2AccessTokenProvider accessTokens = tokenService::currentAccessToken;
    
    Mailer mailer = MailerBuilder
        .withSMTPServer("smtp.example.com", 587, "user@example.com")
        .withTransportStrategy(TransportStrategy.SMTP_OAUTH2)
        .withOAuth2AccessTokenProvider(accessTokens)
        .buildMailer();

    Since 9.2, the refresh-aware provider is preferred for long-lived mailers because it is consulted before a physical SMTP connection is opened or reopened. Passing a fixed token as the SMTP password remains valid for a short-lived mailer. See the 9.2.0 release notes and current OAuth2 documentation.