IMAP with outlook.office365.com and XOAUTH2 fails since 18-Feb-2024 with command LIST illegal in state NONAUTH

[weisslj]

Bug description

Since around 18-Feb-2024 fetching email with offlineimap via IMAP from my work account outlook.office365.com via XOAUTH2 fails with command LIST illegal in state NONAUTH. Nothing was changed on my laptop as far as I know, and also not on the remote side according to our administrators. Accessing via mutt, thunderbird, and mbsync still works!

First I thought this is related to the changed Thunderbird client ID from 08162f7c-0fd2-4200-a84a-f25a4db0b584 to 9e5f94bc-e8a4-4e73-b8be-63364c29d753, but that does not seem to be the case!

• https://blog.thunderbird.net/2023/01/important-message-for-microsoft-office-365-enterprise-users/
• https://hg.mozilla.org/comm-central/rev/8a2ef67503dff486b842a6fd35bc99bf1d223137#l6.122
• https://www.reddit.com/r/Thunderbird/comments/yqwes1/notice_to_microsoft_office_365_enterprise_users/
• https://www.soeren-hentzschel.at/thunderbird/thunderbird-102-7-0/

General informations

• system/distribution (with version): Debian GNU/Linux Stable (Bookworm)
• offlineimap version (offlineimap -V): offlineimap v8.0.0, imaplib2 v3.06, Python v3.11.2, OpenSSL 3.0.11 19 Sep 2023 (also latest master v8.0.0-38-gd29a4dc = d29a4dc)
• Python version: Python 3.11.2
• server name or domain: outlook.office365.com
• CLI options: offlineimap -o -1

Configuration file offlineimaprc

[general]
accounts = work
pythonfile = ~/.offlineimap.py

[Account work]
localrepository = work-Local
remoterepository = work-Remote

[Repository work-Local]
type = Maildir
localfolders = ~/mail/work
sep = /

[Repository work-Remote]
type = IMAP
ssl = yes
sslcacertfile = /etc/ssl/certs/ca-certificates.crt
auth_mechanisms = XOAUTH2
oauth2_request_url = https://login.microsoftonline.com/common/oauth2/v2.0/token
# from https://hg.mozilla.org/comm-central/file/tip/mailnews/base/src/OAuth2Providers.jsm
oauth2_client_id = 9e5f94bc-e8a4-4e73-b8be-63364c29d753
oauth2_client_secret = 
# via https://github.com/UvA-FNWI/M365-IMAP
oauth2_refresh_token_eval = keyring.get_password('offlineimap-refresh-token', 'mymail@mycompany.com')
remotehost = outlook.office365.com
remoteuser = mymail@mycompany.com
remotepasseval = keyring.get_password('offlineimap', 'mymail@mycompany.com')
createfolders = no

pythonfile (if any)

import keyring

Logs, error

OfflineIMAP 8.0.0
  Licensed under the GNU GPL v2 or any later version (with an OpenSSL exception)
imaplib2 v3.06, Python v3.11.2, OpenSSL 3.0.11 19 Sep 2023
Account sync work:
 *** Processing account work
 Establishing connection to outlook.office365.com:993 (work-Remote)
 ERROR: While attempting to sync account 'work'
  command LIST illegal in state NONAUTH
 *** Finished account 'work' in 0:00
 ERROR: Exceptions occurred during the run!
 ERROR: While attempting to sync account 'work'
  imaplib2.imaplib2.IMAP4.error: command LIST illegal in state NONAUTH