From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.io!.POSTED.blaine.gmane.org!not-for-mail From: David Engster Newsgroups: gmane.emacs.devel Subject: Re: oauth2 support for Emacs email clients Date: Sun, 08 Aug 2021 10:52:59 +0200 Message-ID: <87sfzk71xw.fsf@randomsample> References: <52589.36892.953561.24840@gargle.gargle.HOWL> <87pmuofpai.fsf@gnu.org> Mime-Version: 1.0 Content-Type: text/plain Injection-Info: ciao.gmane.io; posting-host="blaine.gmane.org:116.202.254.214"; logging-data="26371"; mail-complaints-to="usenet@ciao.gmane.io" User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/28.0.50 (gnu/linux) Cc: Richard Stallman , emacs-devel@gnu.org To: "Roland Winkler" Original-X-From: emacs-devel-bounces+ged-emacs-devel=m.gmane-mx.org@gnu.org Sun Aug 08 10:53:44 2021 Return-path: Envelope-to: ged-emacs-devel@m.gmane-mx.org Original-Received: from lists.gnu.org ([209.51.188.17]) by ciao.gmane.io with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1mCeYy-0006hK-Db for ged-emacs-devel@m.gmane-mx.org; Sun, 08 Aug 2021 10:53:44 +0200 Original-Received: from localhost ([::1]:57884 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1mCeYw-0006KE-Mt for ged-emacs-devel@m.gmane-mx.org; Sun, 08 Aug 2021 04:53:42 -0400 Original-Received: from eggs.gnu.org ([2001:470:142:3::10]:35904) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1mCeYQ-0005eS-VA for emacs-devel@gnu.org; Sun, 08 Aug 2021 04:53:10 -0400 Original-Received: from zplane.randomsample.de ([192.145.45.252]:57394) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1mCeYO-0007bd-UY; Sun, 08 Aug 2021 04:53:10 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=randomsample.de; s=a; h=Content-Type:MIME-Version:Message-ID:Date: References:In-Reply-To:Subject:Cc:To:From:Sender:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=vP9EH29Z/GCxdNbJqSiOAWykPFcnLvSTZXBl8zIEiZM=; b=Mr9A9RraZejbNk8KbT3m3OAHn B0V+2MyPVyJexIp7zbOOMtraKg82loPQ1P1UJmrgZiirih0lkTgWF95vdxs6rZAAjZ5WWxAin4X39 pTqX4LPu64BPEnDZUGnxnVcKTzzgAusF57lsGcKCqf15Fx8DdFwdAVMwglLN8wZM/NZLrhkHYgMCN +9LQRjv8k5b4CiS2MNkur0EiskiIZFOtkM2hhS7pdXbdLMyARz3R94899UutS4fcj6plZq2UhqO14 QO5obDI5K680tanNGnaJavRLllCMq+CdwOZRJs0WguUZ8eg9xs516kx174UZrv9wA+iCxiteS66b8 w9FLw0DoQ==; Original-Received: from ip5f5abab6.dynamic.kabel-deutschland.de ([95.90.186.182] helo=void) by zplane.randomsample.de with esmtpsa (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1mCeYG-0002t7-Dg; Sun, 08 Aug 2021 10:53:00 +0200 In-Reply-To: <87pmuofpai.fsf@gnu.org> (Roland Winkler's message of "Sun, 08 Aug 2021 01:01:25 -0500") Received-SPF: pass client-ip=192.145.45.252; envelope-from=deng@randomsample.de; helo=zplane.randomsample.de X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: emacs-devel@gnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: "Emacs development discussions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: emacs-devel-bounces+ged-emacs-devel=m.gmane-mx.org@gnu.org Original-Sender: "Emacs-devel" Xref: news.gmane.io gmane.emacs.devel:272196 Archived-At: > Others have mentioned "officially" registering Emacs as IMAP/SMTP > clients for Office365 (and possibly Gmail), similar to what seems > to be the case for Thunderbird. I am wondering how davmail is > doing this. Microsoft has actually recognized that it does not make sense for desktop applications to embed secrets into their code, so they distinguish between "public" and "confidential" client applications: https://docs.microsoft.com/en-us/azure/active-directory/develop/msal-client-applications Public client applications do not have a client secret but only an ID which can simply be embedded into the application, which is how DavMail does it. Public client applications are only allowed to access web APIs on behalf of the user, but this is usually enough. -David