Emailing using Microsoft Office 365 account

nhofkes

Build Number	Database	OS
2530	MariaDB 12	Windows Server 2016

Has anyone managed to send emails from the Aware appplication using an Office365 email account?

This requires OAuth authentication, but I can’t get the settings correctly. I registered my application in Microsoft Entra and granted it permissions to send emails on behalf of the email account owner (i.e. myself) using SMTP. In this case, I understand from the Microsoft documentation that no authorization request needs to be made, the application can directly proceed to request an access token. And indeed, when I make the request using curl, the Microsoft server promptly returns the access token.

However, it seems that the OAuth settings for the email channel can’t be configured to skip the authorization step and just request an access token. I think that in the settings the Grant type would be “Client Credentials”, which indeed removes the authorization url, but when I try to save the settings by clicking the “OK” button, I get an error: “Please specify authorization URL”. This makes no sense, as the authorization URL is not needed for this OAuth flow and it can’t even be specified because the field is disabled when using “Client Credentials”. See screenshot below (I highlighted the relevant fields and the error message).

I also asked the same question to AI (Claude), which gave the following answer:

This looks like a UI validation bug in AwareIM’s configurator — the “Client Credentials” grant type correctly disables the AUTHOR_URL field (since the flow doesn’t use it), but the save validation still requires it. That’s an AwareIM bug.

@aware_support3 I’d be happy to hear your views.

aware_support3

nhofkes hmm, could you try with a dummy URL in the authorisation url and let us know the result please

nhofkes

aware_support3 I tried many URLs for the authorisation URL, but all of them get called by the server when it tries to obtain the authorization. And when I put in any URL in the authorisation URL and then switch from grant type authorisation to client credentials, the authorization URL is deleted and I get the same erorr message.

nhofkes

An addition to my earlier post.
As was probably clear from the screenshot, I tried to set the OAuth settings ‘non-dynamic’ in the configurator, i.e. open the BS version, select ‘Outgoing emails’ from the Properties pane, tick ‘OAuth support’ and then ‘Settings’.

As an alternative, I looked at the possibility to define the settings in the SystemSettings object. After choosing the option “Use values from SystemSettings object”, I ticked “Add attributes for OAuth support to the SystemSettings object”. This resulted in a lot of “OA_” attributes in the SystemSettings, but I do not see any attribute that controls the grant type (OAuth flow), being Authorization Code or Client Credentials, so it seems that only the Authorization Code flow will be used and it is not possible to use the Client Credentials instead.

Also, when using the SystemSettings I don’t see a way to control whether the email channel uses the OAuth at all. It seems that once the relevant OAuth attributes are added to the SystemSettings, Aware assumes that OAuth must be used and there is no way to tell it to ignore those settings and to send an email without OAuth flow. Also, I could not delete any of those OA_ attributes in SystemSettings (results in an error “Deletion of this attribute is not allowed”), even though those SystemSettings attributes were not used for the outgoing email and not even after I removed all email communication for all objects in the business space.

All in all, it seems that there is still some work to do to support OAuth communication for outgoing emails. I hope that this can be fixed because OAuth is becoming increasingly used or required for cloud services.

Jaymer

i send daily emails thru
https://outlook.office365.com/mail/

but i never messed with oAuth for this

nhofkes

Thanks Jaymer, I’ll give that a try. From the description here, I had the impression that using SMTP without authentication using OAuth was no longer possible, but perhaps that is a misunderstanding. If so, it’s likely that it will be disabled at some time in the future, given the security risk.

BTW, the page referred to above describes SMTP with OAuth as a “Legacy protocol”. It seems that Microsoft wants people to move over to the Microsoft Graph API. See the reference for the sendMail endpoint, with code examples in Java. There are also Java code libraries that support the client credentials authorization flow, so hopefully it isn’t too complex to include this in a future update of AwareIM.

nhofkes

I have meanwhile tried to send the email through Microsoft 365 without the OAuth. Unfortunately, this results in an authentication error:

Authentication unsuccessful, user is locked by your organization’s security defaults policy. Contact your administrator.

Since I am the administrator, I tried to change my security defaults policy, but it seems that this is not possible for my Microsoft 365 Business Basic subscription. From what I understand, it might be possible with a higher plan (from Microsoft 365 Business Premium), but that’s about 4 times more expensive and I am not sure whether I want to spend that only to reduce (rather than increase) the security for my account.

aware_support3

nhofkes this looks like a bug. We are working on it

nhofkes

aware_support3 Thanks. I meanwhile discovered that the bug in the interface for the REST settings is not only for the email OAuth settings, but it also applies to the settings for the REST communication channel generally. Presumably it is the same code/module.

nhofkes

It seems that Microsoft Graph is planned to be implemented. The current documentation has the following information on the page about Sending Outgoing E-mails:

Sending Emails Using Microsoft Graph
Using Microsoft Graph for sending emails does not mean that you have to replace SEND actions with REST service calls. The framework for email handling remains the same - whether you use SMPT or MS Graph. To send emails using Microsoft Graph you need to obtain your client id and secret from Microsoft, as well as tenant id and sender info. For details go to https://learn.microsoft.com/en-us/graph/api/user-sendmail. You then need to tick the “Emails will be sent using Microsoft Graph checkbox and click on the Settings link next to the checkbox. Then you need to enter values obtained from Microsoft.

In my version of the configurator (v10 build 3534) I don’t see the checkbox ““Emails will be sent using Microsoft Graph”. Hopefully this functionality will be added in a next release version?

Jaymer

nhofkes the way I read that, that’s not a checkbox in aware, but on the Microsoft side.

nhofkes

The preceding link to the Microsoft website may seem to suggest that, but I don’t think that this is intended - to send emails using Microsoft Graph, Aware must somehow be configured to use Microsoft Graph because the protocol is very different from regular IMAP and SMTP. The relevant settings must be made entered in Aware.