Skip to content

[Mailer] Support OAuth2 #48888

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
nguyenk opened this issue Jan 5, 2023 · 24 comments
Open

[Mailer] Support OAuth2 #48888

nguyenk opened this issue Jan 5, 2023 · 24 comments

Comments

@nguyenk
Copy link

nguyenk commented Jan 5, 2023

Description

I'm submitting this issue related to #35528 (closed)

Starting from the 1st January 2023, Microsoft permanently disabled basic auth for sending emails, and it seems app password will not help anymore. Microsoft's recomendations are :

  • Modify app to use modern auth, hence implement Oauth 2 support
  • Migrate app to use Graph API and modern auth

Knowing that, may be it make more sense now to consider supporting oauth token - handling - renewing inside a dedicated mailer component ?

Example

No response

@carsonbot
Copy link

Thank you for this suggestion.
There has not been a lot of activity here for a while. Would you still like to see this feature?

@Purek
Copy link

Purek commented Jul 20, 2023

Hi,Do you have a support plan?

@carsonbot carsonbot removed the Stalled label Jul 20, 2023
@xabbuh
Copy link
Member

xabbuh commented Sep 4, 2023

Someone (could be you) would have to work on a pull request.

@Gorkyman
Copy link

Any progress on this one maybe?

@nguyenk
Copy link
Author

nguyenk commented Oct 23, 2023

Hello @Gorkyman @Purek.

Actually, I ended up switching to the Microsoft Graph API for sending emails.

Basically I had to :

  • Implement a MicrosoftOAuthMailTransport (TransportInterface that has the 'send' logic)
  • Register it using a MicrosoftOAuthMailTransportFactory (AbstractTransportFactory)
  • at the end, I can have a quite standard MAILER_DSN: microsoft://client_api:client_secret@login.microsoftonline.com?tenant=tenant_id&graph=https://graph.microsoft.com

If you think it's worse a package, please tell my, I might find some time to do it. Else ping me if you want me to share the code in a gist.

Cheers!

@limenet
Copy link

limenet commented Oct 30, 2023

Hi @nguyenk, thanks for offering to share your code! Could you please create a Gist with it? That would be very helpful :)

@nguyenk
Copy link
Author

nguyenk commented Nov 1, 2023

Hello @limenet here you go ! https://gist.github.com/nguyenk/15dd504dbcf7322807cb8f93371937d7

Any issue please ask

@xabbuh If you think it's worth a PR, I'll be happy to contribute. I think the more logical would be creating a new 3rd party transport : composer require symfony/microsoft-graph-mailer

@xabbuh
Copy link
Member

xabbuh commented Nov 7, 2023

@ngyuenk please do so

@carsonbot
Copy link

Thank you for this suggestion.
There has not been a lot of activity here for a while. Would you still like to see this feature?

@nguyenk
Copy link
Author

nguyenk commented May 12, 2024

@carsonbot sure ! I'm almost done with my PR #52546

@carsonbot carsonbot removed the Stalled label May 12, 2024
@carsonbot
Copy link

Thank you for this suggestion.
There has not been a lot of activity here for a while. Would you still like to see this feature?
Every feature is developed by the community.
Perhaps someone would like to try?
You can read how to contribute to get started.

@carsonbot
Copy link

Friendly ping? Should this still be open? I will close if I don't hear anything.

@akaDJon
Copy link

akaDJon commented Nov 27, 2024

Friendly ping? Should this still be open? I will close if I don't hear anything.

This functionality is needed. We are waiting for it. What if SMTP Auth stops working on Google?

@carsonbot carsonbot removed the Stalled label Nov 27, 2024
@xabbuh
Copy link
Member

xabbuh commented Nov 27, 2024

There is an open PR that looks stalled. Help welcome if you need this feature.

@akaDJon
Copy link

akaDJon commented Apr 11, 2025

Gmail stopped SMTP auth by login/password. It's catastrophic ((

@sophie-la-li
Copy link

This is a real blocker.

@nguyenk
Copy link
Author

nguyenk commented Apr 25, 2025

Hello everyone, for now I can only remind that you can implement your onw transport like in this gist: https://gist.github.com/nguyenk/15dd504dbcf7322807cb8f93371937d7

It's implemented over MS Graph API, but I think switching it to GMAIL could be quite similar.

@stof
Copy link
Member

stof commented Apr 25, 2025

@akaDJon @sophie-la-li if this is a blocker for you, maybe you could contribute. Mailer bridges are updated based on community contributions.

