Google email via OAuth not possible?

antgel · March 31, 2025, 3:23pm

Thanks @revant_one for pointing me here from Connected App for outgoing email via OAuth.

We’re currently sending outgoing mail with Google Workspace SMTP Relay with authentication off (limited by IP addresses). But I’m wondering now if what I want to do will even work as Google Workspace seems to use JWT, not OAuth for service accounts / domain-wide delegation. Is there a way to get ERPNext to work with Google Workspace for sending outgoing mail without linking to any specific user? (I also have admin on Google Workspace / Cloud.)

(We don’t want to create accounts for non-human users, they should be aliases, so we want to start with my account and use the “Use different Email ID” option.

I then tried setting OAuth up anyway with my personal company email account, just to see if that would work. I was able to set up the OAuth Connected App and authenticate with “Connect to…”.

But when I went back to Email Account, enabled SMTP authentication, and chose OAuth with this connected app, I got the following message:

Please check your email login credentials. smtplib.SMTPAuthenticationError: (535, b'5.7.8 Username and Password not accepted. For more information, go to\n5.7.8 https://support.google.com/mail/?p=BadCredentials 98e67ed59e1d1-3039f8b28acsm500967a91.10 - gsmtp')

What might I be doing wrong? ERPNext shouldn’t be sending a username and password.

(I did change the Email Domain server from smtp.gmail.com to smtp-relay.gmail.com.)

volkswagner · March 31, 2025, 3:31pm

@antgel have you tried using basic auth with a fictitious uername and password?

This may work with your ip authentication.

You may need the correct username with a fake password??

antgel · March 31, 2025, 3:57pm

The IP “authentication” (SMTP relay, lack of Basic / OAuth2 authentication) does work. But I’d rather be able to configure OAuth2 with a service account that isn’t related to a “real” user, or at least is connected to my user and using the “Use different email ID” option.

revant_one · April 1, 2025, 3:17am

Code for backend app token / client_credentials grant is there:

github.com

frappe/frappe/blob/d73c716fe0bba7a49ec38429d0ccdf677e4b2431/frappe/integrations/doctype/connected_app/connected_app.py#L151-L177


      
          	def get_backend_app_token(self, include_client_id=None):
          		"""Get an Access Token for the Cloud-Registered Service Principal"""
          		# There is no User assigned to the app, so we give it an empty string,
          		# otherwise it will assign the logged in user.
          		token_cache = self.get_token_cache("")
          		if token_cache is None:
          			token_cache = frappe.new_doc("Token Cache")
          			token_cache.connected_app = self.name
          		elif not token_cache.is_expired():
          			return token_cache
          
          		# Get a new Access token for the App
          		client = BackendApplicationClient(client_id=self.client_id, scope=self.get_scopes())
          		oauth_session = OAuth2Session(client=client)
          
          		token = oauth_session.fetch_token(
          			self.token_uri,
          			client_secret=self.get_password("client_secret"),
          			include_client_id=include_client_id,
          		)

This file has been truncated. show original

Does calling this works? “System Console” or bench --site ... console

c = frappe.get_doc("Connected App", "abcdefgh01")
c.get_backend_app_token(c.client_id)

If it shows the token in token cache we’ll figure out a way to use it.

the get_backend_app_token also needs to change. no need for passing it a client_id. it should be picked up from self/cls in stead of passing it as arg.

antgel · April 2, 2025, 4:40pm

Thanks so much for jumping in to explain that. I’m travelling next couple of days but will definitely take a look ASAP! Cheers