OAuth2 authentication

[Bibhu280]

Hi Erik,
My id is in shared mailbox(cloud) & have client,tenant,secrert id. How to perform OAuth2 authentication to access my id.
Tried below code showing "Unauthorized Error: Invalid credentials for https://outlook.office.com/EWS/Exchange.asmx" .

try:
    BaseProtocol.HTTP_ADAPTER_CLS = NoVerifyHTTPAdapter
    cred = OAuth2Credentials(client_id=Client_id, client_secret=Secret_id, tenant_id=Tenant_id)
    config = Configuration(server='outlook.office.com',credentials=cred, auth_type=OAUTH2)
    account = Account(primary_smtp_address='mailid', credentials=cred, config=config, autodiscover=False, 
 access_type=DELEGATE)

except Exception as e:
    print(str(e))
    print('Unknown failure')
    print("Transport Error:Network connectivity issue Please check internet or mail server")

could u please help on this.

[ecederstrand]

Unfortunately, I don't have access to test OAuth authentication myself. It's contributed code but I've seen others have success using it. Your code looks correct, which hints at the auth tokens being wrong. Do you have any other means to test them against EWS? It's possible that the tokens are correct, but are not allowed to be used for EWS.

[agronholm]

If you want to get access, you can get a Microsoft developer subscription which is free. This gets you a limited organization with access to O365 and Azure AD. This is how I tested OAuth2 access (and got the same error as OP). Apparently this requires the Exchange Online full_access_as_app permission (though I still get the error). Details here: https://docs.microsoft.com/en-us/exchange/client-developer/exchange-web-services/how-to-authenticate-an-ews-application-by-using-oauth#configure-for-app-only-authentication

[OriginalDopey]

I am having the same issue, did you ever get it working?

[cmin764]

Replicated the issue here as well, autodiscovery fails with Unauthorized in the last step and not sure what's the correct server we should provide in such case. Added the permissions (including the full one), used the right scopes, got the tokens, but when it comes to instantiate the Account it just fails with this Unauthorized error when supplying a server myself. (and autodiscovery is failing if set to True)

Still, it works to do the auth with the following delegation scope added: https://graph.microsoft.com/EWS.AccessAsUser.All (but then you need to give impersonation rights to the app).

[ecederstrand]

If your account is on O365, then autodiscover is unnecessary. just hardcode the server and skip autodiscover. Also, Oauth apparently doesn't work with the current autodiscover implementation at all. See #1089.

I've added a description to the docs of the Oauth setup needed. That should get you going if you have auth issues with Oauth.

[cmin764]

Somehow I got the autodiscovery working (by turning it off) and it still works (and takes some time until caching does its job starting with the 2nd run), BUT, it doesn't work anymore once the access token expires, since you'll get "401 Unauthorized" with every autodiscover test.

On the other hand, disabling it and hardcoding the server will just work, even with token auto-refresh during expiry once you monkey patch the problematic underlying OAuth2 library.

[cmin764]

I got it working with this open-source RPA (Robocorp) robot:

class OAuth2Creds(OAuth2AuthorizationCodeCredentials):

    """OAuth2 auth code flow credentials wrapper supporting token state on refresh."""

    def __init__(self, *args, on_token_refresh: Callable, **kwargs):
        super().__init__(*args, **kwargs)
        # Additional behaviour to trigger during token refresh (when it expires), like
        #  saving the newly generated structure in the Vault.
        self._on_token_refresh = on_token_refresh

    def on_token_auto_refreshed(self, access_token: OAuth2Token):
        super().on_token_auto_refreshed(access_token)
        self._on_token_refresh(access_token)


self.credentials = OAuth2Creds(
                on_token_refresh=self.on_token_refresh,
                identity=Identity(upn=username),
                client_id=client_id,
                client_secret=client_secret,
                # Contains at least a non-expired access token or non-revoked refresh
                #  one. (otherwise an authorization code should be present inside)
                access_token=OAuth2Token(params=token) if token else None,
            )

self.config = Configuration(
                server=server,
                credentials=self.credentials,
                # Automatically detects authentication type based on the provided
                #  `credentials` object. (when not using OAuth2)
                auth_type=OAUTH2 if is_oauth else None,
            )

Make sure you:

• Use outlook.office365.com server
• Switch to "impersonation" access type
• Follow these Web App setup instructions in Azure AD

and you should get it working. (as ready to test from the Portal example)