1757713 - migrate google accounts to OAuth2 authentication (password only, Less secure apps will not work starting May 30, 2022)

Status: RESOLVED FIXED

(Thunderbird :: General, task, P1)

Description

[Magnus Melin [:mkmelin]]

https://support.google.com/accounts/answer/6010255?hl=en

Less secure apps & your Google Account

To help keep your account secure, starting May 30, 2022, ​​Google will no longer support the use of third-party apps or devices which ask you to sign in to your Google Account using only your username and password. For more information, please continue reading.

---

We should add a migration that goes through imap/pop3/smtp accounts and, if google, migrate them to using OAuth2 instead of "password", since that will not work soon.

Bug 1670892 did similar things for Yahoo.

Comment 1

[Sean Burke [:leftmostcat]]

Attachment: Bug 1757713 - migrate Google accounts to oauth2. r=mkmelin

Comment 2

[Magnus Melin [:mkmelin]]

When the patch is ready, you can set the checkin-needed-tb keyword on the bug, and someone will land it soon.
I need something to land now, so going to grab this one.

Comment 3

[Magnus Melin [:mkmelin]]

Actually, seems the test fails so will hold off on landing
./mach test comm/mail/base/test/unit/test_oauth_migration.js

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/c89c8b223f3c
migrate Google accounts to oauth2. r=mkmelin

Comment 5

[Wayne Mery (:wsmwk)]

Comment on attachment 9266634 [details]
Bug 1757713 - migrate Google accounts to oauth2. r=mkmelin

[Triage Comment]
Approved for beta

Comment 6

[Rob Lemley [:rjl]]

Thunderbird 99.0b2:
https://hg.mozilla.org/releases/comm-beta/rev/85ac455794de

Comment 7

[Rob Lemley [:rjl]]

This will need rebasing for c-esr91.

Comment 8

[Sean Burke [:leftmostcat]]

Attachment: Bug_1757713___migrate_Google_accounts_to_oauth2__r_mkmelin.diff

[Approval Request Comment]
User impact if declined:
Starting at the end of May, users using "Less secure apps" setting of Gmail and cleartext passwords in Thunderbird will receive incorrect password errors and would need to manually migrate Gmail accounts to use OAuth.

Testing completed (on c-c, etc.):
Patch is present in 99b2, unit tests present.

Risk to taking this patch (and alternatives if risky):
Migration may fail and/or cause side effects in using Gmail. Possibility for user confusion when presented with Google OAuth authorization window.

Comment 9

[Magnus Melin [:mkmelin]]

Comment on attachment 9269948 [details] [diff] [review]
Bug_1757713___migrate_Google_accounts_to_oauth2__r_mkmelin.diff

Review of attachment 9269948 [details] [diff] [review]:
-----------------------------------------------------------------

Looks reasonable to me!

Comment 10

[Wayne Mery (:wsmwk)]

Comment on attachment 9269948 [details] [diff] [review]
Bug_1757713___migrate_Google_accounts_to_oauth2__r_mkmelin.diff

[Triage Comment]
Approved for esr91

Comment 11

[Rob Lemley [:rjl]]

Thunderbird 91.8.0:
https://hg.mozilla.org/releases/comm-esr91/rev/525d4941f487

Comment 12

[Matt]

I don't see any checking that cookies are available. Is that occurring somewhere?

Some Linux distributions appear to set the default to off, as do some "We will protect your privacy" and antivirus programs in windows for the flow to succeed some cookies are required.

Comment 14

[Wayne Mery (:wsmwk)]

Query for potentially related new bug reports https://mzl.la/3JEjbcJ

Comment 15

[Wayne Mery (:wsmwk)]

Interesting twist at https://support.mozilla.org/en-US/questions/1373955 "The installation must have looked at my email address being @gmail.com and assumed that the authentication method needed to change to OAuth2. HOWEVER, while my email address IS @gmail.com, my imap server is my own server, not gmail's. The Thunderbird update process should instead look at the actual imap server address to determine if the auth method should be changed, not the domain of the email address. "

Comment 16

[Sean Burke [:leftmostcat]]

That assumption is incorrect; the OAuth2 migration would only occur if the incoming hostname ended with "imap.gmail.com".

Comment 17

[Magnus Melin [:mkmelin]]

And how can someone have @gmail.com on their own server?? (In real usage.)

Comment 18

[rmueller83]

The migration is incomplete. I have 2 gmail accounts from which one worked, the other did not. The older account used pop.googlemail.com which is still a valid and working domain. You should extend the migration to support this old domain, too (and perhaps automatically migrate from googlemail.com to gmail.com).

Comment 19

[Rene]

had the same problem. I solved it since I had a second computer that still had an slightly older TB on it. No bug in the older version, OAuth was configured without no issues at all, even for a completely new account. then I just migrated (copied) my TB account folder to the machine with the actual Tb 91.9.1 (64-Bit) on ubuntu version and obviously, it had copied the working OAuth token, too. Working fine now, but there seems to be a bug in the Tb 91.9.1 (64-Bit) on ubuntu version that need to be fixed in the next update, please

Comment 20

[Sean Burke [:leftmostcat]]

This is very late, sorry, but I've filed bug 1799322 to address googlemail.com.