{"thread":{"id":"63324","subject":"[PATCH 0/2] send-email: add oauth2 support and fix outlook breaking threads","startedAt":"2025-04-22T06:55:43Z","lastAt":"2025-04-22T06:55:48Z","messageCount":3,"participants":["Aditya Garg"],"isPatch":true,"patchVersion":1,"patchTotal":2},"messages":[{"id":"516459","messageId":"PN3PR01MB95979D98917E3986E37267A5B8BB2@PN3PR01MB9597.INDPRD01.PROD.OUTLOOK.COM","threadId":"63324","inReplyTo":null,"subject":"[PATCH 0/2] send-email: add oauth2 support and fix outlook breaking threads","fromName":"Aditya Garg","fromEmail":"gargaditya08@live.com","sentAt":"2025-04-22T06:54:59Z","receivedAt":"2025-04-22T06:55:43Z","isPatch":true,"sender":{"key":"gargaditya08@live.com","avatar":"https://avatars.githubusercontent.com/u/85610623?v=4"},"body":"Hi all!\n\nThis patch series includes two changes:\n\n1. It adds support for Oauth2 authentication, which is now compulsory by Microsoft.\n This patch has been rebased to the latest version from the original version\n at https://lore.kernel.org/git/20250125190131.48717-1-julian@swagemakers.org/\n\n2. The second patch makes the script reply to the message id set by the outlook,\n since outlook has its own proprietary way to handle message ids,\n and does not allow user to set their own. As a result, threads were breaking.\n\nDetailed description of each patch has been done in the respective patches\n\nBTW, I am sending this series using the patched send-email by these patches from\nOutlook!\n\nAditya Garg (1):\n send-email: retrieve Message-ID from outlook SMTP server\n\nJulian Swagemakers (1):\n send-email: implement SMTP bearer authentication\n\n Documentation/git-send-email.adoc | 5 ++-\n git-send-email.perl | 75 ++++++++++++++++++++++++++++++-\n 2 files changed, 78 insertions(+), 2 deletions(-)\n\n-- \n2.49.0\n\n"},{"id":"516460","messageId":"PN3PR01MB95970BE1414A760592A0C391B8BB2@PN3PR01MB9597.INDPRD01.PROD.OUTLOOK.COM","threadId":"63324","inReplyTo":"PN3PR01MB95979D98917E3986E37267A5B8BB2@PN3PR01MB9597.INDPRD01.PROD.OUTLOOK.COM","subject":"[PATCH 1/2] send-email: implement SMTP bearer authentication","fromName":"Aditya Garg","fromEmail":"gargaditya08@live.com","sentAt":"2025-04-22T06:55:00Z","receivedAt":"2025-04-22T06:55:46Z","isPatch":true,"sender":{"key":"gargaditya08@live.com","avatar":"https://avatars.githubusercontent.com/u/85610623?v=4"},"body":"From: Julian Swagemakers \n\nManually send SMTP AUTH command for auth type OAUTHBEARER and XOAUTH2.\nThis is necessary since they are currently not supported by the Perls\nAuthen::SASL module.\n\nThe bearer token needs to be passed in as the password. This can be done\nwith git-credential-oauth[0] after minor modifications[1]. Which will\nallow using git send-email with Gmail and oauth2 authentication:\n\n [credential]\n helper = cache --timeout 7200 # two hours\n helper = oauth\n [sendemail]\n smtpEncryption = tls\n smtpServer = smtp.gmail.com\n smtpUser = example@gmail.com\n smtpServerPort = 587\n smtpauth = OAUTHBEARER\n\nAs well as Office 365 accounts:\n\n [credential]\n helper = cache --timeout 7200 # two hours\n helper = oauth\n [sendemail]\n smtpEncryption = tls\n smtpServer = smtp.office365.com\n smtpUser = example@example.com\n smtpServerPort = 587\n smtpauth = XOAUTH2\n\n[0] https://github.com/hickford/git-credential-oauth\n[1] https://github.com/hickford/git-credential-oauth/issues/48\n\nTested-by: M Hickford \nSigned-off-by: Julian Swagemakers \nSigned-off-by: Aditya Garg \n---\n Documentation/git-send-email.adoc | 5 ++-\n git-send-email.perl | 64 ++++++++++++++++++++++++++++++-\n 2 files changed, 67 insertions(+), 2 deletions(-)\n\ndiff --git a/Documentation/git-send-email.adoc b/Documentation/git-send-email.adoc\nindex 7f223db42d..1bf75c060d 100644\n--- a/Documentation/git-send-email.adoc\n+++ b/Documentation/git-send-email.adoc\n@@ -213,7 +213,10 @@ SMTP server and if it is supported by the utilized SASL library, the mechanism\n is used for authentication. If neither 'sendemail.smtpAuth' nor `--smtp-auth`\n is specified, all mechanisms supported by the SASL library can be used. The\n special value 'none' maybe specified to completely disable authentication\n-independently of `--smtp-user`\n+independently of `--smtp-user`. Specifying `OAUTHBEARER` or `XOAUTH2` will\n+bypass SASL negotiation and force bearer authentication. In this case the\n+bearer token must be provided with `--smtp-pass` or using a credential helper\n+and `--smtp-encryption=tls` must be set.\n \n --smtp-pass[=]::\n \tPassword for SMTP-AUTH. The argument is optional: If no\ndiff --git a/git-send-email.perl b/git-send-email.perl\nindex 1f613fa979..aa6aad596f 100755\n--- a/git-send-email.perl\n+++ b/git-send-email.perl\n@@ -1398,6 +1398,63 @@ sub smtp_host_string {\n \t}\n }\n \n+sub generate_oauthbearer_string {\n+\t# This will generate the oauthbearer string used for authentication.\n+\t#\n+\t# \"n,a=\" {User} \",^Ahost=\" {Host} \"^Aport=\" {Port} \"^Aauth=Bearer \" {Access Token} \"^A^A\n+\t#\n+\t# The first part `n,a=\" {User} \",` is the gs2 header described in RFC5801.\n+\t# * gs2-cb-flag `n` -> client does not support CB\n+\t# * gs2-authzid `a=\" {User} \"`\n+\t#\n+\t# The second part are key value pairs containing host, port and auth as\n+\t# described in RFC7628.\n+\t#\n+\t# https://datatracker.ietf.org/doc/html/rfc5801\n+\t# https://datatracker.ietf.org/doc/html/rfc7628\n+\tmy $username = shift;\n+\tmy $token = shift;\n+\treturn \"n,a=$username,\\001port=$smtp_server_port\\001auth=Bearer $token\\001\\001\";\n+}\n+\n+sub generate_xoauth2_string {\n+\t# \"user=\" {User} \"^Aauth=Bearer \" {Access Token} \"^A^A\"\n+\t# https://developers.google.com/gmail/imap/xoauth2-protocol#initial_client_response\n+\tmy $username = shift;\n+\tmy $token = shift;\n+\treturn \"user=$username\\001auth=Bearer $token\\001\\001\";\n+}\n+\n+sub smtp_bearer_auth {\n+\tmy $username = shift;\n+\tmy $token = shift;\n+\tmy $auth_string;\n+\tif ($smtp_encryption ne \"tls\") {\n+\t\t# As described in RFC7628 TLS is required and will be enforced\n+\t\t# at this point.\n+\t\t#\n+\t\t# https://datatracker.ietf.org/doc/html/rfc7628#section-3\n+\t\tdie __(\"For $smtp_auth TLS is required.\")\n+\t}\n+\tif ($smtp_auth eq \"OAUTHBEARER\") {\n+\t\t$auth_string = generate_oauthbearer_string($username, $token);\n+\t} elsif ($smtp_auth eq \"XOAUTH2\") {\n+\t\t$auth_string = generate_xoauth2_string($username, $token);\n+\t}\n+\tmy $encoded_auth_string = MIME::Base64::encode($auth_string, \"\");\n+\t$smtp->command(\"AUTH $smtp_auth $encoded_auth_string\\r\\n\");\n+\tuse Net::Cmd qw(CMD_OK);\n+\tif ($smtp->response() == CMD_OK){\n+\t\treturn 1;\n+\t} else {\n+\t\t# Send dummy request on authentication failure according to rfc7628.