微软OAuth2 SMTP

Question

我正在尝试构建一个应用程序，从我的Microsoft电子邮件帐户发送电子邮件，在Python中使用SMTP发送与OAuth2一起进行身份验证。身份验证不起作用，我得到了reply: retcode (535); Msg: b'5.7.3 Authentication unsuccessful [LO2P265CA0061.GBRP265.PROD.OUTLOOK.COM]'

我已经在azure上创建了一个AAD应用程序，并下载了在设置凭据之后提供的示例烧瓶应用程序，据我所知，它就是这个存储库。

我使用了这个应用程序(从带有我的秘密的AAD门户下载)，并尝试使用给定的令牌进行SMTP身份验证，使用的信息来自

• 微软文档1
• 微软文档2

登录到我的办公室电子邮件帐户工作，/graphcall也工作。但是SMTP身份验证不起作用，我正在从它接收reply: retcode (535); Msg: b'5.7.3 Authentication unsuccessful [LO2P265CA0061.GBRP265.PROD.OUTLOOK.COM]'。

我所要求的令牌的范围是SCOPE = ["User.ReadBasic.All", "https://outlook.office.com/SMTP.Send"]，应用程序在配置文件中打开了SMTP.send。

下面是一个扩展smtplib.SMTP的类，我是基于这些类编写的：

import smtplib
import base64


class MicrosoftSMTP(smtplib.SMTP):
    def __init__(self, host="smtp.office365.com", port=587, **kwargs):
        super().__init__(host=host, port=port, **kwargs)

    @staticmethod
    def encode_auth_token(username, token):
        just_a_str = f"user={username}\x01auth=Bearer {token}\x01\x01"
        xoauth2_token = base64.b64encode(just_a_str.encode())

        return xoauth2_token

    def authenticate(self, username, token):
        self.helo()

        # first step, we
        code, msg = self.docmd("auth", "XOAUTH2")
        if code != 334:
            raise Exception(msg.decode())

        # send the token
        self.send(self.encode_auth_token(username, token))

以及连接到应用程序的凭据的代码，并在其中添加一个页面，在其中显示令牌json以进行正常检查：

@app.route("/send_to_self")
def send_to_self():
    token = _get_token_from_cache(app_config.SCOPE)
    if not token:
        return redirect(url_for("login"))

    # connect to the server
    connection = MicrosoftSMTP()
    connection.set_debuglevel(True)  # for output
    connection.starttls()
    connection.authenticate(
        # same as session["user"]["preferred_username"]
        token["id_token_claims"]["preferred_username"],
        token["access_token"],
    )

    # ... would write an email here with connection.sendmail( ... )

    connection.quit()

    return render_template(
        "send_to_self.html",
        data=token,
        data_session=session["flow"],
        data_user=session["user"],
    )

身份验证失败了，下面是完整的日志：

send: 'ehlo 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa\r\n'
reply: b'250-LO2P265CA0516.outlook.office365.com Hello [<A.GENERAL.IP>]\r\n'
reply: b'250-SIZE 157286400\r\n'
reply: b'250-PIPELINING\r\n'
reply: b'250-DSN\r\n'
reply: b'250-ENHANCEDSTATUSCODES\r\n'
reply: b'250-STARTTLS\r\n'
reply: b'250-8BITMIME\r\n'
reply: b'250-BINARYMIME\r\n'
reply: b'250-CHUNKING\r\n'
reply: b'250 SMTPUTF8\r\n'
reply: retcode (250); Msg: b'LO2P265CA0516.outlook.office365.com Hello [<A.GENERAL.IP>]\nSIZE 157286400\nPIPELINING\nDSN\nENHANCEDSTATUSCODES\nSTARTTLS\n8BITMIME\nBINARYMIME\nCHUNKING\nSMTPUTF8'
send: 'STARTTLS\r\n'
reply: b'220 2.0.0 SMTP server ready\r\n'
reply: retcode (220); Msg: b'2.0.0 SMTP server ready'
send: 'helo 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa\r\n'
reply: b'250 LO2P265CA0516.outlook.office365.com Hello [<A.GENERAL.IP>]\r\n'
reply: retcode (250); Msg: b'LO2P265CA0516.outlook.office365.com Hello [<A.GENERAL.IP>]'
send: 'auth XOAUTH2\r\n'
reply: b'334 \r\n'
reply: retcode (334); Msg: b''
send: b'dX......EB'
send: 'quit\r\n'
reply: b'535 5.7.3 Authentication unsuccessful [LO2P265CA0516.GBRP265.PROD.OUTLOOK.COM]\r\n'
reply: retcode (535); Msg: b'5.7.3 Authentication unsuccessful [LO2P265CA0516.GBRP265.PROD.OUTLOOK.COM]'

我说过的话：

1. 我们允许此邮箱使用SMTP。
2. 令牌允许SMTP。
3. XOAUTH2令牌编码器的输出与网站上示例的输出相匹配

令牌数据如下所示，删除了令牌和用户名

{
    "access_token": "ey<...>aw",
    "client_info": "ey<...>In0",
    "expires_in": 3599,
    "ext_expires_in": 3599,
    "id_token": "ey<...>jQ",
    "id_token_claims": {
        "aud": "8<...>9",
        "exp": 1634319637,
        "iat": 1634315737,
        "iss": "https://login.microsoftonline.com/5<...>1/v2.0",
        "name": "<Name of the user>",
        "nbf": 1634315737,
        "nonce": "c1<...>d0",
        "oid": "cd<...>1b",
        "preferred_username": "user.name@company.com",
        "rh": "0.A<...>As.",
        "sub": "2w<...>ww",
        "tid": "50<...>31",
        "uti": "8W<...>AA",
        "ver": "2.0"
    },
    "refresh_token": "0.A<...>4Y",
    "scope": "openid profile SMTP.Send User.ReadBasic.All email",
    "token_type": "Bearer"
}

Answer 1

1. 通过将“启用安全性默认值”切换到“否”，禁用Azure Security默认设置：

- Sign in to the Azure portal as a security administrator, conditional access administrator, or Global administrator.
- Browse to Azure Active Directory -> Properties.
- Select Manage security defaults.
- Set the Enable security defaults toggle to No.
- Select save.

1. 将用户排除在阻止遗留身份验证的条件访问策略之外：

- Sign in to the Azure portal as a Security administrator, Conditional Access administrator, or Global administrator.
- Browse to Azure Active Directory > Security > Conditional Access.
- In the policy that blocks legacy Authentication, exclude the mailbox being used under Users and Groups > Exclude.
- Select Save.

您应该使用SMTP服务器:带有apicalsolutions-com.mail.protection.outlook.com端口25的。当用户使用您域的任何用户时。即使它没有链接邮箱，您也可以用来登录。

阅读更多的这里。