#35 Automatic OAuth Token Refresh for SMTP

[Xenbeat]

Hello,

Currently, we are using JS7 v2.5.3 to send emails via Gmail's SMTP server (smtp.gmail.com) with basic authentication (username and password). However, due to Google's policy changes, basic authentication is being deprecated, and OAuth authentication is now required.

To comply with this change, we are attempting to configure JS7 to send emails using OAuth authentication. However, based on the documentation, it appears that JS7 only provides a field to manually input an access token, without an automatic mechanism to obtain or refresh it. Since access tokens have a limited lifespan, this means that administrators must manually retrieve and update the token periodically.

Feature Request
We request the implementation of an automatic OAuth token management feature in JS7. Specifically, this feature should:

1. Automatically obtain and refresh the access token using the refresh token, along with the client ID and client secret, without requiring manual intervention.
2. Ensure continuous email delivery by seamlessly handling token expiration.

We appreciate your consideration and look forward to your response. Please let us know if any additional details are required.

Best regards,

[Andreas]

Hi,

thank you. Let's check if this needs a feature request.

Architecture first: If JOC Cockpit were in charge to obtain a renewed access token then this includes that JOC Cockpit monitors the renewal period, knows how to renew an access token and knows how to authenticate (which in turn will require access to some secret). There are a thousand ways how to do it and this will not result in an acceptable standard for the product.

Think it the other way round: You (or your application) know when it's time to renew an access token, know what to renew and how to renew and know how to authenticate. Assuming that the "trigger" for renewal is outside of JOC Cockpit's reach, you could run your own code/script that performs renewal and that stores the new access token to the eMailDefault (or any other) Job Resource.

To this purpose, find the following interfaces how to store/update a value to a Job Resource variable:

• https://kb.sos-berlin.com/display/JS7/JS7+-+How+to+update+a+Job+Resource+using+Unix+Shell
• https://kb.sos-berlin.com/display/JS7/JS7+-+How+to+update+a+Job+Resource+using+PowerShell
• https://kb.sos-berlin.com/display/JS7/JS7+-+JITL+SetJobResourceJob

The process can be automated from a job if the trigger for renewal is time-based. This might boil down to a job script for Unix like this:

# your code to renew the access token

# store access token to Job Resource
${JS7_AGENT_HOME}/bin/js7_set_job_resource.sh \
    --url=http://joc-2-0-primary:7446 \
     ...
    --job-resource=eMailDefault \
    --key=mail.smtp.sasl.mechanisms.oauth2.oauthToken \
    --value=<access-token>

The above offers to encrypt (and to automatically decrypt) the access token, for details and examples see https://kb.sos-berlin.com/display/JS7/JS7+-+Encryption+-+Integration+with+Secret+Manager+Products

BTW: we will be happy to find a wording in your future posts that will "ask" for a feature instead of "request" a feature. We are not your service desk.