[PR #6388] Add XoAuth2 support #3779

New issue

Open

opened 2026-03-03 10:21:30 +03:00 by kerem · 0 comments

kerem commented

2026-03-03 10:21:30 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/dani-garcia/vaultwarden/pull/6388
Author: @hnolde
Created: 10/22/2025
Status: 🔄 Open

Base: main ← Head: main

📝 Commits (10+)

e5934c1 Add XoAuth2 support to fetch the token from the SMTP Provider and refresh used by Google or Microsoft
bfbedb0 Fix: is_some_and and formatting issues
1269330 Fix: formatting issues
f6a5e53 Fix: handlebars oauth2_success, http_client, url
e5c0655 Fix: formatting
96fe363 Merge branch 'main' into main
7e3acf2 Fix: update OAuth2 state storage initialization and state token encoding
2be8e7e Fix: reorder imports and clean up whitespace in admin.rs
25fd440 Merge branch 'main' into main
1441d08 Merge branch 'main' into main

📊 Changes

19 files changed (+550 additions, -9 deletions)

View changed files

📝 .env.template (+12 -0)
➕ migrations/mysql/2025-12-26-143000_create_xoauth2/down.sql (+1 -0)
➕ migrations/mysql/2025-12-26-143000_create_xoauth2/up.sql (+4 -0)
➕ migrations/postgresql/2025-12-26-143000_create_xoauth2/down.sql (+1 -0)
➕ migrations/postgresql/2025-12-26-143000_create_xoauth2/up.sql (+4 -0)
➕ migrations/sqlite/2025-12-26-143000_create_xoauth2/down.sql (+1 -0)
➕ migrations/sqlite/2025-12-26-143000_create_xoauth2/up.sql (+4 -0)
📝 src/api/admin.rs (+149 -1)
📝 src/config.rs (+75 -2)
📝 src/db/mod.rs (+8 -0)
📝 src/db/models/mod.rs (+2 -0)
➕ src/db/models/xoauth2.rs (+51 -0)
📝 src/db/schema.rs (+7 -0)
📝 src/error.rs (+6 -0)
📝 src/mail.rs (+149 -6)
📝 src/main.rs (+1 -0)
📝 src/static/scripts/admin_settings.js (+35 -0)
➕ src/static/templates/admin/oauth2_success.hbs (+10 -0)
📝 src/static/templates/admin/settings.hbs (+30 -0)

📄 Description

This pull request adds comprehensive support for SMTP OAuth2 (XOAUTH2) authentication, enabling the system to send emails via providers that require OAuth2 (like Gmail). It introduces new configuration options, admin panel endpoints, and user interface controls for managing OAuth2 tokens and authorization flows. The implementation includes secure handling of OAuth2 state for CSRF protection, token caching, and robust validation of configuration parameters.

SMTP OAuth2 (XOAUTH2) Support

Added new configuration options for OAuth2, including smtp_oauth2_client_id, smtp_oauth2_client_secret, smtp_oauth2_auth_url, smtp_oauth2_token_url, smtp_oauth2_refresh_token, and smtp_oauth2_scopes. These allow the system to be configured for OAuth2-based SMTP authentication.
Implemented validation logic to ensure all required OAuth2 parameters are set and correctly formatted when XOAUTH2 is enabled, including checks for valid URLs and required fields. [1] [2]

Backend OAuth2 Flow and Token Management

Introduced OAuth2 authorization endpoints (/admin/oauth2/authorize and /admin/oauth2/callback) and a token refresh endpoint (/admin/test/oauth2) in the admin API, including secure state storage for CSRF protection during the OAuth2 flow. [1] [2] [3] [4]
Added logic to exchange authorization codes for refresh tokens, persist them in configuration, and refresh access tokens as needed, with token caching to minimize unnecessary requests. [1] [2]

SMTP Transport and Authentication Logic

Modified SMTP transport logic to support OAuth2: when configured, the system uses the OAuth2 access token as the SMTP password, falling back to traditional authentication if necessary, and preferring OAuth2 when both are present. [1] [2]