@nguyenk
Copy link
Author

nguyenk commented Apr 25, 2025

@akaDJon @sophie-la-li Please check discussion on PR (it's not far from being ready I think) : #52546

@ThomasTr
Copy link
Contributor

Gmail stopped SMTP auth by login/password. It's catastrophic ((

According to this article: https://support.google.com/a/answer/14114704?hl=en&src=supportwidget0&authuser=0
you can still use app passwords.

@DanCocoDotCom
Copy link

Gmail stopped SMTP auth by login/password. It's catastrophic ((

According to this article: https://support.google.com/a/answer/14114704?hl=en&src=supportwidget0&authuser=0 you can still use app passwords.

For anyone using Google Workspace accounts, that feature was killed off by Google as of May 1st, 2025:

Starting May 1, 2025, Google Workspace accounts no longer support less secure apps, third-party apps, or devices that ask you to sign in to your Google Account with your username and password. You must use OAuth to let these apps and devices access your account. Third-party email apps that are no longer supported include Microsoft Outlook and the mail app on iOS and MacOS. For detailed instructions and information, visit Transition from less secure apps to OAuth. For the latest dates, visit Google Workspace Updates.

@sophie-la-li
Copy link

sophie-la-li commented May 8, 2025

Gmail stopped SMTP auth by login/password. It's catastrophic ((

According to this article: https://support.google.com/a/answer/14114704?hl=en&src=supportwidget0&authuser=0 you can still use app passwords.

For anyone using Google Workspace accounts, that feature was killed off by Google as of May 1st, 2025:

Starting May 1, 2025, Google Workspace accounts no longer support less secure apps, third-party apps, or devices that ask you to sign in to your Google Account with your username and password. You must use OAuth to let these apps and devices access your account. Third-party email apps that are no longer supported include Microsoft Outlook and the mail app on iOS and MacOS. For detailed instructions and information, visit Transition from less secure apps to OAuth. For the latest dates, visit Google Workspace Updates.

Can't confirm. On our end the app passwords are still working. Note that app passwords are not account passwords. You have to set up 2fa for the Google Account and retrieve a bespoke app password. ( https://support.google.com/accounts/answer/185833?sjid=1472586306713202151-EU )

@DanCocoDotCom
Copy link

DanCocoDotCom commented May 8, 2025

Gmail stopped SMTP auth by login/password. It's catastrophic ((

According to this article: https://support.google.com/a/answer/14114704?hl=en&src=supportwidget0&authuser=0 you can still use app passwords.

For anyone using Google Workspace accounts, that feature was killed off by Google as of May 1st, 2025:
Starting May 1, 2025, Google Workspace accounts no longer support less secure apps, third-party apps, or devices that ask you to sign in to your Google Account with your username and password. You must use OAuth to let these apps and devices access your account. Third-party email apps that are no longer supported include Microsoft Outlook and the mail app on iOS and MacOS. For detailed instructions and information, visit Transition from less secure apps to OAuth. For the latest dates, visit Google Workspace Updates.

Can't acknowledge. On our end the app passwords are still working. Note that app passwords are not account passwords. You have to set up 2fa for the Google Account and retrieve a bespoke app password. ( https://support.google.com/accounts/answer/185833?sjid=1472586306713202151-EU )

Google WORKSPACE accounts is where this no longer functions. It is their paid accounts. I did not test with the unpaid gmail service though a user above mentioned this affects them.

Here is the Google support article where this is quoted from. https://support.google.com/a/answer/176600?hl=en

I'm not at a computer to be able to grab screenshots/urls/exact error wording, but can update later if that would help. I did not find anything relevant in logs as i was using the test email function.

I attempted the steps anyways, turned on 2fa (the link to create an app password would not generate one without it enabled. I toggled it to be sure. 2fa off and app passwords were not an option. (Something like "this feature is not available for your account.") Turn it back on and I could set one again. Gives a 16 character password in 4 groups of 4.

I put the app password into my nextcloud email settings, and clicked to send test mail. It replied with email sent, but nothing was received. To check the password was input correctly, i took a character out, and it failed to authenticate when sending the test mail. Tried a few different times, toggled between SSL and None, 465 and 587, etc for good measure even after reading the "killed by google" notice in their support articles.

My solution may be to migrate my domain to a better email provider, but for those who don't have that ability, getting oauth working with email may be important.

@sophie-la-li
Copy link

sophie-la-li commented May 8, 2025

@DanCocoDotCom we are paying GSuite customers. It's still working here.

Still you are right with the conclusion that we should switch to OAuth whenever possible. App passwords are a workaround.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests