SMTP Oauth2 configuration

[Norsagir]

Hi everyone !

I have some problem with my SMTP configuration.
Since the end of september, Microsoft deactivated basic authentication (on only my account?).
For now, I can't log in Vaultwarden anymore because it cannot send a notification email.

So I tried to configure Oauth2 method :

"smtp_host": "smtp-mail.outlook.com",
"smtp_security": "starttls",
"smtp_port": 587,
"smtp_from": "XXXXXXX@outlook.com",
"smtp_from_name": "Vaultwarden",
"smtp_username": "XXXXXXX@outlook.com",
"smtp_password": "YYYYYYYYYY",
"smtp_auth_mechanism": "xoauth2",
"smtp_timeout": 15,

Now I have this error from Outlook servers :

SMTP 5xx error: permanent error (535): 5.7.3 Authentication unsuccessful [SI1PR02CA0052.apcprd02.prod.outlook.com 2024-10-09T10:58:39.926Z 08DCE7803723BAE8] - Authentication credentials invalid

I tried using both my real password and my "app key" password, the one Microsoft lets you configure to send mails on some devices.

Logs of smtp_debug :

12:58:40.003[response][INFO] (test_smtp) POST /admin/test/smtp => 400 Bad Request
12:58:40.002[vaultwarden::mail][ERROR] SMTP 5xx error: permanent error (535): 5.7.3 Authentication unsuccessful [SI1PR02CA0052.apcprd02.prod.outlook.com 2024-10-09T10:58:39.926Z 08DCE7803723BAE8] - Authentication credentials invalid
12:58:40.002[DEBUG] << 535 5.7.3 Authentication unsuccessful [SI1PR02CA0052.apcprd02.prod.outlook.com 2024-10-09T10:58:39.926Z 08DCE7803723BAE8]<CRLF>
12:58:32.493[DEBUG] Wrote: AUTH XOAUTH2 dXNlcj1uYXMtdmF1dHJpbkBvdXRsb29rLmNvbQFhdXRoPUJlYXJlciBseHpxZWdhanNzc21ybWljAQE=<CRLF>
12:58:32.493[DEBUG] << 250-SI1PR02CA0052.outlook.office365.com Hello [MYIPADDRESS]<CRLF>250-SIZE 157286400<CRLF>250-PIPELINING<CRLF>250-DSN<CRLF>250-ENHANCEDSTATUSCODES<CRLF>250-AUTH LOGIN XOAUTH2<CRLF>250-8BITMIME<CRLF>250-BINARYMIME<CRLF>250-CHUNKING<CRLF>250 SMTPUTF8<CRLF>
12:58:32.493[DEBUG] << 250-SI1PR02CA0052.outlook.office365.com Hello [MYIPADDRESS]<CRLF>250-SIZE 157286400<CRLF>250-PIPELINING<CRLF>250-DSN<CRLF>250-ENHANCEDSTATUSCODES<CRLF>250-AUTH LOGIN XOAUTH2<CRLF>250-8BITMIME<CRLF>250-BINARYMIME<CRLF>250-CHUNKING<CRLF>
12:58:32.493[DEBUG] << 250-SI1PR02CA0052.outlook.office365.com Hello [MYIPADDRESS]<CRLF>250-SIZE 157286400<CRLF>250-PIPELINING<CRLF>250-DSN<CRLF>250-ENHANCEDSTATUSCODES<CRLF>250-AUTH LOGIN XOAUTH2<CRLF>250-8BITMIME<CRLF>250-BINARYMIME<CRLF>
12:58:32.493[DEBUG] << 250-SI1PR02CA0052.outlook.office365.com Hello [MYIPADDRESS]<CRLF>250-SIZE 157286400<CRLF>250-PIPELINING<CRLF>250-DSN<CRLF>250-ENHANCEDSTATUSCODES<CRLF>250-AUTH LOGIN XOAUTH2<CRLF>250-8BITMIME<CRLF>
12:58:32.493[DEBUG] << 250-SI1PR02CA0052.outlook.office365.com Hello [MYIPADDRESS]<CRLF>250-SIZE 157286400<CRLF>250-PIPELINING<CRLF>250-DSN<CRLF>250-ENHANCEDSTATUSCODES<CRLF>250-AUTH LOGIN XOAUTH2<CRLF>
12:58:32.493[DEBUG] << 250-SI1PR02CA0052.outlook.office365.com Hello [MYIPADDRESS]<CRLF>250-SIZE 157286400<CRLF>250-PIPELINING<CRLF>250-DSN<CRLF>250-ENHANCEDSTATUSCODES<CRLF>
12:58:32.493[DEBUG] << 250-SI1PR02CA0052.outlook.office365.com Hello [MYIPADDRESS]<CRLF>250-SIZE 157286400<CRLF>250-PIPELINING<CRLF>250-DSN<CRLF>
12:58:32.493[DEBUG] << 250-SI1PR02CA0052.outlook.office365.com Hello [MYIPADDRESS]<CRLF>250-SIZE 157286400<CRLF>250-PIPELINING<CRLF>
12:58:32.493[DEBUG] << 250-SI1PR02CA0052.outlook.office365.com Hello [MYIPADDRESS]<CRLF>250-SIZE 157286400<CRLF>
12:58:32.493[DEBUG] << 250-SI1PR02CA0052.outlook.office365.com Hello [MYIPADDRESS]<CRLF>