\n+\t\t# https://datatracker.ietf.org/doc/html/rfc7628#section-3.2.3\n+\t\t$smtp->command(MIME::Base64::encode(\"\\001\"));\n+\t\t$smtp->response();\n+\t\treturn 0;\n+\t}\n+}\n+\n # Returns 1 if authentication succeeded or was not necessary\n # (smtp_user was not specified), and 0 otherwise.\n \n@@ -1436,7 +1493,12 @@ sub smtp_auth_maybe {\n \n \t\t# catch all SMTP auth error in a unified eval block\n \t\teval {\n-\t\t\tif ($smtp_auth) {\n+\t\t\tif (defined $smtp_auth && ($smtp_auth eq \"OAUTHBEARER\" || $smtp_auth eq \"XOAUTH2\")) {\n+\t\t\t\t# Since Authen:SASL does not support XOAUTH2 nor OAUTHBEARER we will\n+\t\t\t\t# manually authenticate for these types. The password field should\n+\t\t\t\t# contain the auth token at this point.\n+\t\t\t\t$result = smtp_bearer_auth($cred->{'username'}, $cred->{'password'});\n+\t\t\t} elsif ($smtp_auth) {\n \t\t\t\tmy $sasl = Authen::SASL->new(\n \t\t\t\t\tmechanism => $smtp_auth,\n \t\t\t\t\tcallback => {\n-- \n2.49.0\n\n"},{"id":"516461","messageId":"PN3PR01MB9597D2F55B26ECB634A2C717B8BB2@PN3PR01MB9597.INDPRD01.PROD.OUTLOOK.COM","threadId":"63324","inReplyTo":"PN3PR01MB95979D98917E3986E37267A5B8BB2@PN3PR01MB9597.INDPRD01.PROD.OUTLOOK.COM","subject":"[PATCH 2/2] send-email: retrieve Message-ID from outlook SMTP server","fromName":"Aditya Garg","fromEmail":"gargaditya08@live.com","sentAt":"2025-04-22T06:55:01Z","receivedAt":"2025-04-22T06:55:48Z","isPatch":true,"sender":{"key":"gargaditya08@live.com","avatar":"https://avatars.githubusercontent.com/u/85610623?v=4"},"body":"Outlook does not accept the Message-ID header in the email body. Instead\nit saves it in its own proprietary X-Microsoft-Original-Message-ID\nheader and a random Message-ID is set my the server. As a result,\nreplying to threads does not work.\n\nThe $smtp->message variable in this script for outlook is something like\nthis:\n\n2.0.0 OK [Hostname=Some-hostname]\n\nThis contains the Message-ID set by Microsoft in the first <>.\n\nThis patch retrieves the Message-ID from this server response\nand sets it in the email headers instead of using the self generated one.\n\nSigned-off-by: Aditya Garg \n---\n git-send-email.perl | 11 +++++++++++\n 1 file changed, 11 insertions(+)\n\ndiff --git a/git-send-email.perl b/git-send-email.perl\nindex aa6aad596f..f2a926872d 100755\n--- a/git-send-email.perl\n+++ b/git-send-email.perl\n@@ -1799,6 +1799,17 @@ sub send_message {\n \t\t\t$smtp->datasend(\"$line\") or die $smtp->message;\n \t\t}\n \t\t$smtp->dataend() or die $smtp->message;\n+\n+\t\t# Retrieve the Message-ID from the server response in case of Outlook\n+\t\tif ($smtp_server eq 'smtp.office365.com' || $smtp_server eq 'smtp-mail.outlook.com') {\n+\t\t\tif ($smtp->message =~ /<([^>]+)>/) {\n+\t\t\t\t$message_id = \"<$1>\";\n+\t\t\t\tprint __(\"Outlook: Retrieved Message-ID: $message_id\\n\");\n+\t\t\t} else {\n+\t\t\t\twarn __(\"Warning: Could not retrieve Message-ID from server response.\\n\");\n+\t\t\t}\n+\t\t}\n+\n \t\t$smtp->code =~ /250|200/ or die sprintf(__(\"Failed to send %s\\n\"), $subject).$smtp->message;\n \t}\n \tif ($quiet) {\n-- \n2.49.0\n\n"}]}