Announcing Client Credential Flow for SMTP AUTH in Exchange Online

mwickens They must be getting this confused with Basic Auth. You can safely use the methodology in the post, there are no plans for it to be deprecated. 

So is it possible to to use CCF with Send-Mailmessage?

AWeinmann You can use this - SmtpClientDiag/SmtpClientDiag.psm1 at master · richfaj/SmtpClientDiag · GitHub (SmtpClientDiag/README.md at master · richfaj/SmtpClientDiag · GitHub)

Many thanks for this.  With this now here, can we please have some commentary around this vs Anonymous SMTP relay via an Exchange Receive Connector?  Does Microsoft see CCF for SMTP as a proper option/ alternative to SMTP relaying?

Seems like it to me but am not sure I am on the right path with this.

any body able to do a walk through post on this, i followed the steps in given links, added the permission to the service principal and full permission to mailbox but it still doesn't work for me"

!! its working now !!

I am still having trouble accessing the token server.  I am not using the MSAL libraries, but rather am accessing it directly.  I am going to then use that token to send the email via java mail.

Using the scope:  "https://outlook.office.com/SMTP.SendAsApp" causes the server to respond with "400 - Bad Request" and using the scope:  "https://outlook.office365.com/.default" (which was how it was previously documented) causes the server to respond with "401 - Unauthorized". 

Here is my code that accesses the token server.   Please let me know if you see any issues with what I am doing.  Thanks in advance!

public class OAuthToken {
  public String getAuthToken() throws IOException, NoSuchAlgorithmException, KeyManagementException {
  // Create a trust manager that does not validate certificate chains
  TrustManager[] trustAllCerts = new TrustManager[] {new X509TrustManager() {
    @Override
    public java.security.cert.X509Certificate[] getAcceptedIssuers() {
      return null;
    }
    @Override
    public void checkClientTrusted(X509Certificate[] certs, String authType) {
    }
    @Override
    public void checkServerTrusted(X509Certificate[] certs, String authType) {
    }
  }
};

// Install the all-trusting trust manager
SSLContext sc = SSLContext.getInstance("TLS");
sc.init(null, trustAllCerts, new java.security.SecureRandom());
HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());

// Create all-trusting host name verifier
HostnameVerifier allHostsValid = new HostnameVerifier() {
  @Override
  public boolean verify(String hostname, SSLSession session) {
    return true;
  }
};

// These are dummy values.  I have removed the actual values that allow connections to my server.
String clientId = "my-client-id";
String tenantId = "my-tenant-id";
String scope = "https://outlook.office.com/SMTP.SendAsApp";
String client_secret = "my-client-secret";
String grant_type = "client_credentials";

// Install the all-trusting host verifier
HttpsURLConnection.setDefaultHostnameVerifier(allHostsValid);
StringBuilder data = new StringBuilder();

data.append("client_id=").append(clientId).append("&");
data.append("scope=").append(scope).append("&");
data.append("client_secret=").append(client_secret).append("&");
data.append("grant_type=").append(grant_type);

byte[] byteArray = data.toString().getBytes(StandardCharsets.UTF_8);

String urlString = "https://login.microsoftonline.com/" + tenantId + "/oauth2/v2.0/token";
URL url = new URL(urlString);

HttpsURLConnection connection = (HttpsURLConnection) url.openConnection();
connection.setRequestMethod("POST");
connection.setRequestProperty("Host", "login.microsoftonline.com");
connection.setRequestProperty("Content-Type", "application/x-www-form-urlencoded");
connection.setRequestProperty("charset", "utf-8");
connection.setRequestProperty("Content-Length", Integer.toString(byteArray.length));
connection.setConnectTimeout(5000);
connection.setUseCaches(false);
connection.setDoOutput(true);
try (OutputStream postStream = connection.getOutputStream()) {
  postStream.write(byteArray, 0, byteArray.length);
}

// Debug information...
int responseCode = connection.getResponseCode();
String responseMessage = connection.getResponseMessage();

System.out.println("Response code = " + responseCode + ", Response description = " + responseMessage);

