Vtiger will be incompatible with Google workspace by Sep. 30th

Per september 30th 2024, Google Workspace will no longer support "Less secure apps" where password is used for authentification.

This will disable the use of the folowing vtiger features:

• Email module
• Mail Manager module
• Campaigns module
• Mail scanner
• Mail workflows
• In general sending emails from within vtiger

Including popular third party extensions as Email Maker, PDF Maker

This is information from Google Workspace:

Starting September 30, 2024, Google Workspace accounts will only allow access to apps using OAuth. Password-based access (with the exception of App Passwords) will no longer be supported. POP and IMAP are NOT going away and can still be enabled with apps that connect using OAuth. Dear Administrator,

We’re writing to remind you that as we previously shared in this blog post and in an email sent in mid-January, we’ll be turning off access to less secure apps (LSA) — non-Google apps that can access Google Workspace accounts with only a username and password (basic authentication) — starting June 15, 2024. What you need to know Access through basic authentication makes accounts more vulnerable to hijacking attempts. Moving forward, only apps that support a more modern and secure access method called OAuth will be able to access Google Workspace accounts. Access to LSAs will be turned off in two stages:

1. Beginning June 15, 2024 - The LSA settings will be removed from the Admin console and can no longer be changed. Enabled users can connect after that time, but disabled users will no longer be able to access LSAs. This includes all third-party apps that require password-only access to Gmail, Google Calendar, Contacts via protocols such as CalDAV, CardDAV, IMAP, SMTP, and POP.
2. The IMAP enable/disable settings will be removed from users’ Gmail settings.

If you’ve been using LSAs prior to this date, you can continue using them until September 30, 2024.

Beginning September 30, 2024 - Access to LSAs will be turned off for all Google Workspace accounts. CalDAV, CardDAV, IMAP, and POP will no longer work when signing in with just a password — you will need to login with a more secure type of access called OAuth.

Starting September 30, 2024, Google Workspace accounts will only allow access to apps using OAuth. Password-based access (with the exception of App Passwords) ....

It sounds like if the App Password is used, the IMAP/SMTP should still work? Also, an alternative SMTP auth for Google Workplace is an smtp relay. Fairly easy to configure.

Regardless, we really need OAuth for Gmail/Office 365.

@prasad thoughts?

Nope SMTP and IMAP won't work Beginning September 30, 2024 - Access to LSAs will be turned off for all Google Workspace accounts. CalDAV, CardDAV, IMAP, and POP will no longer work when signing in with just a password — you will need to login with a more secure type of access called OAuth.

Hi, Phpmailer has two examples , one for google xauth

https://github.com/PHPMailer/PHPMailer/blob/master/examples/gmail_xoauth.phps

and another for microsoft xauth

https://github.com/PHPMailer/PHPMailer/blob/master/examples/azure_xoauth2.phps

If I recall correctly @prasad was working on it to adapt it to vtiger.

I tried this many times passing access_token as XAUTH2 through PHPMailer but get (status=334, AUTH command failed). Verified access_token with this script and re-run with PHP worked!

Bit strange to observe Google imposed a block? Account recover failed as I tried too many times to get access token during development?

Hi Prasad I've worked I've made it work too with the following:

composer require phpmailer/phpmailer

composer require league/oauth2-google

create a project with google cloud, go to https://console.developers.google.com/apis/credentials

to set oauth with yourdomain.com/get_oauth_token.php as redirect url

then try:

https://github.com/PHPMailer/PHPMailer/blob/master/get_oauth_token.php

and work to obtain a temporary token, once you get it, fill in email, client id and client secret and refreshToken in gmai_xoauth.phps

https://github.com/PHPMailer/PHPMailer/blob/master/examples/gmail_xoauth.phps

then disable or comment Option 2 (MyOAuthTokenProvider)

set body email using $mail->Body='ciao';

run the script.

Let me know if it works for you too! @prasad

@angelo.paglialonga - I'm trying to reach Google support to get oAuth2 flow to work for me. Not able to login with OTP after oAuth2 login. Google prompts me to Recover account. Suspecting account locked - need to wait for 7 days!

PHPMailer is for SMTP, IMAP will still be a problem.

PHP Ref: https://github.com/php/php-src/issues/10540 (closed!)

I found email-oauth2-proxy as alternative approach. Which does not expect changes in the CRM. Haven't had chance to try tough.

Hi @prasad for imap and OAuth there is this solution (look the first answer) does it looks workable for mailscanner and mail manager to you?

https://stackoverflow.com/questions/73370661/php-connect-mailbox-office-365-with-oauth

uses https://github.com/Webklex/php-imap

changed milestone to %8.3.0

added enhancement label

marked this issue as related to #1915 (closed)

• Changes to OutgoingServer, MailManager and MailConverter - #1915 (closed)
• Gmail Imap Proxy to get tunneling work for imap_* API - #1914 (closed)

closed

@angelo.paglialonga @support.vtexperts1 - thanks for your assistance.