Re: gmail+imap+smtp (oauth2)

[Thomas Fitzsimmons <fitzsim@fitzsim.org>]

Hi Jorge,

"Jorge A. Alfaro-Murillo" <jorge@democraciareal.org> writes:

> On Thu, May 05 2022, Filipp Gunbin wrote:
>
>> Just FTR, with Outlook from Office365 (we had that at work), it is
>> just that - you create an app password in web interface (yes,
>> non-free JS), and then just put it in authinfo instead of your
>> "account password".
>
> Just to let you know that (sadly) we have Office365 at my institution
> but that they do not allow app passwords. It is something that IT has
> to allow from the Office 365 Admin Center. When I called them about
> it, they told me that they were only supporting email clients that had
> 2-factor authentication.
>
> I haven't been able to use gnus with my work email (@yale.edu) since
> then. I wonder if the same is true for other institutions that use
> Google Workspace.
>
> FYI, two free open-source email projects thunderbird (MPL-2.0) and
> fairmail (GPL3) work with 2-factor authentication. Is there anyway to
> use their method of authentication in gnus?

In my case I had to request that my Microsoft Office 365 administrators
leave IMAP and SMTP enabled.  Apparently each of these protocols can be
enabled or disabled for individual users, groups, etc., or
organization-wide.  (This is another variable that frustrates the
writing of a generic set of instructions for "Using Emacs with MSO365".)
This setting is orthogonal to whether Microsoft-Office-365-OAuth-2.0 is
required for each of the protocols, as far as I can tell.

Assuming you can have your administrators enable IMAP and SMTP for your
accounts, and assuming that application passwords are not enabled, using
Gnus for email is still achievable in my experience.

Ideally I would like to use the Emacs IMAP and SMTP implementations,
with the oauth2 package from GNU ELPA.  However, I haven't got there
yet.  I haven't yet tackled whether oauth2.el supports
Microsoft-Office-365's-take-on-OAuth-2.0-as-configured-by-my-organization
(there should probably be a standard for naming OAuth 2.0 implementation
and configuration variants; you know, to limit confusion).

However, an interim solution I've landed on is to use Gnus's nnmaildir
backend for reading a local archive of my IMAP emails, smtpmail for
SMTP, and mbsync for synchronizing between the IMAP server and the local
archive.

Microsoft-Office-365-OAuth-2.0 is handled by a script, oauth2ms, which
smtpmail and mbsync call out to:

    https://github.com/harishkrupo/oauth2ms

Besides providing the script, the oauth2ms repository has thorough
documentation that explains all the Emacs-vs-MSO365 considerations
better than any other resource I've seen.

Thomas