[FW][ADD] fetchmail_outlook, microsoft_outlook: add OAuth authentication #87498

fw-bot · 2022-03-29T16:55:28Z

Purpose

As it has been done for Gmail, we want to add the OAuth authentication
for the incoming / outgoing mail server.

Specifications

The user has to create a project on Outlook and fill the credentials
in Odoo. Once it's done, he can create an incoming / outgoing mail
server.

For the authentication flow is a bit different from Gmail. For Outlook
the user is redirected to Outlook where he'll accept the permission.
Once it's done, he's redirected again to the mail server form view and
the tokens are automatically added on the mail server.

Technical

There are 3 tokens used for the OAuth authentication.

The authentication code. This one is only used to get the refresh
token and the first access token. It's the code returned by the user
browser during the authentication flow.
The refresh token. This one will never change once the user is
authenticated. This token is used to get new access token once they
are expired.
The access token. Those tokens have an expiration date (1 hour) and
are used in the XOAUTH2 protocol to authenticate the IMAP / SMTP
connection.

During the authentication process, we can also give a state that will
be returned by the user browser. This state contains

The model and the ID of the mail server (as the same mixin manage
both incoming and outgoing mail server)
A CSRF token which sign those values and is verified once the browser
redirect the user to the Odoo database. This is useful so a malicious
user can not send a link to an admin to disconnect the mail server.

Task-2751996

Forward-Port-Of: #87294
Forward-Port-Of: #87040

robodoo · 2022-03-29T16:56:31Z

fw-bot · 2022-03-29T16:56:32Z

Ping @std-odoo, @tde-banana-odoo cherrypicking of pull request #87040 failed.

d2a43a6
1f98d12 <- on this commit
e5cb742

stderr:

18:55:02.326241 git.c:344               trace: built-in: git cherry-pick 1f98d124e1980147d5cce722a2aa288f4d391299
error: Cherry-picking is not possible because you have unmerged files.
hint: Fix them up in the work tree, and then use 'git add/rm <file>'
hint: as appropriate to mark resolution and make a commit.
fatal: cherry-pick failed
----------
status:

Either perform the forward-port manually (and push to this branch, proceeding as usual) or close this PR (maybe?).

In the former case, you may want to edit this PR message as well.

Bug === When we copy a GMail outgoing / incoming mail server, an error occurs because we try to refetch the access token, based on the same authorization code (which can be used only once). To fix this issue, we do not copy the authorization code (and other related fields). Task-2751996 X-original-commit: 2879976

std-odoo · 2022-03-30T08:12:29Z

@tde-banana-odoo Conflict solved :)

The second fix commit was removed (it was introduced in 14.0)

I use the new HMAC function

I use self.get_base_url()

tde-banana-odoo

Thanks ! Just had a verrrrry quick look, few comments while passing by :)

tde-banana-odoo · 2022-03-30T08:35:50Z

addons/fetchmail_gmail/models/fetchmail_server.py

@@ -23,8 +23,6 @@ def _onchange_use_google_gmail_service(self):
            self.is_ssl = True
            self.port = 993
        else:
-            self.server_type = 'pop'


Shouldn't it be in its own commit ?

tde-banana-odoo · 2022-03-30T08:36:17Z

addons/fetchmail_outlook/i18n/fetchmail_outlook.pot

+#
+msgid ""
+msgstr ""
+"Project-Id-Version: Odoo Server 13.0\n"


Should be updated maybe ? Still speaking about odoo 13 :)

tde-banana-odoo · 2022-03-30T08:36:53Z

addons/google_gmail/models/ir_mail_server.py

@@ -27,7 +27,6 @@ def _onchange_use_google_gmail_service(self):
            self.smtp_encryption = 'starttls'
            self.smtp_port = 587
        else:
-            self.smtp_encryption = 'none'


Would also move it in a specific commit updating gmail independently from outlook :)

tde-banana-odoo · 2022-03-30T08:37:10Z

addons/microsoft_outlook/i18n/microsoft_outlook.pot

+#
+msgid ""
+msgstr ""
+"Project-Id-Version: Odoo Server 13.0\n"


