18

Please forgive my amateurism both in php and on stackoverflow. I have a PHP script that reads emails from an office 365 mailbox, for this I use a standard connection:

$Inbox = imap_open('{Outlook.office365.com:993/imap/ssl}', '[email protected]', 'mypassword');

Then to read the new emails received, I used the command:

$UnRead = imap_search($Inbox, 'UNSEEN');

Starting 20221001 - October 1, 2022, Microsoft will remove this authentication and require OAuth2 authentication.

I registered my web application at Microsoft Azure and tried several settings. I have done a lot of research that allows me to connect to the mailbox to be able to read the mails without going through an interaction with a user. I've found nothing.

Does anyone have a step-by-step solution to retrieve a variable bound to an "imap_open" or do you have to use a completely different system.

Thanks for your help.

4

2 Answers 2

22

It's been a wild ride for me and my coworkers but we found a solution.

1 - Configure your mail box in Azure

(I didn't do this part so i can't help you more than that ! )

Edit : Thanks to parampal-pooni, this link explains how to configurate in azure.

You will need :

  • The client Id
  • The tenant Id
  • The secret client
  • The redirect Uri (Set it to http://localhost/test_imap)

2 - Grab a code to get a token

Construct this url :

$TENANT="5-48...";
$CLIENT_ID="c-9c-....";
$SCOPE="https://outlook.office365.com/IMAP.AccessAsUser.All";
$REDIRECT_URI="http://localhost/test_imap";

$authUri = 'https://login.microsoftonline.com/' . $TENANT
           . '/oauth2/v2.0/authorize?client_id=' . $CLIENT_ID
           . '&scope=' . $SCOPE
           . '&redirect_uri=' . urlencode($REDIRECT_URI)
           . '&response_type=code'
           . '&approval_prompt=auto';

echo($authUri);

Go to the link, connect to the mail box with the passeword. Once it done, you will be redirect to : http://localhost/test_imap?code=LmpxSnTw...&session_state=b5d713....

Save the code (remove the '&' at the end !) and the session state inside the url. These codes expired after a few hours !

3 - Get an access token

$CLIENT_ID="c-9c-....";
$CLIENT_SECRET="Y~tN...";
$TENANT="5-48...";
$SCOPE="https://outlook.office365.com/IMAP.AccessAsUser.All offline_access";
$CODE="LmpxSnTw...";
$SESSION="b5d713...";
$REDIRECT_URI="http://localhost/test_imap";

echo "Trying to authenticate the session..";

$url= "https://login.microsoftonline.com/$TENANT/oauth2/v2.0/token";

$param_post_curl = [ 
 'client_id'=>$CLIENT_ID,
 'scope'=>$SCOPE,
 'code'=>$CODE,
 'session_state'=>$SESSION,
 'client_secret'=>$CLIENT_SECRET,
 'redirect_uri'=>$REDIRECT_URI,
 'grant_type'=>'authorization_code' ];

$ch=curl_init();
curl_setopt($ch,CURLOPT_URL,$url);
curl_setopt($ch,CURLOPT_POSTFIELDS, http_build_query($param_post_curl));
curl_setopt($ch,CURLOPT_POST, 1);
curl_setopt($ch,CURLOPT_RETURNTRANSFER, true);

$oResult=curl_exec($ch);

echo "result : \n";

var_dump($oResult);

The access_token given in response is going to work only for a few hours. ( If your script is going to be launch on a daily basic you need to recreate a token. I'm going to show you how in the part 5 ! Save the refresh_token inside $oResult. If you don't have the "refresh_token" you have forgot to put "offline_access" in the scope)

Edit : I forgot to add the redirect_uri in this step, thank jose ayram

4 - Connect to the mail box

Now choose your favorite library ;) ! We will use webklex/php-imap for this example (https://github.com/Webklex/php-imap)

include __DIR__.'/vendor/autoload.php'; 
    
use Webklex\PHPIMAP\ClientManager;

$access_token="EH.j8s5z8...";
    
//$cm = new ClientManager($options = ["options" => ["debug" => true]]);                     
$cm = new ClientManager();                      
$client = $cm->make([
    'host'          => 'outlook.office365.com',                
    'port'          => 993,
    'encryption'    => 'ssl',
    'validate_cert' => false,
    'username'      => '[email protected]',
    'password'      => $access_token,
    'protocol'      => 'imap',
    'authentication' => "oauth"
]);

try {
    //Connect to the IMAP Server
    $client->connect();
    $folder = $client->getFolder('INBOX');
    $all_messages = $folder->query()->all()->get();
    //DONE ! :D     
} catch (Exception $e) {
    echo 'Exception : ',  $e->getMessage(), "\n";
}

