github-starred/vaultwarden
2
0
Fork 0
mirror of https://github.com/dani-garcia/vaultwarden.git synced 2026-03-15 11:24:52 -05:00
Code Issues 79 Packages Projects Releases 78 Wiki Activity

[PR #6388] Add XoAuth2 support #7410

New Issue
Open
opened 2026-03-07 21:17:14 -06:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-03-07 21:17:14 -06:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/dani-garcia/vaultwarden/pull/6388
Author: @hnolde
Created: 10/22/2025
Status: 🔄 Open

Base: main ← Head: main

📝 Commits (10+)

  • e5934c1 Add XoAuth2 support to fetch the token from the SMTP Provider and refresh used by Google or Microsoft
  • bfbedb0 Fix: is_some_and and formatting issues
  • 1269330 Fix: formatting issues
  • f6a5e53 Fix: handlebars oauth2_success, http_client, url
  • e5c0655 Fix: formatting
  • 96fe363 Merge branch 'main' into main
  • 7e3acf2 Fix: update OAuth2 state storage initialization and state token encoding
  • 2be8e7e Fix: reorder imports and clean up whitespace in admin.rs
  • 25fd440 Merge branch 'main' into main
  • 1441d08 Merge branch 'main' into main

📊 Changes

19 files changed (+550 additions, -9 deletions)

View changed files

📝 .env.template (+12 -0)
➕ migrations/mysql/2025-12-26-143000_create_xoauth2/down.sql (+1 -0)
➕ migrations/mysql/2025-12-26-143000_create_xoauth2/up.sql (+4 -0)
➕ migrations/postgresql/2025-12-26-143000_create_xoauth2/down.sql (+1 -0)
➕ migrations/postgresql/2025-12-26-143000_create_xoauth2/up.sql (+4 -0)
➕ migrations/sqlite/2025-12-26-143000_create_xoauth2/down.sql (+1 -0)
➕ migrations/sqlite/2025-12-26-143000_create_xoauth2/up.sql (+4 -0)
📝 src/api/admin.rs (+149 -1)
📝 src/config.rs (+75 -2)
📝 src/db/mod.rs (+8 -0)
📝 src/db/models/mod.rs (+2 -0)
➕ src/db/models/xoauth2.rs (+51 -0)
📝 src/db/schema.rs (+7 -0)
📝 src/error.rs (+6 -0)
📝 src/mail.rs (+149 -6)
📝 src/main.rs (+1 -0)
📝 src/static/scripts/admin_settings.js (+35 -0)
➕ src/static/templates/admin/oauth2_success.hbs (+10 -0)
📝 src/static/templates/admin/settings.hbs (+30 -0)

📄 Description

This pull request adds comprehensive support for SMTP OAuth2 (XOAUTH2) authentication, enabling the system to send emails via providers that require OAuth2 (like Gmail). It introduces new configuration options, admin panel endpoints, and user interface controls for managing OAuth2 tokens and authorization flows. The implementation includes secure handling of OAuth2 state for CSRF protection, token caching, and robust validation of configuration parameters.

SMTP OAuth2 (XOAUTH2) Support

  • Added new configuration options for OAuth2, including smtp_oauth2_client_id, smtp_oauth2_client_secret, smtp_oauth2_auth_url, smtp_oauth2_token_url, smtp_oauth2_refresh_token, and smtp_oauth2_scopes. These allow the system to be configured for OAuth2-based SMTP authentication.
  • Implemented validation logic to ensure all required OAuth2 parameters are set and correctly formatted when XOAUTH2 is enabled, including checks for valid URLs and required fields. [1] [2]

Backend OAuth2 Flow and Token Management

  • Introduced OAuth2 authorization endpoints (/admin/oauth2/authorize and /admin/oauth2/callback) and a token refresh endpoint (/admin/test/oauth2) in the admin API, including secure state storage for CSRF protection during the OAuth2 flow. [1] [2] [3] [4]
  • Added logic to exchange authorization codes for refresh tokens, persist them in configuration, and refresh access tokens as needed, with token caching to minimize unnecessary requests. [1] [2]

SMTP Transport and Authentication Logic

  • Modified SMTP transport logic to support OAuth2: when configured, the system uses the OAuth2 access token as the SMTP password, falling back to traditional authentication if necessary, and preferring OAuth2 when both are present. [1] [2]

