OAUTHBEARER authentication fails in mutt

Question

I've used OAUTHBEARER authentication to use mutt with GMail for a while, but I've run into a an issue that I can't figure out. When I launch mutt I get OAUTHBEARER authentication failed. Here is .muttdebug0:

[2020-08-27 10:38:59] TLSv1.3 connection using TLSv1.3 (TLS_AES_256_GCM_SHA384)
[2020-08-27 10:39:00] Connected to imap.gmail.com:993 on fd=7
[2020-08-27 10:39:00] imap_cmd_step: grew buffer to 512 bytes
[2020-08-27 10:39:00] 7< * OK Gimap ready for requests from XX.XX.XX.XX r65mb112981108pjg
[2020-08-27 10:39:00] IMAP queue drained
[2020-08-27 10:39:00] 7> a0000 CAPABILITY
[2020-08-27 10:39:00] 7< * CAPABILITY IMAP4rev1 UNSELECT IDLE NAMESPACE QUOTA ID XLIST CHILDREN X-GM-EXT-1 XYZZY SASL-IR AUTH=XOAUTH2 AUTH=PLAIN AUTH=PLAIN-CLIENTTOKEN AUTH=OAUTHBEARER AUTH=XOAUTH
[2020-08-27 10:39:00] Handling CAPABILITY
[2020-08-27 10:39:00] 7< a0000 OK Thats all she wrote! r65mb112981108pjg
[2020-08-27 10:39:00] IMAP queue drained
[2020-08-27 10:39:00] imap_authenticate: Trying method oauthbearer
[2020-08-27 10:39:00] Authenticating (OAUTHBEARER)...
[2020-08-27 10:39:00] 7> a0001 AUTHENTICATE OAUTHBEARER bixhPWN3YWxrYXRyb25AZ21haWwuXXXXX=
[2020-08-27 10:39:01] 7< + eyJXXXXXXX29nbGUuY29tLyJ9
[2020-08-27 10:39:01] 7> [2020-08-27 10:39:01] OAUTHBEARER authentication failed.

I have a project set up in the Google Dev console and a client_id and client_secret. I get a warning that I have to specifically ignore about my Google Developer app being unverified that I have to explicitly allow. I don't remember this being an issue in the past. I can successfully log in using:

oauth2.py [email protected] --client_id=56843257498 --client_secret=fjdksla --generate_oauth2_token

This is in my .muttrc:

set imap_oauth_refresh_command="~me/bin/oauth2.py \
    --user [email protected] \
    --client_id=60080XXX.apps.googleusercontent.com \
    --client_secret=AZXXXX \
    --refresh_token=1//XXXXAYSNwF"
set smtp_oauth_refresh_command="~me/bin/oauth2.py \
    [email protected] \
    --client_id=60080XXX.apps.googleusercontent.com \
    --client_secret=AZXXXX \
    --refresh_token=1//XXXXAYSNwF"

The above commands run fine in a shell. Also, a test with oauth2.py succeeds as well (though this tests XOAUTH2 and not OAUTHBEARER).

  10:30.51 > HNNF1 AUTHENTICATE XOAUTH2
  10:30.54 < +
  10:30.54 write literal size 280
  10:31.24 < * CAPABILITY IMAP4rev1 UNSELECT IDLE NAMESPACE QUOTA ID XLIST CHILDREN X-GM-EXT-1 UIDPLUS COMPRESS=DEFLATE ENABLE MOVE CONDSTORE ESEARCH UTF8=ACCEPT LIST-EXTENDED LIST-STATUS LITERAL- SPECIAL-USE APPENDLIMIT=35651584
  10:31.24 < HNNF1 OK [email protected] authenticated (Success)
  10:31.24 > HNNF2 SELECT INBOX
  10:31.50 < * FLAGS (\Answered \Flagged \Draft \Deleted \Seen $Forwarded $Junk $NotJunk $NotPhishing $Phishing)
  10:31.50 < * OK [PERMANENTFLAGS (\Answered \Flagged \Draft \Deleted \Seen $Forwarded $Junk $NotJunk $NotPhishing $Phishing \*)] Flags permitted.
  10:31.50 < * OK [UIDVALIDITY 2] UIDs valid.
  10:31.50 < * 1060 EXISTS
  10:31.50 < * 0 RECENT
  10:31.50 < * OK [UIDNEXT 51915] Predicted next UID.
  10:31.50 < * OK [HIGHESTMODSEQ 5748372]
  10:31.50 < HNNF2 OK [READ-WRITE] INBOX selected. (Success)

I have this all set up and working for my work email, but not for my personal. I feel like I'm just missing something simple. Can anyone help me see my mistake?

Jakub Jindra · Answer 1 · 2020-10-01T08:59:44.760

2

According to example in mutt or neomutt docs the script oauth2.py in {smtp,imap,pop}_oauth_refresh_command should include --quiet option.

It's not clear from the documentation that this is important. But I've just tested it on mine setup with SMTP. Without the option I'm getting authentication error also.

edited Oct 01 '20 at 08:59

answered Aug 28 '20 at 07:27

Jakub Jindra

1,392
1
12
25

Thanks for checking. I tried it with `--quiet` and get the same error. – Chris W. Aug 28 '20 at 16:39

score 2 · Accepted Answer · answered Aug 28 '20 at 17:07

I figured this out. I had a change in my oauth2.py that printed the json response instead of just the access_token. mutt was passing the base64-encoded json as the bearer token which is not correct. Thanks to @jakub-jindra for pointing me toward the --quiet option.

I figured this out by running mutt -d 5 which shows the base64-encoded payload that it passes to GMail:

[2020-08-28 10:00:54] Authenticating (OAUTHBEARER)...
[2020-08-28 10:00:54] 7> a0001 AUTHENTICATE OAUTHBEARER XXXXXXXXXX$XXXXInfQEB
[2020-08-28 10:00:55] 7< + XXXXXXXXXX
[2020-08-28 10:00:55] 7> [2020-08-28 10:00:55] OAUTHBEARER authentication failed.

I base-64 decoded that and got:

n,[email protected],host=imap.gmail.comport=993auth=Bearer {u'access_token': u'ya29.a0XXXXXX', u'scope': u'https://mail.google.com/', u'expires_in': 3599, u'token_type': u'Bearer'}

Hope this helps someone!

OAUTHBEARER authentication fails in mutt

2 Answers2