oauth2ms VS cyrus-sasl-xoauth2

Funny, just dealt with the whole O365 authentication just this week. With moving to 2 factor authentication you need to use OAuth 2 to do anything with it. I have my (work) O365 email forwarded, so I do have normal IMAP access. I use isync/mbsync [1] to receive email, goimapnotify [2] to get pushed new email, read/reply/etc with mu4e [3] and org-msg [4] and org-mode, and until recently just plain SMTP to send mail. This last part will break with 2 factor, but found oauth2ms [5] to set up the OAuth to work with O365 SMTP. The trick was to find the "tenet ID" from the Azure page of your organization and to use Thunderbird's credentials [6] (or another mail program, since I can't make new app registrations on Azure to have my own "application"). That should also allow you to use IMAP with OAuth 2 as well, but haven't done that since I still have the forwarding. (As usual, I think the Arch Wiki [7] covers most of this too.)

[1] http://isync.sourceforge.net/

[2] https://gitlab.com/shackra/goimapnotify

[3] https://www.djcbsoftware.nl/code/mu/mu4e.html

[4] https://github.com/jeremy-compostella/org-msg

[5] https://github.com/harishkrupo/oauth2ms

[6] https://hg.mozilla.org/comm-central/file/tip/mailnews/base/s...

[7] https://wiki.archlinux.org/title/Isync#Using_XOAUTH2

I’ve been using this successfully for the last year: https://github.com/harishkrupo/oauth2ms

@harishkrupo has posted over on r/emacs and helpfully described in even more detail on github the steps to follow to get mbsync working with office365 and has written a python script that handles getting the token from the identity server and putting it into a format that mbsync can use. Crucially, he explains how to set up the azure app that the token is generated for. Really, this guide made a lot of things clear that I had been absolutely muddling through previously.

This works well: https://github.com/harishkrupo/oauth2ms Does require setting up an App in your Microsoft tenant (don’t know if it works across tenants)

no you need to install both cyrus-sasl and some form or another of xoauth, such as https://github.com/moriyoshi/cyrus-sasl-xoauth2. If you're on a mac you should look at this issue: https://github.com/moriyoshi/cyrus-sasl-xoauth2/issues/9

final: prev: with prev.lib; { cyrus_sasl_xoauth2 = prev.stdenv.mkDerivation rec { name = "cyrus-sasl-xoauth2"; src = prev.fetchFromGitHub { owner = "moriyoshi"; repo = "cyrus-sasl-xoauth2"; rev = "36aabca54fd65c8fa7a707cb4936751599967904"; sha256 = "OlmHuME9idC0fWMzT4kY+YQ43GGch53snDq3w5v/cgk="; }; outputs = [ "out" ]; depsBuildBuild = with final; [ buildPackages.stdenv.cc cyrus_sasl ]; nativeBuildInputs = with final; [ autoreconfHook ] ++ optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames; buildInputs = with final; [ openssl db gettext libkrb5 ] ++ optional stdenv.isLinux pam; configureFlags = [ "--with-openssl=${final.openssl.dev}" "--with-cyrus-sasl=${placeholder "out"}" "--with-plugindir=${placeholder "out"}/lib/sasl2" "--with-saslauthd=/run/saslauthd" "--enable-login" "--enable-shared" ]; installFlags = optional prev.stdenv.isDarwin [ "framedir=$(out)/Library/Frameworks/SASL2.framework" ]; # Make autoreconfHook happy postPatch = '' touch NEWS AUTHORS ChangeLog ''; meta = with prev.lib; { description = "Cyrus SASL XOAUTH2 plugin"; homepage = "https://github.com/moriyoshi/cyrus-sasl-xoauth2"; license = licenses.mit; platforms = platforms.all; }; }; }

Unfortunate things 2: it seems that even once you have cyrus-sasl installed, there might not be a standard, widely-distributed XOAUTH2 plugin. The one I found referenced the most often and ended up installing myself was here. It took me a lot of fiddling with the configure.ac file to get it to install the plugin to /usr/local/lib instead of /usr/lib, because, again, Apple does not want me to do things the default Linux way, because of reasons.