5 - Connecting to the mail box everyday

include __DIR__.'/vendor/autoload.php'; 
    
use Webklex\PHPIMAP\ClientManager;

$CLIENT_ID="c-9c-....";
$CLIENT_SECRET="Y~tN...";
$TENANT="5-48...";
$REFRESH_TOKEN="EebH9H8S7...";

$url= "https://login.microsoftonline.com/$TENANT/oauth2/v2.0/token";

$param_post_curl = [ 
 'client_id'=>$CLIENT_ID,
 'client_secret'=>$CLIENT_SECRET,
 'refresh_token'=>$REFRESH_TOKEN,
 'grant_type'=>'refresh_token' ];

$ch=curl_init();

curl_setopt($ch,CURLOPT_URL,$url);
curl_setopt($ch,CURLOPT_POSTFIELDS, http_build_query($param_post_curl));
curl_setopt($ch,CURLOPT_POST, 1);
curl_setopt($ch,CURLOPT_RETURNTRANSFER, true);
//ONLY USE CURLOPT_SSL_VERIFYPEER AT FALSE IF YOU ARE IN LOCALHOST !!!
curl_setopt($ch,CURLOPT_SSL_VERIFYPEER, false);// NOT IN LOCALHOST ? ERASE IT !

$oResult=curl_exec($ch);

echo("Trying to get the token.... \n");

if(!empty($oResult)){
    
    echo("Connecting to the mail box... \n");
    
    //The token is a JSON object
    $array_php_resul = json_decode($oResult,true);
    
    if( isset($array_php_resul["access_token"]) ){

        $access_token = $array_php_resul["access_token"];

        //$cm = new ClientManager($options = ["options" => ["debug" => true]]);                     
        $cm = new ClientManager();                      
        $client = $cm->make([
            'host'          => 'outlook.office365.com',                
            'port'          => 993,
            'encryption'    => 'ssl',
            'validate_cert' => false,
            'username'      => '[email protected]',
            'password'      => $access_token,
            'protocol'      => 'imap',
            'authentication' => "oauth"
        ]);
        
        try {
            //Connect to the IMAP Server
            $client->connect();
        }catch (Exception $e) {
            echo 'Exception : ',  $e->getMessage(), "\n";
        }

    }else{
        echo('Error : '.$array_php_resul["error_description"]); 
    }
}   

I hope it will help you.

30
  • 2
    Thanks. This works for me. Just you must add the redirect_uri in the step3
    – Jose Ayram
    Nov 30, 2022 at 12:36
  • 2
    You are right ! I just edited my answer. Thank you very much :) learn.microsoft.com/en-us/azure/active-directory/develop/… Dec 1, 2022 at 13:54
  • 2
    This is it. THIS IS THE MILLION DOLLAR SOLUTION. Microsoft doesn't support client_credential + IMAP authorization but they haven't updated their documentation to reflect this feature IS STILL NOT AVAILABLE. Thank you so much for providing this.
    – Ishmael
    Dec 19, 2022 at 19:31
  • 1
    The refresh token allows you to generate a new acess token every time you run the script. It never changes nor expire (maybe it will someday, but for me it's been 2 months and it's still good and running well :) ! Redo the step 3 if needed.) I hope, i am clear in my explanation. Jan 9 at 8:27
  • 1
    To help with step 1 go here: learn.microsoft.com/en-us/azure/active-directory/develop/… Jan 25 at 5:34
1
  1. Execute this curl Replace client_id, client_secret and tenant_id

In scope you can try to use https://outlook.office365.com/.default, https://graph.microsoft.com/.default or https://outlook.office.com/.default

curl -X POST -H "Content-Type: application/x-www-form-urlencoded" -d 'client_id={CLIENT_ID}&scope=https%3A%2F%2Foutlook.office365.com%2F.default&client_secret={CLIENT_SECRET}&grant_type=client_credentials' 'https://login.microsoftonline.com/{TENANT_ID}/oauth2/v2.0/token'
  1. PHP-imap login
<?php 
// ....
$instance = new ClientManager();
$this->client = $instance->make([
    'host' => "outlook.office365.com",
    'port' => "993",
    'encryption' => 'ssl',
    'validate_cert' => true,
    'username' => "[email protected]",
    'password' => $curlAcessToken, // Access token curl
    'protocol' => 'imap',
    'authentication' => "oauth",
]);

Not the answer you're looking for? Browse other questions tagged or ask your own question.