Feature request: OAUTH support

[j4g3r]

Hello, our dmarc reports go to an office365 account and I have been made aware that on October 1, 2022 Microsoft is deprecating the basic auth access method:

https://techcommunity.microsoft.com/t5/exchange-team-blog/basic-authentication-deprecation-in-exchange-online-may-2022/ba-p/3301866

It seems that the only ways to access Outlook365 mail via a script will be using either OAUTH or the Graph API. I am aware of a project here on github which implements OAUTH for php-imap:

https://github.com/javanile/php-imap2

I am unsure if the standard php-imap library has implemented this functionality. "javanile" has claimed in comments responding to this feature request for other projects that his library is a drop-in replacement for the standard php-imap and merely requires changing calls to php2-imap. I hope this is true and would allow quick implementation of this request before Microsoft breaks things.

Thanks for your consideration and for this useful software.

[liuch]

Hello j4g3r,
Isn't basic auth access just about using credentials via HTTP protocol? Perhaps, I do not understand something. Yes, I read your links, but it did not give me a clear understanding of what kind of authentication protocol they mean. Perhaps, they are referring to the IMAP authentication method called PLAIN?

[j4g3r]

Yes, they are referring to IMAP PLAIN authentication which is enough for you to understand.

For a bit more background, though, basic auth deprecation in the Office365 ecosystem will affect many more services than merely IMAP, it also affect MAPI, RPC, Offline Address Book (OAB), Exchange Web Services (EWS), POP, IMAP, Exchange ActiveSync (EAS), Remote PowerShell, and eventually even SMTP. Currently using your main password is already not allowed but you can make an application specific password to use with these services including IMAP PLAIN over http. Once this feature is turned off OAUTH and their Graph API will be the only way to authenticate programmatically to any Microsoft service.

I saw in another comment the you don't want to use composer, so probably the php-imap2 project is not the ideal solution. I see references to OAUTH on php-imap.com so perhaps nothing more is needed. Thanks again for your attention and for your excellent software.

[liuch]

Yes, I don't tend to use external dependencies without good reason. I don't have much time at the moment, but I'm going to dig into this protocol in a while. Any way, you can extract report files from your mailbox by any software that suits you into a directory on your server and set up this directory in the conf.phhp file to fetch these reports.

Thanks for the information and for your attention to my project!