bug#72358: 29.4; oauth2.el improvements

["Björn Bidar via Bug reports for GNU Emacs, the Swiss army knife of text editors" <bug-gnu-emacs@gnu.org>]

Xiyue Deng <manphiz@gmail.com> writes:

> Björn Bidar <bjorn.bidar@thaodan.de> writes:
>
>> Robert Pluim <rpluim@gmail.com> writes:
>>
>>>     Xiyue> - This will invalidate all existing entries and a user will have to redo
>>>     Xiyue>   the authorization process again to get a new refresh token.  However,
>>>     Xiyue>   I think it's more important to ensure that oauth2.el works correctly
>>>     Xiyue>   for multiple accounts of the same provider, or a user may suffer from
>>>     Xiyue>   confusion when adding a new account invalidates a previous account.
>>>
>>> I donʼt think thatʼs too big a concern. 'modern' authentication flows
>>> regularly re-prompt, so this will not be too surprising (although
>>> maybe call it out in the packageʼs NEWS or README).
>>
>> In many cases the refreshing of tokens is transparent to the user there
>> doesn't have to be a re-prompt to refresh the token if the OAuth
>> provider support it.
>> Micrsofts OAuth workflow is quite good in this regard as there's a
>> non-standard error to indicate when the user has to re-authorize the
>> application.
>>
>
> Actually I am currently having trouble for a few weeks to get my
> outlook.com email work with MS OAuth2.  To avoid some repeated typing, I
> have documented the issues and steps I have tried in this stackoverflow
> question[1].  I would great appreciated it if you can shed some lights
> there
>

I remember when adding OAuth support to Sailfish OS we needed to patch
our signon to work with the non-standard Microsoft flow.

We have this patch on top of the OAuth2 plugin for signond to accept
that they send the authentication as a request for you to fetch upon you
have to another request with the new url to get authentication code.

The patch can be found here:
https://github.com/sailfishos/signon-plugin-oauth2/blob/master/rpm/0005-Support-Microsoft-OAuth2-flow.patch

I'm not the person who wrote the patch but I fixed the plugin later for
Dropbox so that PKCE (RFC7636) isn't used unless the server requests it
(response type must be code to request PKCE).

PKCE is strongly recommended. The patch above already works kinda that
way without requesting PKCE.

Read here for further information:
https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-auth-code-flow
https://datatracker.ietf.org/doc/html/rfc7636