Would also re-generate pot files :)

Purpose ======= Do not reset the email configuration when unchecking "is Gmail". Task-2751996

Purpose ======= As it has been done for Gmail, we want to add the OAuth authentication for the incoming / outgoing mail server. Specifications ============== The user has to create a project on Outlook and fill the credentials in Odoo. Once it's done, he can create an incoming / outgoing mail server. For the authentication flow is a bit different from Gmail. For Outlook the user is redirected to Outlook where he'll accept the permission. Once it's done, he's redirected again to the mail server form view and the tokens are automatically added on the mail server. Technical ========= There are 3 tokens used for the OAuth authentication. 1. The authentication code. This one is only used to get the refresh token and the first access token. It's the code returned by the user browser during the authentication flow. 2. The refresh token. This one will never change once the user is authenticated. This token is used to get new access token once they are expired. 3. The access token. Those tokens have an expiration date (1 hour) and are used in the XOAUTH2 protocol to authenticate the IMAP / SMTP connection. During the authentication process, we can also give a state that will be returned by the user browser. This state contains 1. The model and the ID of the mail server (as the same mixin manage both incoming and outgoing mail server) 2. A CSRF token which sign those values and is verified once the browser redirect the user to the Odoo database. This is useful so a malicious user can not send a link to an admin to disconnect the mail server. Task-2751996 X-original-commit: e54d63b

std-odoo · 2022-03-30T09:02:25Z

@tde-banana-odoo Changes done :)

tde-banana-odoo · 2022-03-30T09:34:34Z

@robodoo override=ci/security

Reason: same as #87040 (review)

@mart-e overriding myself to avoid transient time on runbot (due to exceptions). @std-odoo correctly updated hmac usage. Please don't send Moc to brise my genoux.

tde-banana-odoo · 2022-03-30T09:34:44Z

@robodoo r+ rebase-merge

robodoo · 2022-03-30T09:35:11Z

Merge method set to rebase and merge, using the PR as merge commit message

Bug === When we copy a GMail outgoing / incoming mail server, an error occurs because we try to refetch the access token, based on the same authorization code (which can be used only once). To fix this issue, we do not copy the authorization code (and other related fields). Task-2751996 X-original-commit: 2879976 Part-of: #87498

Purpose ======= Do not reset the email configuration when unchecking "is Gmail". Task-2751996 Part-of: #87498

Purpose ======= As it has been done for Gmail, we want to add the OAuth authentication for the incoming / outgoing mail server. Specifications ============== The user has to create a project on Outlook and fill the credentials in Odoo. Once it's done, he can create an incoming / outgoing mail server. For the authentication flow is a bit different from Gmail. For Outlook the user is redirected to Outlook where he'll accept the permission. Once it's done, he's redirected again to the mail server form view and the tokens are automatically added on the mail server. Technical ========= There are 3 tokens used for the OAuth authentication. 1. The authentication code. This one is only used to get the refresh token and the first access token. It's the code returned by the user browser during the authentication flow. 2. The refresh token. This one will never change once the user is authenticated. This token is used to get new access token once they are expired. 3. The access token. Those tokens have an expiration date (1 hour) and are used in the XOAUTH2 protocol to authenticate the IMAP / SMTP connection. During the authentication process, we can also give a state that will be returned by the user browser. This state contains 1. The model and the ID of the mail server (as the same mixin manage both incoming and outgoing mail server) 2. A CSRF token which sign those values and is verified once the browser redirect the user to the Odoo database. This is useful so a malicious user can not send a link to an admin to disconnect the mail server. Task-2751996 X-original-commit: e54d63b Part-of: #87498

