Re: oauth2 support for Emacs email clients

[Tim Cross]

Eric S Fraga <e.fraga@ucl.ac.uk> writes:

> On Tuesday,  3 Aug 2021 at 00:00, Roland Winkler wrote:
>> I am asking because my institution uses MS Outlook.  Recently, they
>> have disabled simple password-based authentication in favor of
>> oauth2.  Now, using oauth2.el from GNU Elpa, I have got the basics
>> (authentication and authorization) working.  This required some ugly
>> configuration within MS Azure.  But I am still some distance away
>> from a smooth workflow, say, using Gnus.  
>
> My institution did the same.  I use gnus.  The easiest solution, in the
> end, for me was to install and run davmail to get my emails from the
> institution.  I then use pop (could have used imap but I prefer pop in
> any case) to get email from "localhost" running davmail.  Davmail takes
> care of multi-factor authentication for me.

Eric, what do you do for sending mail? As I understand it, oauth2 will
be required for authentication for smtp as well. While I know davmail
will get the messages, does it also send/relay them to the gmail smtp
server?

I also wonder if the 'ban' on putting credentials into the source
(public) is that 'clear cut'. From what I've read, the 'applicaiton
key', was never supposed to be secret - this was apparently an oversight
in the initial oauth specs - obviously other parts of the credentials
do need to be secret. (I do wonder if you can actually get the
application key from registered apps by just running 'strings' over the
binaries!). Of course, the chance of getting a decision from the right
person at either google or MS is next to zero, so I guess we are stuck. 

I guess in the end, all we can really do is try to find a way of
streamlining the process to get a developer key for each user as this
seems to be the main barrier to a more straight-forward setup. I have
had to jump through those hoops with other oauth2 systems which have an
emacs client. The good news is that once you have that key, the
oauth2.el library seems to take care of renewal of session tokens, so
once setup, things should just work.