InputStreamReader reader = new InputStreamReader(connection.getInputStream());
String accessToken;
try (BufferedReader in = new BufferedReader(reader)) {
  String json = in.readLine();
  if (json.length() > 0)
    System.out.println("Json String = " + json);
  else 
    throw new IOException("No response returned from server while attempting to acquire access token.");

  // Parse the Json response and retrieve the Access Token
  Gson gson = new Gson();
  Type mapType = new TypeToken<Map<String,String>>(){}.getType();
  Map<String,String> response = gson.fromJson(json, mapType);
  accessToken = response.get("access_token");
  System.out.println("Access Token = " + accessToken);

} finally {
  connection.disconnect();
}

return accessToken;
}

Sunil Chauhan 

Can you tell me what you did to get your implementation working?   What kind of errors were you seeing when it wasn't working?

I cannot find any clues as to why it is failing....

Thanks in Advance

I am now able to get the access token, but now I am having problems sending the SMTP mail message.  All I get is that Authentication Failed but it is not telling me WHY it failed.

This is the code snippet:

// Create a mail session        

Properties props = new Properties();        
props.put("mail.smtp.host", smtpHost);        
props.put("mail.smtp.port", "" + smtpPort);        
props.put("mail.smtp.connectiontimeout", "10000");        
props.put("mail.smtp.timeout", "10000");        
props.put("mail.smtp.sendpartial", "true");        
props.put("mail.smtp.starttls.enable", "true");        
props.put("mail.smtp.ssl.trust", "*"); 

// Get the bearer token for OAUTH2 Access to the MS Exchange/365 server              
OAuthToken oauth = new OAuthToken();               
String authToken = oauth.getAuthToken();                      

props.put("mail.smtp.auth.mechanisms", "XOAUTH2");
props.put("mail.smtp.sasl.mechanisms.oauth2.oauthToken", authToken);
props.put("mail.smtp.auth.login.disable", "true");               
props.put("mail.smtp.auth.plain.disable", "true");               
props.put("mail.smtp.auth.xoauth2.disable", "false");                
props.put("mail.smtp.auth", "true");               
props.put("mail.debug.auth", "true");               
props.put("mail.debug.auth.password", "true");        

Session session = Session.getInstance(props, null);              
session.setDebug(debug);

// Construct the message       
Message msg = new MimeMessage(session);       
msg.setFrom(new InternetAddress(fromAddr));       
msg.setSubject(subject);
msg.setText(content);
msg.saveChanges();

try {
  transport = session.getTransport("smtp");      
  transport.connect(user, authToken);      
  transport.sendMessage(msg, msg.getAllRecipients());
} finally {
  transport.close(); 
} 

This is the debug output that is being generated:

