Microsoft is deprecating basic auth

[cef-informatique]

Hi,

Microsoft is deprecating basic authentication for its 365 services starting October 1st. Basic auth will still be usable in last resort until December 31st 2022.

Does vaultwarden have any plans to add oauth2 for smtp ?

[BlackDex]

Vaultwarden already supports XOAUTH2, not sure if that is the same. That is what Google uses, if Microsoft is using the same RFC for this, then it should work (A quick search seems that it is).

I only have no clue or way on how to get this to work.
You need to somehow create a token for an application and use that token together with a username to login.
This is probably somewhere explained correctly by Microsoft on how to do this, so i would say to look it up, and try that.

[cef-informatique]

Getting this to work on Microsoft's side is not a problem. However, I wasn't aware Vaultwarden support oauth2. Any doc on how to use it on Vaultwarden's side ?

[BlackDex]

It will be as simple as setting SMTP_AUTH_MECHANISM to xoauth2

vaultwarden/.env.template

Lines 360 to 363 in 382e610

	## Defaults for SSL is "Plain" and "Login" and nothing for Non-SSL connections.
	## Possible values: ["Plain", "Login", "Xoauth2"].
	## Multiple options need to be separated by a comma ','.
	# SMTP_AUTH_MECHANISM="Plain"

And set the token as a SMTP_PASSWORD and of course the correct user name in SMTP_USERNAME.

vaultwarden/.env.template

Lines 356 to 357 in 382e610

	# SMTP_USERNAME=username
	# SMTP_PASSWORD=password

Also, if it is simple to get it to work on the Microsoft side, would be cool if you could set those steps in the wiki :).
https://github.com/dani-garcia/vaultwarden/wiki/SMTP-Configuration

[cef-informatique]

I think there needs to be a couple more variables for xoauth2 to work :

• SMTP_XOAUTH2_CLIENT_ID : the client ID of the app on Microsoft/Google's side.
• SMTP_XOAUTH2_CLIENT_SECRET : same as above except it's the secret/password for the app.
• SMTP_XOAUTH2_TOKEN_ENDPOINT: the URL vaultwarden has to use to validate the credentials (for instance : https://login.microsoftonline.com/consumers/oauth2/v2.0/token for Microsoft)
• SMTP_XOAUTH2_TENANT_ID : this is specific to Microsoft but is needed in the case the admin wants to restrict access only to accounts of his organization.

[BlackDex]

Then I'm afraid we can't support that from a Vaultwarden side right now.
We use a mail library https://github.com/lettre/lettre which seems to support XOauth2 by a simple username/password, which seems to be correct according to the RFC.

Also, if i check my Thunderbird SMTP connection with xoauth2 auth, then i only see the token and my username. So, not sure what more is needed. All the other data i do not see.

So, if we need to do something more on the Vaultwarden side, we would need to have some documentation on how to get this working.