Admin UI Enhancements

Added UI controls and JavaScript handlers to the admin settings page for initiating OAuth2 authorization and refreshing tokens, with checks to prevent actions if unsaved config changes are present. [1] [2]

General Improvements

Made update_config_partial public to allow saving OAuth2 tokens from the OAuth2 callback handler.
Added a convenience From<&str> implementation for the Error type to simplify error handling.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/dani-garcia/vaultwarden/pull/6388 **Author:** [@hnolde](https://github.com/hnolde) **Created:** 10/22/2025 **Status:** 🔄 Open **Base:** `main` ← **Head:** `main` --- ### 📝 Commits (10+) - [`e5934c1`](https://github.com/dani-garcia/vaultwarden/commit/e5934c13e9a13083923479342eac2eb346af5f44) Add XoAuth2 support to fetch the token from the SMTP Provider and refresh used by Google or Microsoft - [`bfbedb0`](https://github.com/dani-garcia/vaultwarden/commit/bfbedb05d67770ed3b5445f36325f18d695d0cf3) Fix: is_some_and and formatting issues - [`1269330`](https://github.com/dani-garcia/vaultwarden/commit/1269330f46c807875e3493216d73a37dca9e39af) Fix: formatting issues - [`f6a5e53`](https://github.com/dani-garcia/vaultwarden/commit/f6a5e53e43e946ca64d4821dac70c5363049ef2e) Fix: handlebars oauth2_success, http_client, url - [`e5c0655`](https://github.com/dani-garcia/vaultwarden/commit/e5c0655c74b025d673b36646d3ef48b9401d4888) Fix: formatting - [`96fe363`](https://github.com/dani-garcia/vaultwarden/commit/96fe363ee53a4194e9a2c54775059ae8696dd267) Merge branch 'main' into main - [`7e3acf2`](https://github.com/dani-garcia/vaultwarden/commit/7e3acf26b4b6f3f1087beebea2ce300e5f89c283) Fix: update OAuth2 state storage initialization and state token encoding - [`2be8e7e`](https://github.com/dani-garcia/vaultwarden/commit/2be8e7e6283dfeef6f1acff15fa635202de898ce) Fix: reorder imports and clean up whitespace in admin.rs - [`25fd440`](https://github.com/dani-garcia/vaultwarden/commit/25fd4406b6b894d9d7aeb9a89d58f4ebae11f18e) Merge branch 'main' into main - [`1441d08`](https://github.com/dani-garcia/vaultwarden/commit/1441d08b11fa33318a90ab239fbfb2370af67c45) Merge branch 'main' into main ### 📊 Changes **19 files changed** (+550 additions, -9 deletions) <details> <summary>View changed files</summary> 📝 `.env.template` (+12 -0) ➕ `migrations/mysql/2025-12-26-143000_create_xoauth2/down.sql` (+1 -0) ➕ `migrations/mysql/2025-12-26-143000_create_xoauth2/up.sql` (+4 -0) ➕ `migrations/postgresql/2025-12-26-143000_create_xoauth2/down.sql` (+1 -0) ➕ `migrations/postgresql/2025-12-26-143000_create_xoauth2/up.sql` (+4 -0) ➕ `migrations/sqlite/2025-12-26-143000_create_xoauth2/down.sql` (+1 -0) ➕ `migrations/sqlite/2025-12-26-143000_create_xoauth2/up.sql` (+4 -0) 📝 `src/api/admin.rs` (+149 -1) 📝 `src/config.rs` (+75 -2) 📝 `src/db/mod.rs` (+8 -0) 📝 `src/db/models/mod.rs` (+2 -0) ➕ `src/db/models/xoauth2.rs` (+51 -0) 📝 `src/db/schema.rs` (+7 -0) 📝 `src/error.rs` (+6 -0) 📝 `src/mail.rs` (+149 -6) 📝 `src/main.rs` (+1 -0) 📝 `src/static/scripts/admin_settings.js` (+35 -0) ➕ `src/static/templates/admin/oauth2_success.hbs` (+10 -0) 📝 `src/static/templates/admin/settings.hbs` (+30 -0) </details> ### 📄 Description This pull request adds comprehensive support for SMTP OAuth2 (XOAUTH2) authentication, enabling