Response code = 200, Response description = OK
Json String = {"token_type":"Bearer","expires_in":3599,"ext_expires_in":3599,"access_token":"my-access-token"}
DEBUG: JavaMail version 1.6.2
DEBUG: successfully loaded resource: /META-INF/javamail.default.address.map
DEBUG: setDebug: JavaMail version 1.6.2
DEBUG: getProvider() returning javax.mail.Provider[TRANSPORT,smtp,com.sun.mail.smtp.SMTPTransport,Oracle]
DEBUG SMTP: useEhlo true, useAuth true
DEBUG SMTP: trying to connect to host "myhost", port 587, isSSL false
220 CH0P220CA0002.outlook.office365.com Microsoft ESMTP MAIL Service ready at Tue, 1 Aug 2023 19:16:40 +0000
DEBUG SMTP: connected to host "myhost", port: 587
EHLO Laptop2
250-CH0P220CA0002.outlook.office365.com Hello [xx.xx.xx.xx]
250-SIZE 157286400
250-PIPELINING
250-DSN
250-ENHANCEDSTATUSCODES
250-STARTTLS
250-8BITMIME
250-BINARYMIME
250-CHUNKING
250 SMTPUTF8
DEBUG SMTP: Found extension "SIZE", arg "157286400"
DEBUG SMTP: Found extension "PIPELINING", arg ""
DEBUG SMTP: Found extension "DSN", arg ""
DEBUG SMTP: Found extension "ENHANCEDSTATUSCODES", arg ""
DEBUG SMTP: Found extension "STARTTLS", arg ""
DEBUG SMTP: Found extension "8BITMIME", arg ""
DEBUG SMTP: Found extension "BINARYMIME", arg ""
DEBUG SMTP: Found extension "CHUNKING", arg ""
DEBUG SMTP: Found extension "SMTPUTF8", arg ""
STARTTLS
220 2.0.0 SMTP server ready
EHLO Laptop2
250-CH0P220CA0002.outlook.office365.com Hello [xx.xx.xx.xx]
250-SIZE 157286400
250-PIPELINING
250-DSN
250-ENHANCEDSTATUSCODES
250-AUTH LOGIN XOAUTH2
250-8BITMIME
250-BINARYMIME
250-CHUNKING
250 SMTPUTF8
DEBUG SMTP: Found extension "SIZE", arg "157286400"
DEBUG SMTP: Found extension "PIPELINING", arg ""
DEBUG SMTP: Found extension "DSN", arg ""
DEBUG SMTP: Found extension "ENHANCEDSTATUSCODES", arg ""
DEBUG SMTP: Found extension "AUTH", arg "LOGIN XOAUTH2"
DEBUG SMTP: Found extension "8BITMIME", arg ""
DEBUG SMTP: Found extension "BINARYMIME", arg ""
DEBUG SMTP: Found extension "CHUNKING", arg ""
DEBUG SMTP: Found extension "SMTPUTF8", arg ""
DEBUG SMTP: protocolConnect login, host=myhost.com, user=myuser, password=my-password
DEBUG SMTP: Attempt to authenticate using mechanisms: XOAUTH2
DEBUG SMTP: Using mechanism XOAUTH2
AUTH XOAUTH2 base64-encoded-password-in-correct-form
535 5.7.3 Authentication unsuccessful [CH0P220CA0002.NAMP220.PROD.OUTLOOK.COM 2023-08-01T19:16:49.039Z 08DB921EAC5372F4]
23/08/01 14:16:47 ERROR mailer.MailMessage: Failure sending message [host:myhost.com, port: 587, user: myuser, recipient: recipient-email-address
javax.mail.AuthenticationFailedException: 535 5.7.3 Authentication unsuccessful [CH0P220CA0002.NAMP220.PROD.OUTLOOK.COM 2023-08-01T19:16:49.039Z 08DB921EAC5372F4]
at com.sun.mail.smtp.SMTPTransport$Authenticator.authenticate(SMTPTransport.java:965)
at com.sun.mail.smtp.SMTPTransport.authenticate(SMTPTransport.java:876)
at com.sun.mail.smtp.SMTPTransport.protocolConnect(SMTPTransport.java:780)
at javax.mail.Service.connect(Service.java:366)
at javax.mail.Service.connect(Service.java:246)
at javax.mail.Service.connect(Service.java:267)
at com.dgi.insitusvc.mailer.MailMessage.send(MailMessage.java:167)
at com.dgi.insitusvc.mailer.TestMailer.sendEmail(TestMailer.java:37)
at com.dgi.insitusvc.mailer.TestMailer.<init>(TestMailer.java:16)
at com.dgi.insitusvc.mailer.TestMailer.main(TestMailer.java:43)
Failure sending message [host:myhost.com, port: 587, user: myuser, recipient: recipient-email-address

[Update:]

After some expert assistance from our server administrator, I can now send SMTP emails.   

Our Azure server was not fully configured.  The last steps described here-> https://learn.microsoft.com/en-us/exchange/client-developer/legacy-protocols/how-to-authenticate-an-imap-pop-smtp-application-by-using-oauth#register-service-principals-in-exchange to create the service principal and give it permissions to the target mailbox had not been done. 

Once this was completed, my SMTP emails using the code above worked like a charm!

Hopefully this will help others experiencing this issue.

Debra_P 

my problem was simple i was just working with the graph api permissions token for smtp auth to work you need to scope it to use the office 365, here is the example of working code.

$AT=Get-MsalToken -ClientId $appID -ClientSecret (ConvertTo-SecureString $secret -AsPlainText -Force) `
-TenantId $dirid -Scope 'https://outlook.office365.com/.default'

for the rest i made full details post below.

https://www.lab365.in/2023/07/CCFforSMTPAUTH.html