OAUTH2 support

[rampaq]

Hi, as my university microsoft mail transfered to OAUTH2 without option to fallback, I modified my client config.

I enclose a pull request to support OAUTH2 mail solutions which should work with Microsoft and Google.
An example on how to create the token file is in manpage and requires ClientID and ClientSecret app registration.

My university does not support custom app registration so I used Mozilla Thunderbird's credentials ones here. Code to generate the token with microsoft:

$ /usr/share/neomutt/oauth2/mutt_oauth2.py -v -t \
    --authorize --client-id "9e5f94bc-e8a4-4e73-b8be-63364c29d753" --client-secret "" \
    --email "<your email>" --provider microsoft \
    --encryption-pipe "gpg --encrypt --recipient <your_gpg_key>" \
    token_path

[rampaq]

It also should not be too hard to incorporate the mutt_oauth2.py script directly into mw

[ayushjaipuriyar]

Is this still not possible ? Cause without oauth there seems to be no point in using neomutt

[pahlse]

As to your question if mutt-wizard does this for you: NO!

But you can always do it yourself. If you have access to your client secret on Azure it shouldn't be a problem. Just follow the mutt_oauth2.py or similar configuration instructions.

If you don't have access to the client secret (which is the case with many corporate or university microsoft accounts) you will have to set up a davmail server on a vps or similar. This is fairly straight forward, just needs a bit more effort. See thread #601 for more details. In the last comment I describe my setup. Works flawlessly for me.

[ayushjaipuriyar]

As to your question if mutt-wizard does this for you: NO!

But you can always do it yourself. If you have access to your client secret on Azure it shouldn't be a problem. Just follow the mutt_oauth2.py or similar configuration instructions.

If you don't have access to the client secret (which is the case with many corporate or university microsoft accounts) you will have to set up a davmail server on a vps or similar. This is fairly straight forward, just needs a bit more effort. See thread #601 for more details. In the last comment I describe my setup. Works flawlessly for me.

Okay got it, will try to replicate your setup

[aabbccddeeffggj]

Recently, I got blocked from sending emails from my main email account (I can receive the emails just fine at least):

msmtp: authentication failed (method LOGIN)
msmtp: server message: 535 5.7.139 Authentication unsuccessful, account locked.
Contact your administrator. [CP5P284CA0025.BRAP284.PROD.OUTLOOK.COM
2024-04-17T16:43:08.320Z 08DC5E4AE6FF6F00]
msmtp: could not send mail (account xxx@hotmail.com from /home/xxx/.msmtprc)

I updated the application password and sent an email to test, it worked, but then the next day my account turns out to be blocked again (I did it twice).

I have another email address and I can send emails from that without a problem (both are hotmail).

I wonder if it's Microsoft slowly implementing the OAuth2 and I'm one of the lucky ones whose account got surprised by it. Do you think that's the case?

[dominicbraam]

Hi, I'm also using the mutt_oauth2.py script and it works okay. However, I'd really like to have everything in one place. Is there an update on the pull request to add the support? Or is it already available by some other way and I'm unaware?

[rampaq]

Hi, check out PR #955. If you’re on Arch, just install the cyrus ssl dependency and you’re good to go. The PR isn’t yet merged as the dependency requires manual compilation on a lot of distros, apparently, so you need to use my fork. Feel free to share your thoughts

[dominicbraam]

It works! I had to make a slight change for the PassCmd in the .mbsyncrc after everything was generated. For the token, I had to put the full path.

[Oxbian]

Hey, for anyone interested, you can also use your keyring to store your token instead of a GPG encrypted file.

/usr/share/neomutt/oauth2/mutt_oauth2.py -v -t \
    --authorize --client-id "9e5f94bc-e8a4-4e73-b8be-63364c29d753" --client-secret " " \
    --email "<your email>" --provider microsoft \
    --encryption-pipe 'secret-tool store --label="Outlook Oauth" email "<your email>"' \
    --decryption-pipe 'secret-tool lookup email "<your email>"' \
    token_path

The token_path file can be anything, it just needs to be chmod 600.

For anyone struggling with Oauth2 flow, try devicecode. From my test, it's the only one that worked.