the system to send emails via providers that require OAuth2 (like Gmail). It introduces new configuration options, admin panel endpoints, and user interface controls for managing OAuth2 tokens and authorization flows. The implementation includes secure handling of OAuth2 state for CSRF protection, token caching, and robust validation of configuration parameters. **SMTP OAuth2 (XOAUTH2) Support** - Added new configuration options for OAuth2, including `smtp_oauth2_client_id`, `smtp_oauth2_client_secret`, `smtp_oauth2_auth_url`, `smtp_oauth2_token_url`, `smtp_oauth2_refresh_token`, and `smtp_oauth2_scopes`. These allow the system to be configured for OAuth2-based SMTP authentication. - Implemented validation logic to ensure all required OAuth2 parameters are set and correctly formatted when XOAUTH2 is enabled, including checks for valid URLs and required fields. [[1]](diffhunk://#diff-cba64c21ab992eaad29fce147a08f4560a4769bc14682b8a96081a5fd02dbecdR1051-R1056) [[2]](diffhunk://#diff-cba64c21ab992eaad29fce147a08f4560a4769bc14682b8a96081a5fd02dbecdR1148-R1188) **Backend OAuth2 Flow and Token Management** - Introduced OAuth2 authorization endpoints (`/admin/oauth2/authorize` and `/admin/oauth2/callback`) and a token refresh endpoint (`/admin/test/oauth2`) in the admin API, including secure state storage for CSRF protection during the OAuth2 flow. [[1]](diffhunk://#diff-48e73dac59e5044731073f602e5331265f839bd0ea9169e2a5368d16e2dbcebeR2-R10) [[2]](diffhunk://#diff-48e73dac59e5044731073f602e5331265f839bd0ea9169e2a5368d16e2dbcebeR65-R67) [[3]](diffhunk://#diff-48e73dac59e5044731073f602e5331265f839bd0ea9169e2a5368d16e2dbcebeR99-R101) [[4]](diffhunk://#diff-48e73dac59e5044731073f602e5331265f839bd0ea9169e2a5368d16e2dbcebeR343-R494) - Added logic to exchange authorization codes for refresh tokens, persist them in configuration, and refresh access tokens as needed, with token caching to minimize unnecessary requests. [[1]](diffhunk://#diff-02d3b205a438920e7c90dc9a121d5f81f2f04940aea6f9c2b48c7adea12305dbR27-R112) [[2]](diffhunk://#diff-02d3b205a438920e7c90dc9a121d5f81f2f04940aea6f9c2b48c7adea12305dbL32-R121) **SMTP Transport and Authentication Logic** - Modified SMTP transport logic to support OAuth2: when configured, the system uses the OAuth2 access token as the SMTP password, falling back to traditional authentication if necessary, and preferring OAuth2 when both are present. [[1]](diffhunk://#diff-02d3b205a438920e7c90dc9a121d5f81f2f04940aea6f9c2b48c7adea12305dbL60-R185) [[2]](diffhunk://#diff-02d3b205a438920e7c90dc9a121d5f81f2f04940aea6f9c2b48c7adea12305dbL674-R798) **Admin UI Enhancements** - Added UI controls and JavaScript handlers to the admin settings page for initiating OAuth2 authorization and refreshing tokens, with checks to prevent actions if unsaved config changes are present. [[1]](diffhunk://#diff-afcf517ecd8a8db9f343dcbad52e2fb871838bd3f27a1e766881dc22ec426e00R29-R55) [[2]](diffhunk://#diff-afcf517ecd8a8db9f343dcbad52e2fb871838bd3f27a1e766881dc22ec426e00R255-R262) **General Improvements** - Made `update_config_partial` public to allow saving OAuth2 tokens from the OAuth2 callback handler. - Added a convenience `From<&str>` implementation for the `Error` type to simplify error handling. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>