Gmail oauth authentication returns error when oauth_refresh_token is used

[fengshaun]

When I try to use gmail's oauth2 authentication with refresh token, I get the following error. I followed the instructions in the docs: https://github.com/OfflineIMAP/offlineimap/blob/master/offlineimap.conf#L746

General informations

• OfflineIMAP version: 7.0.0-rc2 (latest master as of today)
• CLI options: offlineimap -k "Repository gmail-remote":remoteuser= -d ALL

[Repository gmail-remote]
type = Gmail
auth_mechanisms = XOAUTH2
oauth2_client_id = <client id>
oauth2_client_secret = <client secret>
oauth2_refresh_torken = <refresh token>
#oauth2_access_token = <access token>

Log error

OfflineIMAP 7.0.0-rc2
  Licensed under the GNU GPL v2 or any later version (with an OpenSSL exception)
Now debugging for imap: IMAP protocol debugging
Now debugging for maildir: Maildir repository debugging
Now debugging for thread: Threading debugging
Now debugging for : Other offlineimap related sync messages
Account sync gmail:
 [thread]: Register new thread 'Account sync gmail' (account 'gmail')
 [imap]: Using authentication mechanisms ['XOAUTH2']
 [maildir]: MaildirRepository initialized, sep is '.'
 *** Processing account gmail
 Establishing connection to imap.gmail.com:993
 [imap]: Attempting XOAUTH2 authentication
 [imap]:   00:55.19 Account sync gmail last 20 log messages:
 XOAUTH2 authentication failed: AUTHENTICATE command error: BAD ['Client aborted AUTHENTICATE command. <string of characters>']. Data: <5-letter code> AUTHENTICATE XOAUTH2

 ERROR: All authentication types failed:
    XOAUTH2: AUTHENTICATE command error: BAD ['Client aborted AUTHENTICATE command. <string of characters>']. Data: <5-letter code> AUTHENTICATE XOAUTH2

 ['  File "~/pkgs/offlineimap/offlineimap/accounts.py", line 272, in syncrunner\n    self.__sync()\n', '  File "~/pkgs/offlineimap/offlineimap/accounts.py", line 335, in __sync\n
remoterepos.getfolders()\n', '  File "~/pkgs/offlineimap/offlineimap/repository/IMAP.py", line 386, in getfolders\n    imapobj = self.imapserver.acquireconnection()\n', '  File "~/pkgs/offlineimap/offlineimap/imapserver.py", line 526, in acquireconnection\n    self.__authn_helper(imapobj)\n', '  File "~/pkgs/offlineimap/offlineimap/imapserver.py", line 439, in __authn_helper\n    "failed:\\n\\t%s"% msg, OfflineImapError.ERROR.REPO)\n']
 *** Finished account 'gmail' in 0:00
[thread]: Unregister thread 'Account sync gmail'
ERROR: Exceptions occurred during the run!
ERROR: All authentication types failed:
    XOAUTH2: AUTHENTICATE command error: BAD ['Client aborted AUTHENTICATE command. <string of characters>']. Data: <5-letter code> AUTHENTICATE XOAUTH2


Traceback:
  File "~/pkgs/offlineimap/offlineimap/accounts.py", line 272, in syncrunner
    self.__sync()
  File "~/pkgs/offlineimap/offlineimap/accounts.py", line 335, in __sync
    remoterepos.getfolders()
  File "~/pkgs/offlineimap/offlineimap/repository/IMAP.py", line 386, in getfolders
    imapobj = self.imapserver.acquireconnection()
  File "~/pkgs/offlineimap/offlineimap/imapserver.py", line 526, in acquireconnection
    self.__authn_helper(imapobj)
  File "~/pkgs/offlineimap/offlineimap/imapserver.py", line 439, in __authn_helper
    "failed:\n\t%s"% msg, OfflineImapError.ERROR.REPO)

Steps to reproduce the error

• use refresh token instead of access token in config.

[nicolas33]

Is the refresh token correct? Does it work if you try it manually with this command: https://github.com/OfflineIMAP/offlineimap/blob/master/offlineimap.conf#L793 ?

[dolohow]

14 days without feedback from user. Closing, if issue still remains, please reopen.

[darnir]

I'm facing pretty much the exact same issue. I've opened #372 where I asked about this

[nicolas33]

I think we should provide a better error message.

[fengshaun]

sorry for the delay. Now using version 7.0.5.

@nicolas33: yes, the refresh token is correct and using gmail-oauth2-tools with the refresh token gives me a usable access token which I can use in offlineimap. Using the same refresh token still gives the original error.

[fengshaun]

Ouch, I had oauth2_refresh_torken instead of token in my config! It works now.

[nicolas33]

So, both @darnir and @fengshaun had a typo for this option and could not figure it out.

[nicolas33]

Could you reproduce the error with above version to check if this helps, please?