Admin UI Enhancements

  • Added UI controls and JavaScript handlers to the admin settings page for initiating OAuth2 authorization and refreshing tokens, with checks to prevent actions if unsaved config changes are present. [1] [2]

General Improvements

  • Made update_config_partial public to allow saving OAuth2 tokens from the OAuth2 callback handler.
  • Added a convenience From<&str> implementation for the Error type to simplify error handling.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/dani-garcia/vaultwarden/pull/6388 **Author:** [@hnolde](https://github.com/hnolde) **Created:** 10/22/2025 **Status:** 🔄 Open **Base:** `main` ← **Head:** `main` --- ### 📝 Commits (10+) - [`e5934c1`](https://github.com/dani-garcia/vaultwarden/commit/e5934c13e9a13083923479342eac2eb346af5f44) Add XoAuth2 support to fetch the token from the SMTP Provider and refresh used by Google or Microsoft - [`bfbedb0`](https://github.com/dani-garcia/vaultwarden/commit/bfbedb05d67770ed3b5445f36325f18d695d0cf3) Fix: is_some_and and formatting issues - [`1269330`](https://github.com/dani-garcia/vaultwarden/commit/1269330f46c807875e3493216d73a37dca9e39af) Fix: formatting issues - [`f6a5e53`](https://github.com/dani-garcia/vaultwarden/commit/f6a5e53e43e946ca64d4821dac70c5363049ef2e) Fix: handlebars oauth2_success, http_client, url - [`e5c0655`](https://github.com/dani-garcia/vaultwarden/commit/e5c0655c74b025d673b36646d3ef48b9401d4888) Fix: formatting - [`96fe363`](https://github.com/dani-garcia/vaultwarden/commit/96fe363ee53a4194e9a2c54775059ae8696dd267) Merge branch 'main' into main - [`7e3acf2`](https://github.com/dani-garcia/vaultwarden/commit/7e3acf26b4b6f3f1087beebea2ce300e5f89c283) Fix: update OAuth2 state storage initialization and state token encoding - [`2be8e7e`](https://github.com/dani-garcia/vaultwarden/commit/2be8e7e6283dfeef6f1acff15fa635202de898ce) Fix: reorder imports and clean up whitespace in admin.rs - [`25fd440`](https://github.com/dani-garcia/vaultwarden/commit/25fd4406b6b894d9d7aeb9a89d58f4ebae11f18e) Merge branch 'main' into main - [`1441d08`](https://github.com/dani-garcia/vaultwarden/commit/1441d08b11fa33318a90ab239fbfb2370af67c45) Merge branch 'main' into main ### 📊 Changes **19 files changed** (+550 additions, -9 deletions) <details> <summary>View changed files</summary> 📝 `.env.template` (+12 -0) ➕ `migrations/mysql/2025-12-26-143000_create_xoauth2/down.sql` (+1 -0) ➕ `migrations/mysql/2025-12-26-143000_create_xoauth2/up.sql` (+4 -0) ➕ `migrations/postgresql/2025-12-26-143000_create_xoauth2/down.sql` (+1 -0) ➕ `migrations/postgresql/2025-12-26-143000_create_xoauth2/up.sql` (+4 -0) ➕ `migrations/sqlite/2025-12-26-143000_create_xoauth2/down.sql` (+1 -0) ➕ `migrations/sqlite/2025-12-26-143000_create_xoauth2/up.sql` (+4 -0) 📝 `src/api/admin.rs` (+149 -1) 📝 `src/config.rs` (+75 -2) 📝 `src/db/mod.rs` (+8 -0) 📝 `src/db/models/mod.rs` (+2 -0) ➕ `src/db/models/xoauth2.rs` (+51 -0) 📝 `src/db/schema.rs` (+7 -0) 📝 `src/error.rs` (+6 -0) 📝 `src/mail.rs` (+149 -6) 📝 `src/main.rs` (+1 -0) 📝 `src/static/scripts/admin_settings.js` (+35 -0) ➕ `src/static/templates/admin/oauth2_success.hbs` (+10 -0) 📝 `src/static/templates/admin/settings.hbs` (+30 -0) </details> ### 📄 Description This pull request adds comprehensive support for SMTP OAuth2 (XOAUTH2) authentication, enabling the system to send emails via providers that require OAuth2 (like Gmail). It introduces new configuration options, admin panel endpoints, and user interface controls for managing OAuth2 tokens