#751 O365Token.java/setJsonToken fails because of bad scope handling

[Heinz Wrobel]

Transparent authentication currently always fails in 6.8.1 because of an incorrect scope check in O365Token.java.

6.8.1 needs the following two tweaks in O365Token.java/setJsonToken() to check for an empty string in scope or the token handling will always fail. Further up in the code scope is set using the optString() method, but without a default null, so null is not returned but an empty string. Given that the subsequent line there uses LOGGER to always dump the scope, null isn't actually all that desirable or logger handling must be conditional. Assuming the empty string, further below we must check for scope not being an empty string, or we will always fail transparent authentication because we will never what we expect if scope isn't actually provided.

if (Settings.isGraphEnabled()) {
     // Graph token required

-                if (scope != null && (!scope.contains("Mail.ReadWrite") || scope.contains(Settings.getOutlookUrl()))) {
+                if (scope != null && !"".equals(scope) && (!scope.contains("Mail.ReadWrite") || scope.contains(Settings.getOutlookUrl()))) {^M
         Settings.storeRefreshToken(username, "");
         throw new IOException("Found EWS stored token, incompatible with Graph API");
     }
 } else {
     // EWS token required
-                if (scope != null && !scope.contains("EWS")) {
+                if (scope != null && !"".equals(scope) && !scope.contains("EWS")) {^M
         // clear token
         Settings.storeRefreshToken(username, "");

[Mickael Guessant]

Actually OK with logging null scope => patch applied in trunk.

Couldn't reproduce the issue directly though, can you please provide the settings combination that still leads to empty scope (with OIDC we always get a scope)

[Heinz Wrobel]

I have forward ported my 6.0.1 patches for the client_credentials flow yesterday as I need to also switch to Graph use.
In our corporate environment with that flow, scopes do not show up.
Another topic is that Graph /me requests cannot be done in that flow. You always need to have a valid /users/ spec, which affects how the requests are built.
While it seems to work well now, I am still in prototype phase for the forward port and need to go through corporate red tape before I could formally provide “true” patches.

NXP Confidential
From: bugs@davmail.p.re.sourceforge.net bugs@davmail.p.re.sourceforge.net On Behalf Of Mickael Guessant
Sent: Friday, August 14, 2026 09:49
To: [davmail:bugs] 751@bugs.davmail.p.re.sourceforge.net
Subject: [EXT] [davmail:bugs] #751 O365Token.java/setJsonToken fails because of bad scope handling

You don't often get email from mguessan@users.sourceforge.netmguessan@users.sourceforge.net. Learn why this is importanthttps://aka.ms/LearnAboutSenderIdentification

Caution: This is an external email. Please take care when clicking links or opening attachments. When in doubt, report the message using the 'Report this email' button

Actually OK with logging null scope => patch applied in trunk.

Couldn't reproduce the issue directly though, can you please provide the settings combination that still leads to empty scope (with OIDC we always get a scope)

---

[bugs:#751]https://sourceforge.net/p/davmail/bugs/751/ O365Token.java/setJsonToken fails because of bad scope handling

Status: open
Group: latest
Created: Thu Aug 13, 2026 01:03 PM UTC by Heinz Wrobel
Last Updated: Thu Aug 13, 2026 01:03 PM UTC
Owner: Mickael Guessant

Transparent authentication currently always fails in 6.8.1 because of an incorrect scope check in O365Token.java.

6.8.1 needs the following two tweaks in O365Token.java/setJsonToken() to check for an empty string in scope or the token handling will always fail. Further up in the code scope is set using the optString() method, but without a default null, so null is not returned but an empty string. Given that the subsequent line there uses LOGGER to always dump the scope, null isn't actually all that desirable or logger handling must be conditional. Assuming the empty string, further below we must check for scope not being an empty string, or we will always fail transparent authentication because we will never what we expect if scope isn't actually provided.

if (Settings.isGraphEnabled()) {

 // Graph token required

• if (scope != null && (!scope.contains("Mail.ReadWrite") || scope.contains(Settings.getOutlookUrl()))) {

• if (scope != null && !"".equals(scope) && (!scope.contains("Mail.ReadWrite") || scope.contains(Settings.getOutlookUrl()))) {^M

   Settings.storeRefreshToken(username, "");
  
   throw new IOException("Found EWS stored token, incompatible with Graph API");
  

  }

} else {

 // EWS token required

• if (scope != null && !scope.contains("EWS")) {

• if (scope != null && !"".equals(scope) && !scope.contains("EWS")) {^M

   // clear token
  
   Settings.storeRefreshToken(username, "");
  

---

Sent from sourceforge.net because you indicated interest in https://sourceforge.net/p/davmail/bugs/751/

To unsubscribe from further messages, please visit https://sourceforge.net/auth/subscriptions/