Purpose ======= As it has been done for Gmail, we want to add the OAuth authentication for the incoming / outgoing mail server. Specifications ============== The user has to create a project on Outlook and fill the credentials in Odoo. Once it's done, he can create an incoming / outgoing mail server. For the authentication flow is a bit different from Gmail. For Outlook the user is redirected to Outlook where he'll accept the permission. Once it's done, he's redirected again to the mail server form view and the tokens are automatically added on the mail server. Technical ========= There are 3 tokens used for the OAuth authentication. 1. The authentication code. This one is only used to get the refresh token and the first access token. It's the code returned by the user browser during the authentication flow. 2. The refresh token. This one will never change once the user is authenticated. This token is used to get new access token once they are expired. 3. The access token. Those tokens have an expiration date (1 hour) and are used in the XOAUTH2 protocol to authenticate the IMAP / SMTP connection. During the authentication process, we can also give a state that will be returned by the user browser. This state contains 1. The model and the ID of the mail server (as the same mixin manage both incoming and outgoing mail server) 2. A CSRF token which sign those values and is verified once the browser redirect the user to the Odoo database. This is useful so a malicious user can not send a link to an admin to disconnect the mail server. Task-2751996 closes #87498 Forward-port-of: #87294 Forward-port-of: #87040 Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>

Purpose ======= As it has been done for Gmail, we want to add the OAuth authentication for the incoming / outgoing mail server. Specifications ============== The user has to create a project on Outlook and fill the credentials in Odoo. Once it's done, he can create an incoming / outgoing mail server. For the authentication flow is a bit different from Gmail. For Outlook the user is redirected to Outlook where he'll accept the permission. Once it's done, he's redirected again to the mail server form view and the tokens are automatically added on the mail server. Technical ========= There are 3 tokens used for the OAuth authentication. 1. The authentication code. This one is only used to get the refresh token and the first access token. It's the code returned by the user browser during the authentication flow. 2. The refresh token. This one will never change once the user is authenticated. This token is used to get new access token once they are expired. 3. The access token. Those tokens have an expiration date (1 hour) and are used in the XOAUTH2 protocol to authenticate the IMAP / SMTP connection. During the authentication process, we can also give a state that will be returned by the user browser. This state contains 1. The model and the ID of the mail server (as the same mixin manage both incoming and outgoing mail server) 2. A CSRF token which sign those values and is verified once the browser redirect the user to the Odoo database. This is useful so a malicious user can not send a link to an admin to disconnect the mail server. Task-2751996 closes #87554 Forward-port-of: #87498 Forward-port-of: #87040 Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>

Bug === When we copy a GMail outgoing / incoming mail server, an error occurs because we try to refetch the access token, based on the same authorization code (which can be used only once). To fix this issue, we do not copy the authorization code (and other related fields). Task-2751996 X-original-commit: 2879976 Part-of: odoo#87498

Purpose ======= Do not reset the email configuration when unchecking "is Gmail". Task-2751996 Part-of: odoo#87498

Purpose ======= As it has been done for Gmail, we want to add the OAuth authentication for the incoming / outgoing mail server. Specifications ============== The user has to create a project on Outlook and fill the credentials in Odoo. Once it's done, he can create an incoming / outgoing mail server. For the authentication flow is a bit different from Gmail. For Outlook the user is redirected to Outlook where he'll accept the permission. Once it's done, he's redirected again to the mail server form view and the tokens are automatically added on the mail server. Technical ========= There are 3 tokens used for the OAuth authentication. 1. The authentication code. This one is only used to get the refresh token and the first access token. It's the code returned by the user browser during the authentication flow. 2. The refresh token. This one will never change once the user is authenticated. This token is used to get new access token once they are expired. 3. The access token. Those tokens have an expiration date (1 hour) and are used in the XOAUTH2 protocol to authenticate the IMAP / SMTP connection. During the authentication process, we can also give a state that will be returned by the user browser. This state contains 1. The model and the ID of the mail server (as the same mixin manage both incoming and outgoing mail server) 2. A CSRF token which sign those values and is verified once the browser redirect the user to the Odoo database. This is useful so a malicious user can not send a link to an admin to disconnect the mail server. Task-2751996 X-original-commit: e54d63b Part-of: odoo#87498

Smig0l · 2023-10-04T09:52:51Z

any plans to adding client_credentials flow?
see this MSFT page.