and authorization flows. The implementation includes secure handling of OAuth2 state for CSRF protection, token caching, and robust validation of configuration parameters. **SMTP OAuth2 (XOAUTH2) Support** - Added new configuration options for OAuth2, including `smtp_oauth2_client_id`, `smtp_oauth2_client_secret`, `smtp_oauth2_auth_url`, `smtp_oauth2_token_url`, `smtp_oauth2_refresh_token`, and `smtp_oauth2_scopes`. These allow the system to be configured for OAuth2-based SMTP authentication. - Implemented validation logic to ensure all required OAuth2 parameters are set and correctly formatted when XOAUTH2 is enabled, including checks for valid URLs and required fields. [[1]](diffhunk://#diff-cba64c21ab992eaad29fce147a08f4560a4769bc14682b8a96081a5fd02dbecdR1051-R1056) [[2]](diffhunk://#diff-cba64c21ab992eaad29fce147a08f4560a4769bc14682b8a96081a5fd02dbecdR1148-R1188) **Backend OAuth2 Flow and Token Management** - Introduced OAuth2 authorization endpoints (`/admin/oauth2/authorize` and `/admin/oauth2/callback`) and a token refresh endpoint (`/admin/test/oauth2`) in the admin API, including secure state storage for CSRF protection during the OAuth2 flow. [[1]](diffhunk://#diff-48e73dac59e5044731073f602e5331265f839bd0ea9169e2a5368d16e2dbcebeR2-R10) [[2]](diffhunk://#diff-48e73dac59e5044731073f602e5331265f839bd0ea9169e2a5368d16e2dbcebeR65-R67) [[3]](diffhunk://#diff-48e73dac59e5044731073f602e5331265f839bd0ea9169e2a5368d16e2dbcebeR99-R101) [[4]](diffhunk://#diff-48e73dac59e5044731073f602e5331265f839bd0ea9169e2a5368d16e2dbcebeR343-R494) - Added logic to exchange authorization codes for refresh tokens, persist them in configuration, and refresh access tokens as needed, with token caching to minimize unnecessary requests. [[1]](diffhunk://#diff-02d3b205a438920e7c90dc9a121d5f81f2f04940aea6f9c2b48c7adea12305dbR27-R112) [[2]](diffhunk://#diff-02d3b205a438920e7c90dc9a121d5f81f2f04940aea6f9c2b48c7adea12305dbL32-R121) **SMTP Transport and Authentication Logic** - Modified SMTP transport logic to support OAuth2: when configured, the system uses the OAuth2 access token as the SMTP password, falling back to traditional authentication if necessary, and preferring OAuth2 when both are present. [[1]](diffhunk://#diff-02d3b205a438920e7c90dc9a121d5f81f2f04940aea6f9c2b48c7adea12305dbL60-R185) [[2]](diffhunk://#diff-02d3b205a438920e7c90dc9a121d5f81f2f04940aea6f9c2b48c7adea12305dbL674-R798) **Admin UI Enhancements** - Added UI controls and JavaScript handlers to the admin settings page for initiating OAuth2 authorization and refreshing tokens, with checks to prevent actions if unsaved config changes are present. [[1]](diffhunk://#diff-afcf517ecd8a8db9f343dcbad52e2fb871838bd3f27a1e766881dc22ec426e00R29-R55) [[2]](diffhunk://#diff-afcf517ecd8a8db9f343dcbad52e2fb871838bd3f27a1e766881dc22ec426e00R255-R262) **General Improvements** - Made `update_config_partial` public to allow saving OAuth2 tokens from the OAuth2 callback handler. - Added a convenience `From<&str>` implementation for the `Error` type to simplify error handling. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-03-07 21:17:14 -06:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
better for forum
bug
documentation
duplicate
enhancement
future Vault
good first issue
help wanted
low priority
notes
pull-request
Mirrored from GitHub Pull Request
 question
SSO
Third party
troubleshooting
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/vaultwarden#7410
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?