1966306 - Support custom application and tenant id for OAuth

Status: RESOLVED DUPLICATE of bug 1995859

(Thunderbird :: Account Manager, enhancement)

Description

[Robert Wolff (:mahlzahn)]

Steps to reproduce:

On Thunderbird nightly, I tested the integration of Exchange Web Services. My Organisation doesn’t allow many applications by default, but it lists the set-up with custom application and tenant ID.

Actual results:

I can login with my credentials, but I am forwarded to a page saying that my organisation must enable EWS for Thunderbird.

Expected results:

I’d love to have an extended settings dialog that allows to set application and tenant ID, something like it is possible with Gnome’s Evolution, see https://hdkb.clemson.edu/phpkb/article.php?id=2668

Comment 1

[Brendan Abolivier [:babolivier]]

Renaming and re-triaging since the Exchange client implementation uses the same OAuth code as the rest of the application, so this is an account management/configuration feature more than one specific to Exchange. I've also added a relation to the account hub meta bug since supporting this feature would likely involve change to it.

Comment 2

[Heather Ellsworth]

@mahlzahn Thank you so much for pointing this out! We are working on an add-on that will enable the user to provide OAuth information to Thunderbird and we hope to have it ready to test in the next couple of weeks. If you're still interested in this feature, would you be willing to help us test it when it's ready?

In order for any mailserver to be able to interact with Thunderbird, there would have been a server side change to allow connecting to Thunderbird. Since this does work for you, those server side credentials have been created. Would you be able to contact your IT administrator for this information? It will be similar to what Evolution needed, and this information is what you will give to the add-on that we will give you to test.

Comment 3

[Will Shanks]

I am not the original poster but I am also willing to help test if the add-on allows setting both the application ID and the tenant ID. The instructions for my organization mirror the Clemson ones provided above, except that I need to set the tenant ID to another UUID-like string instead of "common". One caveat though is that like the Clemson instructions I use https://outlook.office365.com/EWS/Exchange.asmx for the host URL. I saw a comment on Matrix that the current Exchange support is targeted at older on premises installations for now, so I was not sure if the Microsoft hosted version on office365.com should also work right now.

Comment 4

[Robert Wolff (:mahlzahn)]

(In reply to Will Shanks from comment #3)

I am not the original poster but I am also willing to help test if the add-on allows setting both the application ID and the tenant ID. The instructions for my organization mirror the Clemson ones provided above, except that I need to set the tenant ID to another UUID-like string instead of "common". One caveat though is that like the Clemson instructions I use https://outlook.office365.com/EWS/Exchange.asmx for the host URL. I saw a comment on Matrix that the current Exchange support is targeted at older on premises installations for now, so I was not sure if the Microsoft hosted version on office365.com should also work right now.

Same here, I may try it out. I have very similar organization instructions as Will Shanks. What already works for me (but differently) is the OWL extension by Ben Bucksch (Beonex, also following this thread here).

@Heather Elssworth

Would you be able to contact your IT administrator […]

Unlikely, they aren’t very helpful in this matter :( Sorry.

Comment 5

[Toby Pilling [:tobyp]]

Thanks for your help @:mahlzahn and @Will Shanks!

Do you happen to know if your domains host any autoconfig information such as this?

https://autoconfig.example.com/mail/config-v1.1.xml?emailaddress=[e-mail]
http://example.com/.well-known/autoconfig/mail/config-v1.1.xml

Comment 6

[Ben Bucksch (:BenB)]

Docs about the expected format of the file: https://benbucksch.github.io/autoconfig-spec/draft-ietf-mailmaint-autoconfig.html and https://www.ietf.org/archive/id/draft-ietf-mailmaint-oauth-public-01.html

Comment 7

[Will Shanks]

I tried those two autoconfig url formats with my domain but they did not lead to a config file.

I am able to configure Evolution but have to do so by manually entering the application and tenant IDs. Is there some other information that is needed? Maybe I could get it by digging into the Evolution settings.

Comment 8

[Toby Pilling [:tobyp]]

Just a quick update on this so you know that we've not forgotten about you!

The current account setup and subsequent autodiscovery and autoconfig processes make some assumptions which combined with our method of associating hostnames with config sets, is making things tricky to split apart.

My plan is to make multiple unique coexisting configurations possible so you can have a hotmail account at the same time as a tenant-specific MS Cloud setup.

If you are able and willing to work with us to help test, could you get in touch with me via email so we can share some information a little more privately? (It won't be sensitive information and if you prefer to discuss here that's perfectly fine with me)

Before we head further down this path, it would be good to have somebody available to test so there might be some back-and-forth.

Comment 9

[Will Shanks]

If you are able and willing to work with us to help test, could you get in touch with me via email so we can share some information a little more privately? (It won't be sensitive information and if you prefer to discuss here that's perfectly fine with me)

Noting here for others following the bug that I sent an email.

Comment 10

[Toby Pilling [:tobyp]]

Thanks, Will. Reply sent.

Before proceeding with more extensive code changes, we'd like to ensure that we can bake-in tenant-specific settings and produce the results we're looking for.

Comment 11

[Ben Bucksch (:BenB)]

(In reply to Toby Pilling [:tobyp] from comment #8)

The current account setup and subsequent autodiscovery and autoconfig processes make some assumptions which combined with our method of associating hostnames with config sets, is making things tricky to split apart.
My plan is to make multiple unique coexisting configurations possible so you can have a hotmail account at the same time as a tenant-specific MS Cloud setup.

I suggest the following design:
If OAuth2 is configured as authentication mechanism:

1. Check whether this account has a specific custom user-provided OAuth2 configuration in the settings. If so, use it. Otherwise:
2. (Later) Dynamic OAuth2 registration, following https://www.ietf.org/archive/id/draft-ietf-mailmaint-oauth-public-01.html . Validate all requirements. If successful, use it. Otherwise:
3. Check whether there's a compiled-in OAuth2 configuration for this server hostname. If found, use it. Otherwise:
4. Show error

Comment 12

[Toby Pilling [:tobyp]]

Hi with the new pref turned on by default in bug 1995859, this is now possible.