dev/mail#79 - Fix MS Exchange/IMAP. Use OpenID Connect.

[totten]

Overview

This addresses a bug (https://lab.civicrm.org/dev/mail/-/issues/79) where the OAuth2 implementation does not work with MS Exchange Online's IMAP.

Before

When requesting a token for the ms-exchange provider, Civi requests multiple permissions, including User.Read (to determine the default email address) and IMAP.AccessAsUser.All (to connect the relevant mailbox).

Thanks to @demeritcowboy's debugging, we can see there is a problem in Microsoft's services: it treats these permissions as mutually-exclusive. (If you have User.Read permission, then IMAP.AccessAsUser.All does not work.)

After

Stop requesting User.Read permission. Consequently, we can't read the default email address from https://graph.microsoft.com/v1.0/me. Instead, we can use OpenID Connect to determine the email address.

Comments

Tested in local builds of 5.32.beta with both:

• https://github.com/totten/oauth2-imap-demo - Complete the consolidated pageflow, get some real IMAP data
• dmaster - Apply patch and flush caches. Register a new "Mail Account" and run "Save & Test".

[civibot]

(Standard links)

• If this is your first pull-request for CiviCRM, please browse CONTRIBUTING.md for information about the development and testing processes.
• If you are reviewing this pull-request, you may wish to consult the test sites and the Review Standards (long template, short template).

[seamuslee001]

@totten should this be against the 5.32 branch?

[totten]

@seamuslee001 Yes, thanks for catching that. Switched it over.

[demeritcowboy]

• Yay it works.
• I'm still seeing User.Read showing up, and with the wrong scope, but since it comes at the end of the list and it's not being accessed it doesn't affect anything. I'm not sure where it's coming from - I also tried deleting the token/mail account and cleared caches and started again.
  • Oauth admin:
    
  • Inspect:
    
• Also checked that google was still working (although still having refresh token acquisition problems for google but it's probably separate).
• Just a note regarding outlook.office365.com vs outlook.office.com - it looks like this was changed in May but without any explanation. They seem to be equivalent but yes seems office.com is the more current.

[seamuslee001]

I'm going to merge based on @demeritcowboy 's testing