Register the email-oauth2-proxy component

The email-oauth2-proxy component runs a local proxy on the Segura® server that adds OAuth2.0 authentication to SMTP and IMAP connections. Use it for mail provider that requires OAuth2.0.

Requirements

• Administrative access to the Segura® server.
• The client_id, client_secret, and tenant_id for your mail provider's OAuth2.0 app.

To obtain the client_id, client_secret, and tenant_id, register the Segura® solution with your provider:

• Office 365: Office 365 Quickstart Register App.
• Office 365: How to find your Microsoft Entra tenant ID.
• Google Workspace: OAuth 2.0 for Mobile & Desktop Apps.

Register the proxy

1. Access the Segura® server using SSH on port 59022.
2. Log in with the administrative user mt4adm.
3. Run orbit email-oauth2-proxy register with your client_id, client_secret, and tenant_id, and the following parameters:

orbit email-oauth2-proxy register \
 --imap-server-address=outlook.office365.com \
 --imap-server-port=993 \
 --smtp-server-address=smtp.office365.com \
 --smtp-server-port=587 \
 --smtp-server-starttls \
 --oauth2-token-url="https://login.microsoftonline.com/TENANT_ID/oauth2/v2.0/token" \
 --oauth2-permission-url="https://login.microsoftonline.com/TENANT_ID/oauth2/v2.0/authorize" \
 --oauth2-scope="https://outlook.office365.com/IMAP.AccessAsUser.All https://outlook.office365.com/SMTP.Send offline_access" \
 --oauth2-flow="client_credentials" \
 --oauth2-client-id="CLIENT_ID" \
 --oauth2-client-secret="CLIENT_SECRET" \
 --force

The following example shows a configuration file for Microsoft Office 365:

[emailproxy]
delete_account_token_on_password_error = True
encrypt_client_secret_on_first_use = False
allow_catch_all_accounts = True
[IMAP-2993]
server_address = outlook.office365.com
server_port = 993
[SMTP-2465]
server_address = smtp.office365.com
server_port = 587
starttls = True
[@]
redirect_uri = http://<Your_Vault_Address>/email-oauth2-proxy-authorize/
redirect_list_address = http://127.0.0.1:8801/
token_url = https://login.microsoftonline.com/TENANT_ID/oauth2/v2.0/token
permission_url = https://login.microsoftonline.com/TENANT_ID/oauth2/v2.0/authorize
oauth2_scope = https://outlook.office365.com/IMAP.AccessAsUser.All https://outlook.office365.com/POP.AccessAsUser.All https://outlook.office365.com/SMTP.Send offline_access
client_id = CLIENT_ID
client_secret = CLIENT_SECRET
oauth2_flow = client_credentials

Point the mail account at the proxy

After you register the proxy, configure your SMTP or IMAP account in Segura® to connect to the local proxy instead of the provider directly. Use the local address 127.0.0.1 and the port assigned to each protocol in the configuration, for example 2465 for SMTP and 2993 for IMAP.

• SMTP: see Manage SMTP settings.
• IMAP/POP3: see Manage IMAP/POP3 settings.

Validate the proxy authentication

After you configure the mail account, obtain the authorization URL from the proxy to complete authentication with the provider:

1. Run orbit email-oauth2-proxy logs in the terminal. In the output, find the message Please visit the following URL to authenticate account to get the validation URL.
2. Copy the full URL and paste it into a browser.
3. Log in to the account.

The browser confirms that OAuth2.0 authentication succeeded.