Add IMAP Support for Microsoft Office 365

[arcade45]

I'm trying to log in into an exchange online imap mailbox with this command:

./dmarc-report-viewer --imap-host outlook.office365.com --imap-user user@randomdomain.com --imap-password randompwd --http-server-user randomhttpuser --http-server-password randomhttppwd --log-level trace

And I'm getting this error:

DEBUG Got 52.98.248.210:993 as as socket address for IMAP endpoint outlook.office365.com:993
DEBUG Created TCP stream
DEBUG Created async TCP stream
DEBUG Directly creating TLS stream...
DEBUG Created Root CA cert store
DEBUG Created TLS client config
DEBUG Created TLS connector
DEBUG Got DNS name: DnsName("outlook.office365.com")
DEBUG Created TLS stream
DEBUG Created IMAP client
ERROR Failed background update: Failed to get mails: Failed to log in and create IMAP session: no response: code: None, info: Some("LOGIN failed.")

I've verified that credentials are correct and that IMAP is enabled for this mailbox.

Any hints?

[nikilase]

I think this is an issue with MS365 and how they deprecated the Basic Auth feature?
I also ran into this wall and could not get any Microsoft imap account to work with this.

If I am not mistaken, the only solution here would be to implement the OAUTH2 Authentication in this project.
For example parsedmarc implemented this back in 2022 domainaware/parsedmarc#301

Actually, I was just about to write a feature request for this.

[cry-inc]

Did you by any chance test the same account with another IMAP client that also just uses username & password? If it works, we have probably a simple issue in the IMAP login code.

If it also fails I guess @nikilase is right and this is more work...

This MS page here talks about OAuth, but the parsedmarc issue mentions some MS Graph API.

The Rust IMAP libary I use seems to support OAuth (see example here), but thats only the last part of the puzzle... We first need to get a valid token from MS.

I do not have an O365 account and any help with this would be greatly appreciated. A standalone small Rust example app that shows how to do this with the async-imap library would be perfect, I can take care of the rest and integrate it.

[nikilase]

I just now tested with a simple python script and an MS365 email account from work like following:

import imaplib

M = imaplib.IMAP4_SSL(host='outlook.office365.com')
M.login('username', 'password')
M.select()
typ, data = M.search(None, 'ALL')
print(len(data[0]))
M.close()
M.logout()

Which failed with a similar error message on the login:
imaplib.IMAP4.error: b'LOGIN failed.'

It worked with my selfhosted email account,
Also worked fine with a Gmail Account using an app password.
And predictibly also did not work with my free private @outlook.de mail account.

Sadly I do not have much time both at work or at home to learn rust and add this feature myself in the forseeable future :/
But on the bright side, I am happy to use this for my own mailserver without any problems, and might just use a gmail account as a stopgap solution for that.

Maybe later in the year I could invest some time to finally learn rust and implement this, but no promises.

[nikilase]

Btw, I do not completely understand the whole OAUTH2 flow for MS365 yet, but from what I understand it might be required to get an access token for the application (i.e. the imap client) using MS Graph API, and then with this token the imap client can login using the token and user credentials? Or create a bearer token for the actual login?

[timnis]

What I have understand you need token and need to use MS Graph API like @nikilase wrote. So basically you need create user to Entra and give it permission to read certain mailbox.

[luismsousa]

Has anyone been able to get this to work?

[RadYio]

should be appreciate. @cry-inc Do you want to support new auth system ?

[cry-inc]

Depends on how much code/dependencies this new auth system would need. But yes, in general I am interested.