Configuring mbsync with AuthMech XOAUTH2

Question

I can't seem to figure out how to get mbsync to work with OAuth for Gmail because I can't get mbsync to find the xoauth2 sasl plugin on Ubuntu. I'm fairly confident that everything about my mbsync config for OAuth is working correctly (e.g. manually testing the PassCmd successfully generates an access token)

edit: I have installed sasl-bin via apt, and https://github.com/robn/sasl2-oauth from source.

---

Questions

• How can I manually "register" a sasl plugin for mbsync? (aka add it to the list of 'available' SASL mechanisms in the first log pasted below)
• Could this issue be due to another component in my "email stack"? Some threads I've read suggest recompiling mutt from source, but I don't understand why mutt would be causing auth problems.

---

Using mbsync installed via nix-env, I haven't been able to get past

C: 0/1  B: 0/0  M: +0/0 *0/0 #0/0  S: +0/0 *0/0 #0/0
IMAP error: selected SASL mechanism(s) not available;
   selected: XOAUTH2
   available: GS2-IAKERB GS2-KRB5 SCRAM-SHA-1 SCRAM-SHA-256 GSS-SPNEGO GSSAPI DIGEST-MD5 EXTERNAL OTP CRAM-MD5 PLAIN LOGIN ANONYMOUS
C: 1/1  B: 0/0  M: +0/0 *0/0 #0/0  S: +0/0 *0/0 #0/0

I've also tried reinstalling mbsync/isync from apt, as well as building isync from the source. Both of which result in the following error.

Notice: Master/Slave are deprecated; use Far/Near instead.
C: 0/1  B: 0/0  F: +0/0 *0/0 #0/0  N: +0/0 *0/0 #0/0
Error: SASL(-1): generic failure: Unable to find a callback: 32775
C: 1/1  B: 0/0  F: +0/0 *0/0 #0/0  N: +0/0 *0/0 #0/0

Answer 1

Thanks to your previous hints. I've managed to get XOAUTH2 working in SASL and use it with mbsync. Here is how I got it working on my Ubuntu 20.10:

Install Cyrus SASL OAuth2

# Clone the Cyrus SASL OAuth2 sources.
git clone https://github.com/moriyoshi/cyrus-sasl-xoauth2.git

# Configure and make.
cd cyrus-sasl-xoauth2
./autogen.sh
./configure

# SASL2 libraries on Ubuntu are in /usr/lib/x86_64-linux-gnu/; modify the Makefile accordingly
sed -i 's%pkglibdir = ${CYRUS_SASL_PREFIX}/lib/sasl2%pkglibdir = ${CYRUS_SASL_PREFIX}/lib/x86_64-linux-gnu/sasl2%' Makefile

make
sudo make install

# Verify XOAUTH2 is known to SASL.
saslpluginviewer | grep XOAUTH2

mbsync

Older versions (up to 1.3.1?) have PassCmd buffer set to 80 -- and this is not enough for OAuth2 tokens. I compiled the current 1.4.0:

# Clone the isync/mbsync 1.4 sources.
git clone --branch 1.4 --depth 1 https://git.code.sf.net/p/isync/isync isync-isync

# Configure and make.
cd isync-isync
./autogen.sh
./configure
make

mutt_oauth2.py

Download mutt_oauth2.py from https://gitlab.com/muttmua/mutt/-/blob/master/contrib/mutt_oauth2.py and make it executable.

I have a modified version that creates a socket with OAuth2 tokens. So I can then access the tokens via the socket:

curl --unix-socket ~/.mutt/oauth2.socket x

Please note that your mileage may vary and you will need a different PassCmd to access the OAuth2 tokens.

mbsyncrc

Configure mbsync to use XOAUTH2 and set PassCmd to execute the above curl command:

IMAPAccount <account-name>
Host outlook.office365.com
User <[email protected]>
AuthMechs XOAUTH2
PassCmd "curl --unix-socket ~/.mutt/oauth2.socket x"
SSLType IMAPS
SSLVersions TLSv1.1 TLSv1.2

mbsync then works as expected; notice the output from curl below:

$ mbsync -a
C: 0/1  B: 0/0  F: +0/0 *0/0 #0/0  N: +0/0 *0/0 #0/0  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  1963    0  1963    0     0   479k      0 --:--:-- --:--:-- --:--:--  479k
C: 1/1  B: 15/15  F: +0/0 *0/0 #0/0  N: +847/847 *0/0 #0/0

Answer 2

On Ubuntu 22.10 installing libsasl2-modules-kdexoauth2 solved the "IMAP error: selected SASL mechanism(s) not available;" issue for me.

Answer 3

I am working on figuring out the same issue. Here are some resources that may help.

1. https://bbs.archlinux.org/viewtopic.php?id=238727
2. https://isync-devel.narkive.com/i6h4k9hB/mbsync-xoauth2-and-gmail
3. http://blog.onodera.asia/2020/06/how-to-use-google-g-suite-oauth2-with.html

I haven't succeeded in fixing the error but it seems you need to have https://www.cyrusimap.org/sasl/ installed. Next, use one of these plugins:

• https://github.com/sweetums/SASL-OAuth
• https://github.com/robn/sasl2-oauth

Hope that helps. I'll keep trying to see if I can get all this to work.