[jira] [Commented] (OFBIZ-13474) Add OAuth2/XOAUTH2 authentication for outgoing SMTP

["ASF subversion and git services (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/OFBIZ-13474?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18102670#comment-18102670 ] 

ASF subversion and git services commented on OFBIZ-13474:
---------------------------------------------------------

Commit 460b031756875e6234b313f38744fa5ec02ee669 in ofbiz-framework's branch refs/heads/trunk from Mridul Pathak
[ https://gitbox.apache.org/repos/asf?p=ofbiz-framework.git;h=460b031756 ]

Fixed: MultiTrustManager doing flat cert-equality checks instead of real X.509 chain validation (OFBIZ-13476) (#1545)

MultiTrustManager.isTrusted() only accepted certificates that were byte-identical to one already stored in a configured trust KeyStore, instead of validating the certificate chain up to a trusted root. This rejected any real, externally-issued certificate (e.g. Google Trust Services certs used by the OAuth2 endpoints surfaced in OFBIZ-13474) even when the correct root CA was present and trusted. checkClientTrusted/checkServerTrusted now delegate to a standard TrustManagerFactory-backed X509TrustManager built from the same trust anchors, giving genuine PKIX path validation while preserving the existing client.all-trusted/server.all-trusted fallback behavior.

> Add OAuth2/XOAUTH2 authentication for outgoing SMTP
> ---------------------------------------------------
>
>                 Key: OFBIZ-13474
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-13474
>             Project: OFBiz
>          Issue Type: New Feature
>          Components: framework/common
>    Affects Versions: Upcoming Branch
>            Reporter: Mridul Pathak
>            Assignee: Mridul Pathak
>            Priority: Major
>
> OFBIZ-13465 migrated OFBiz mail to Jakarta Mail / Eclipse Angus Mail, which supports SASL XOAUTH2 for SMTP. Gmail and Office365 are each moving toward OAuth2 for SMTP auth. Google retired the ["less secure apps" password toggle|https://knowledge.workspace.google.com/admin/sync/transition-from-less-secure-apps-to-oauth?hl=en] for Workspace on 2025-03-14, though App Passwords still work. Microsoft's Exchange Online basic-auth SMTP AUTH goes default-off for existing tenants end of 2026, per [Microsoft's updated deprecation timeline|https://techcommunity.microsoft.com/blog/exchange/updated-exchange-online-smtp-auth-basic-authentication-deprecation-timeline/4489835], with final removal not yet scheduled.
> Add XOAUTH2 as a second supported auth mechanism in {{EmailServices.sendMail}}, alongside existing basic auth — not a replacement for it, since many installs use plain SMTP relays unaffected by either provider's timeline.
> Proposed approach:
> * New encrypted entity {{MailSmtpConfig}} holding all {{mail.smtp.*}} settings (relay/port/starttls/etc., basic-auth user/password, and new OAuth2 fields: client id/secret, refresh token, token endpoint, scope), modeled on the existing {{encrypt="true"}} pattern used by {{firstdatapaymentgateway}}.
> * Per-field fallback to {{general.properties}}/{{SystemProperty}} for full backward compatibility — no forced migration.
> * Access tokens obtained via standard OAuth2 refresh-token grant against a configurable token endpoint (provider-agnostic, no Gmail/Office365-specific code).
> * Initial refresh token is bootstrapped manually (admin obtains it out-of-band, pastes into the entity).



--
This message was sent by Atlassian Jira
(v8.20.10#820010)