C3POdoo added the RD research & development, internal work label Mar 29, 2022

robodoo added conflict There was an error while creating this forward-port PR forwardport This PR was created by @fw-bot labels Mar 29, 2022

fw-bot mentioned this pull request Mar 30, 2022

[ADD] fetchmail_outlook, microsoft_outlook: add OAuth authentication #87040

Closed

std-odoo force-pushed the 14.0-12.0-microsoft-outlook-2022-std-PB_2-fw branch from 531a252 to a532e30 Compare March 30, 2022 07:13

std-odoo force-pushed the 14.0-12.0-microsoft-outlook-2022-std-PB_2-fw branch 2 times, most recently from e0e15f9 to acff028 Compare March 30, 2022 07:28

tde-banana-odoo reviewed Mar 30, 2022

View reviewed changes

std-odoo added 2 commits March 30, 2022 10:59

[IMP] {microsoft, fetchmail}_outlook: do not reset the email config

9c111ca

Purpose ======= Do not reset the email configuration when unchecking "is Gmail". Task-2751996

std-odoo force-pushed the 14.0-12.0-microsoft-outlook-2022-std-PB_2-fw branch from acff028 to 745a982 Compare March 30, 2022 08:59

robodoo pushed a commit that referenced this pull request Mar 30, 2022

[IMP] {microsoft, fetchmail}_outlook: do not reset the email config

28ca6c2

Purpose ======= Do not reset the email configuration when unchecking "is Gmail". Task-2751996 Part-of: #87498

robodoo closed this Mar 30, 2022

robodoo temporarily deployed to merge March 30, 2022 10:47 Inactive

fw-bot mentioned this pull request Mar 30, 2022

[FW][ADD] fetchmail_outlook, microsoft_outlook: add OAuth authentication #87554

Closed

fw-bot deleted the 14.0-12.0-microsoft-outlook-2022-std-PB_2-fw branch April 13, 2022 11:46

odooaktiv pushed a commit to odooaktiv/odoo that referenced this pull request Jun 13, 2022

[IMP] {microsoft, fetchmail}_outlook: do not reset the email config

732a555

Purpose ======= Do not reset the email configuration when unchecking "is Gmail". Task-2751996 Part-of: odoo#87498

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[FW][ADD] fetchmail_outlook, microsoft_outlook: add OAuth authentication #87498

[FW][ADD] fetchmail_outlook, microsoft_outlook: add OAuth authentication #87498

fw-bot commented Mar 29, 2022

robodoo commented Mar 29, 2022 •

edited

Loading

fw-bot commented Mar 29, 2022

std-odoo commented Mar 30, 2022

tde-banana-odoo left a comment

tde-banana-odoo Mar 30, 2022

tde-banana-odoo Mar 30, 2022

tde-banana-odoo Mar 30, 2022

tde-banana-odoo Mar 30, 2022

std-odoo commented Mar 30, 2022

tde-banana-odoo commented Mar 30, 2022

tde-banana-odoo commented Mar 30, 2022

robodoo commented Mar 30, 2022

Smig0l commented Oct 4, 2023

[FW][ADD] fetchmail_outlook, microsoft_outlook: add OAuth authentication #87498

[FW][ADD] fetchmail_outlook, microsoft_outlook: add OAuth authentication #87498

Conversation

fw-bot commented Mar 29, 2022

Purpose

Specifications

Technical

robodoo commented Mar 29, 2022 • edited Loading

fw-bot commented Mar 29, 2022

std-odoo commented Mar 30, 2022

tde-banana-odoo left a comment

Choose a reason for hiding this comment

tde-banana-odoo Mar 30, 2022

Choose a reason for hiding this comment

tde-banana-odoo Mar 30, 2022

Choose a reason for hiding this comment

tde-banana-odoo Mar 30, 2022

Choose a reason for hiding this comment

tde-banana-odoo Mar 30, 2022

Choose a reason for hiding this comment

std-odoo commented Mar 30, 2022

tde-banana-odoo commented Mar 30, 2022

tde-banana-odoo commented Mar 30, 2022

robodoo commented Mar 30, 2022

Smig0l commented Oct 4, 2023

robodoo commented Mar 29, 2022 •

edited

Loading