From bf0f75de095dc7ecb7171ab61009fab2631b4bee Mon Sep 17 00:00:00 2001
From: Luca Boccassi <luca.boccassi@microsoft.com>
Date: Tue, 2 Apr 2019 16:06:35 +0200
Subject: [PATCH] M!1 - Simplify OAuth2 for outlook.office365.com server
Two changes:
1) preset default tenant to "common"
2) do not pass 'scope' parameter in the requests, which is optional
and can cause errors like:
error:invalid_request description:AADSTS65002:
Consent between first party applications and resources must be
configured via preauthorization.
Closes https://gitlab.gnome.org/GNOME/evolution-ews/merge_requests/1
---
CMakeLists.txt | 2 +-
src/configuration/e-mail-config-ews-backend.c | 15 +++------------
src/server/e-oauth2-service-office365.c | 17 -----------------
3 files changed, 4 insertions(+), 30 deletions(-)
diff --git a/CMakeLists.txt b/CMakeLists.txt
index e8ea9875..dbc58832 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -180,7 +180,7 @@ endif(ENABLE_TESTS)
add_printable_variable(WITH_OFFICE365_TENANT "Office365.com OAuth 2.0 tenant" "")
if(WITH_OFFICE365_TENANT STREQUAL "")
- set(WITH_OFFICE365_TENANT "")
+ set(WITH_OFFICE365_TENANT "common")
endif(WITH_OFFICE365_TENANT STREQUAL "")
add_printable_variable(WITH_OFFICE365_CLIENT_ID "Office365.com OAuth 2.0 client ID" "")
diff --git a/src/configuration/e-mail-config-ews-backend.c b/src/configuration/e-mail-config-ews-backend.c
index fbf341b2..e62d3922 100644
--- a/src/configuration/e-mail-config-ews-backend.c
+++ b/src/configuration/e-mail-config-ews-backend.c
@@ -348,9 +348,9 @@ mail_config_ews_backend_insert_widgets (EMailConfigServiceBackend *backend,
G_BINDING_SYNC_CREATE);
mail_config_ews_backend_set_oauth2_tooltip (widget, OFFICE365_TENANT,
- /* Translators: 'Tenant' here means a term used by Microsoft to identify a company or organization in an Office 365 world.
+ /* Translators: 'Tenant' here means a term used by Microsoft to identify a company or organization in an Office 365 world. Same for 'common', it's a default URL path.
You probably do not want to translate it. More for example here: https://powerbi.microsoft.com/en-us/blog/what-is-a-tenant/ */
- _("There is not set any default tenant"),
+ _("Default tenant is “common“"),
/* Translators: 'Tenant' here means a term used by Microsoft to identify a company or organization in an Office 365 world.
You probably do not want to translate it. More for example here: https://powerbi.microsoft.com/en-us/blog/what-is-a-tenant/ */
g_strdup_printf (_("Default tenant is “%s”"), OFFICE365_TENANT));
@@ -586,23 +586,14 @@ mail_config_ews_backend_check_complete (EMailConfigServiceBackend *backend)
e_util_set_entry_issue_hint (priv->user_entry, correct ? NULL : _("User name cannot be empty"));
if (correct && camel_ews_settings_get_auth_mechanism (ews_settings) == EWS_AUTH_TYPE_OAUTH2) {
- const gchar *tenant, *client_id;
+ const gchar *client_id;
if (camel_ews_settings_get_override_oauth2 (ews_settings)) {
- tenant = camel_ews_settings_get_oauth2_tenant (ews_settings);
client_id = camel_ews_settings_get_oauth2_client_id (ews_settings);
} else {
- tenant = OFFICE365_TENANT;
client_id = OFFICE365_CLIENT_ID;
}
- correct = tenant && *tenant;
- complete = complete && correct;
-
- /* Translators: 'Tenant' here means a term used by Microsoft to identify a company or organization in an Office 365 world.
- You probably do not want to translate it. More for example here: https://powerbi.microsoft.com/en-us/blog/what-is-a-tenant/ */
- e_util_set_entry_issue_hint (priv->oauth2_tenant_entry, correct ? NULL : _("Tenant cannot be empty"));
-
correct = client_id && *client_id;
complete = complete && correct;
diff --git a/src/server/e-oauth2-service-office365.c b/src/server/e-oauth2-service-office365.c
index 4be84f6f..d660458c 100644
--- a/src/server/e-oauth2-service-office365.c
+++ b/src/server/e-oauth2-service-office365.c
@@ -30,21 +30,6 @@
#define OFFICE365_RESOURCE "https://outlook.office.com"
-#define OFFICE365_SCOPE "openid offline_access profile " \
- "Mail.ReadWrite " \
- "Mail.ReadWrite.Shared " \
- "Mail.Send " \
- "Mail.Send.Shared " \
- "Calendars.ReadWrite " \
- "Calendars.ReadWrite.Shared " \
- "Contacts.ReadWrite " \
- "Contacts.ReadWrite.Shared " \
- "Tasks.ReadWrite " \
- "Tasks.ReadWrite.Shared " \
- "MailboxSettings.ReadWrite " \
- "People.Read " \
- "User.ReadBasic.All"
-
struct _EOAuth2ServiceOffice365Private
{
GMutex string_cache_lock;
@@ -253,7 +238,6 @@ eos_office365_prepare_authentication_uri_query (EOAuth2Service *service,
e_oauth2_service_util_set_to_form (uri_query, "response_mode", "query");
e_oauth2_service_util_set_to_form (uri_query, "prompt", "login");
- e_oauth2_service_util_set_to_form (uri_query, "scope", OFFICE365_SCOPE);
e_oauth2_service_util_set_to_form (uri_query, "resource", OFFICE365_RESOURCE);
}
@@ -321,7 +305,6 @@ eos_office365_prepare_refresh_token_form (EOAuth2Service *service,
{
g_return_if_fail (form != NULL);
- e_oauth2_service_util_set_to_form (form, "scope", OFFICE365_SCOPE);
e_oauth2_service_util_set_to_form (form, "resource", OFFICE365_RESOURCE);
e_oauth2_service_util_set_to_form (form, "redirect_uri", e_oauth2_service_get_redirect_uri (service, source));
}
--
GitLab