12:58:32.188[DEBUG] Wrote: EHLO Vaultwarden<CRLF>
12:58:32.188[DEBUG] connection encrypted
12:58:31.870[DEBUG] << 220 2.0.0 SMTP server ready<CRLF>
12:58:31.717[DEBUG] Wrote: STARTTLS<CRLF>
12:58:31.717[DEBUG] server SI1PR02CA0052.outlook.office365.com with {StartTls, EightBitMime, SmtpUtfEight}
12:58:31.717[DEBUG] << 250-SI1PR02CA0052.outlook.office365.com Hello [MYIPADDRESS]<CRLF>250-SIZE 157286400<CRLF>250-PIPELINING<CRLF>250-DSN<CRLF>250-ENHANCEDSTATUSCODES<CRLF>250-STARTTLS<CRLF>250-8BITMIME<CRLF>250-BINARYMIME<CRLF>250-CHUNKING<CRLF>250 SMTPUTF8<CRLF>
12:58:31.717[DEBUG] << 250-SI1PR02CA0052.outlook.office365.com Hello [MYIPADDRESS]<CRLF>250-SIZE 157286400<CRLF>250-PIPELINING<CRLF>250-DSN<CRLF>250-ENHANCEDSTATUSCODES<CRLF>250-STARTTLS<CRLF>250-8BITMIME<CRLF>250-BINARYMIME<CRLF>250-CHUNKING<CRLF>
12:58:31.717[DEBUG] << 250-SI1PR02CA0052.outlook.office365.com Hello [MYIPADDRESS]<CRLF>250-SIZE 157286400<CRLF>250-PIPELINING<CRLF>250-DSN<CRLF>250-ENHANCEDSTATUSCODES<CRLF>250-STARTTLS<CRLF>250-8BITMIME<CRLF>250-BINARYMIME<CRLF>
12:58:31.717[DEBUG] << 250-SI1PR02CA0052.outlook.office365.com Hello [MYIPADDRESS]<CRLF>250-SIZE 157286400<CRLF>250-PIPELINING<CRLF>250-DSN<CRLF>250-ENHANCEDSTATUSCODES<CRLF>250-STARTTLS<CRLF>250-8BITMIME<CRLF>
12:58:31.717[DEBUG] << 250-SI1PR02CA0052.outlook.office365.com Hello [MYIPADDRESS]<CRLF>250-SIZE 157286400<CRLF>250-PIPELINING<CRLF>250-DSN<CRLF>250-ENHANCEDSTATUSCODES<CRLF>250-STARTTLS<CRLF>
12:58:31.717[DEBUG] << 250-SI1PR02CA0052.outlook.office365.com Hello [MYIPADDRESS]<CRLF>250-SIZE 157286400<CRLF>250-PIPELINING<CRLF>250-DSN<CRLF>250-ENHANCEDSTATUSCODES<CRLF>
12:58:31.717[DEBUG] << 250-SI1PR02CA0052.outlook.office365.com Hello [MYIPADDRESS]<CRLF>250-SIZE 157286400<CRLF>250-PIPELINING<CRLF>250-DSN<CRLF>
12:58:31.717[DEBUG] << 250-SI1PR02CA0052.outlook.office365.com Hello [MYIPADDRESS]<CRLF>250-SIZE 157286400<CRLF>250-PIPELINING<CRLF>
12:58:31.717[DEBUG] << 250-SI1PR02CA0052.outlook.office365.com Hello [MYIPADDRESS]<CRLF>250-SIZE 157286400<CRLF>
12:58:31.717[DEBUG] << 250-SI1PR02CA0052.outlook.office365.com Hello [MYIPADDRESS]<CRLF>
12:58:31.564[DEBUG] Wrote: EHLO Vaultwarden<CRLF>
12:58:31.564[DEBUG] << 220 SI1PR02CA0052.outlook.office365.com Microsoft ESMTP MAIL Service ready at Wed, 9 Oct 2024 10:58:30 +0000 [08DCE7803723BAE8]<CRLF> 

Can someone help me please ?

[stefan0xC]

We don't support OAuth2 (yet). So you might want to use something like email-oauth2-proxy.

[Norsagir]

I'm not a developer so I won't be able to do a PR...
Can I write an "enhancement" issue just to log this problem for all the people using Microsoft email ?

[BlackDex]

That is not where issues are for.
Maybe update the wiki, which would be a much better place to show/tell how to configure it.

[Norsagir]

That's not what I meant.
I meant to ask for help trying to implement OAuth2 in Vaultwarden, asking for an enhancement.
As emails via Microsoft was working perfectly fine since many years and now it does not work anymore, I think Vaultwarden needs an enhancement.
Again, I'm not a developer, so I'm looking for someone in the community who is capable of helping Microsoft users (as I think we are many users here).

[BlackDex]

I have added it to #246

[Norsagir]

Thanks.

[yang05051]

We don't support OAuth2 (yet). So you might want to use something like email-oauth2-proxy.

email-oauth2-proxy is quite helpful, thank you.