Authentication error while connecting to Outlook for Java application (Spring) while IMAP OAuth2 implementation

Question

We have a Java Spring application having a scheduled job that read mails from outlook inbox and complete the process based on the content of mail. Currently application uses IMAP basic authentication. Since IMAP basic authentication is getting deprecated we are working on a solution to implement IMPA OAuth2 protocol.

As a first step, we completed the application registration in AzureAD. We have done necessary configuration in Microsoft365. Below is the API Permission scope we setup

Microsoft Graph
IMAP.AccessAsUser.All
mail.ReadWrite
User.Read
Office365 Exchange online
full_access_as_app
IMAP.AccessAsApp
mail.Read
mail.ReadWrite
mail.send

We have received the Application(Client)ID, Client secret, Tenant ID. Below is the page we have referenced for creating the source code.

https://ralph.blog.imixs.com/2022/10/24/how-to-access-outlook-office365-com-imap-form-java-with-oauth2/

We have verified office 365 and Azure AD settings with PowerShell command and its working fine and able to get the token created successfully. We have verified the token with jwt.ms . We had connect with Microsoft support team verified all configurations from their side as well.

But we are not able to connect to the IMAP store and getting the below error at this line (store.connect(host,userEmailId, oauth2AccessToken);) We have the Administrator of the office365 account running a PowerShell script on the Exchange as per the suggestion provided in one of the forum , but still the issue persist.

javax.mail.AuthenticationFailedException: AUTHENTICATE failed.  

We have gone through many Microsoft discussion forums and searched for a solution but still couldn't succeed. Below are some of the pages we tried

https://learn.microsoft.com/en-us/answers/questions/828094/how-to-access-to-a-shared-mail-box-using-oauth2-wi.html
https://learn.microsoft.com/en-us/answers/questions/872062/how-to-authenticate-a-backend-java-imap-applicatio-1.html
https://social.msdn.microsoft.com/Forums/en-US/6086d4f3-4288-4bad-b290-9aaa7423a9cc/outlook-oauth2-access-mails?forum=WindowsAzureAD
https://stackoverflow.com/questions/73039215/authentication-failure-for-imap-using-client-credential-flow-for-oauth2-0-java

Please advice any specific configuration or setup is required to connect to IMAP store and read the mail.

Any help to get this issue resolved will be highly appreciated.

Answer 1

Hi @Biji ,

Thanks for reaching out and provide the update.

The sample you are referring is using client credential flow to get the access token which require Application permissions.

All the permissions which you mentioned are both Delegated permissions and Application permissions as well.

To get the access token using delegated permissions (which require user interaction) , you need to provide below permissions to your application:

With delegated permissions, you can get access token using authorization grant flow by passing https://outlook.office365.com/IMAP.AccessAsUser.All in scope.

Once you will get the access token, you can create and open a Java Mail connection to read mails.

Hope this will help.

Thanks,
Shweta

---------------------------------------

Please remember to "Accept Answer" if answer helped you.

Answer 2

Hi @Shewalkar, Snehal Thank you for your guidance !! Based on your comments , we have set the permissions under Office 365 Exchange Online as you mentioned and we were able to get the token created. However , our code is unable to read the emails from the mail box with the current code we are using. Below is the code snippet we are using to connect to Inbox and read the mail. But we are getting Authenticate Failed exception in the log.

    Properties props = new Properties();  
    props.put("mail.store.protocol", "imaps");  
    props.put("mail.imap.host", "outlook.office365.com");  
    props.put("mail.imap.port", "993");  
    props.put("mail.imap.ssl.enable", "true");  
    props.put("mail.imap.starttls.enable", "true");  
    props.put("mail.imap.auth", "true");  
    props.put("mail.imap.auth.mechanisms", "XOAUTH2");  
    props.put("mail.imap.user", emailInput.getReceiveEmailId());  
    props.put("mail.debug", "true");  
    props.put("mail.debug.auth", "true");  

    Store store = null;  
    Session session = Session.getInstance(props);  
    session.setDebug(true);  
    store  = session.getStore("imaps");  
    store.connect("outlook.office365.com", usermailId, token);  

Since we come across the Authentication failure, we tried with the Application permissions in Graph API and we tried to trigger the requests through postman and received the success response. Our application is in Java and we consume Graph API through Rest call and the job was able to read the mails successfully. But the job is not making the mails to 'read' status and job reads the same set of emails every time it runs.

Is there any built-in function/class available with Microsoft Graph which can be used to mark the emails as READ status. or mark the emails with Flag ? We were able to see a similar function/method exist in IMAP (ImapMailReciver.receive()) .So would like to understand whether a similar method is available with Graph .

Any recommendation would be highly appreciated. Thanks