Skip to content
OTOBO Community Guide

OTOBO OAuth2 Email – Secure POP3/IMAP with Microsoft Azure

In this guide: Replace basic auth with OAuth2 for cloud mailboxes (especially Microsoft 365 / Azure).

Related: Email setup · OpenID Connect login · Communication overview

OTOBO now also supports authentication via OAuth2 / OpenID Connect for POP3 and IMAP, which enables a secure and modern method of authentication. After installation of the MailAccount-OAuth2 package, you can use this authentication method, which is particularly recommended when using cloud-based email services such as Microsoft Azure.

Azure Configuration Steps

Section titled “Azure Configuration Steps”
  1. Visit the Azure Portal to start your Azure Active Directory configuration.
  2. Add a new enterprise application and create your own application.
  3. Assign a name to your app and configure it according to your requirements.
  4. The mailbox user must be assigned to the application. Note the application ID for later use in OTOBO.
  5. Determine the tenant ID of your domain, which is also required for the configuration in OTOBO.
  6. Create a new app in the app registration to complete the authentication process.

Azure configuration for OTOBO [1]

By integrating modern authentication standards like OAuth2 into OTOBO, you improve the security and flexibility of your email communication. Furthermore, the clear structure of email account management in OTOBO facilitates an efficient and user-friendly configuration of your email settings to optimize your customer support and internal communication.

OAuth2 Authentication for POP3 and IMAP in OTOBO

Section titled “OAuth2 Authentication for POP3 and IMAP in OTOBO”

OTOBO enables highly secure OAuth2 authentication for POP3 and IMAP email accounts through integration with Microsoft Azure, which represents a significant improvement in the security and efficiency of email communication.

Setting up OAuth2 authentication involves several steps in the Azure console and the OTOBO system configuration.

Steps to Set Up Azure for OAuth2 Authentication

Section titled “Steps to Set Up Azure for OAuth2 Authentication”

  1. Redirect URL and Client Secret

    Create a redirect URL of the type Web for your application. The redirect URL should include the address of your OTOBO system, followed by “/otobo/index.pl?Action=AdminMailAccount”.

    Azure step for creating the redirect URL
    Azure step for creating the redirect URL [1]
    https://<OTOBO-address>/otobo/index.pl?Action=AdminMailAccount

    Also, create a client secret and note its value, as it will be required later in OTOBO.

    Create client secret in Azure [1]

  2. API Permissions

    Add the required API permissions for IMAP.AccessAsUser.All and POP.AccessAsUser.All. This grants OTOBO the necessary rights to access your email accounts.

    Add API permissions [1]

OTOBO OAuth2 Configuration

Section titled “OTOBO OAuth2 Configuration”

After completing the Azure configuration, it is necessary to apply the settings in OTOBO:

  1. Activation of the OAuth2 Profile

    Navigate in the OTOBO admin interface to System Configuration and activate the profile OAuth2::MailAccount::Profiles###Custom1.

  2. Entry of the Application ID and Client Secret

    Enter the previously noted application/client ID and the client secret in the corresponding fields.

    OAuth2 settings in OTOBO [1]

  3. Adjustment of the OAuth2 Provider

    In the configuration OAuth2::MailAccount::Providers###MicrosoftAzure, replace the placeholder common with your TenantID.

    Adjust OAuth2 provider [1]

    Once these configurations have been made, you can select the OAuth2 profile for your email accounts in OTOBO to complete the authentication.

    Adjust PostMaster Mail Account in OTOBO [1]

In summary, OAuth2 authentication and the use of Postmaster filters significantly improve the security and efficiency of email processing in OTOBO. With these features, OTOBO offers a powerful platform for optimizing communication with customers and within the team.

Frequently asked questions

What is the primary package required for enabling OAuth2 authentication for email in OTOBO, and what are the subsequent steps?

The core component for enabling OAuth2 authentication for POP3 and IMAP email accounts in OTOBO is the MailAccount-OAuth2 package. After successfully installing this package, the configuration process involves two main phases: first, setting up an application within the Microsoft Azure Portal, which includes registering the app, defining redirect URLs, generating client secrets, and assigning necessary API permissions. Second, you must configure OTOBO's System Configuration settings by activating the OAuth2 profile, entering the Azure-provided Application ID and Client Secret, and replacing the placeholder with your specific Tenant ID. These steps collectively ensure that OTOBO can securely authenticate with cloud-based email services using modern OAuth2 standards.

Quellen / Sources

Why is OAuth2 authentication recommended over basic authentication for cloud-based email services like Microsoft 365?

OAuth2 is the recommended modern authentication method for cloud-based email services, especially Microsoft 365, primarily due to its enhanced security features and compliance with contemporary standards. Unlike basic authentication, which sends usernames and passwords with every request, OAuth2 uses tokens, significantly reducing the risk of credentials being intercepted or compromised. This approach improves the overall security posture for mailbox access. Furthermore, major cloud providers like Microsoft have deprecated or are deprecating basic authentication in favor of OAuth2, making it a necessary transition for continued secure and reliable email communication. Implementing OAuth2 ensures your OTOBO system remains compatible and secure with evolving email service security policies.

Quellen / Sources

How do I configure the OAuth2 redirect URL in Azure for OTOBO, and what is its specific format?

To configure the OAuth2 redirect URL in Azure, you must navigate to your application's settings within Azure App Registration. Here, you will create a new redirect URL of the Web type. This URL is crucial because it tells Azure where to send the authentication response after a user grants consent. The specific format for the OTOBO redirect URL is https://<YOUR-OTOBO-ADDRESS>/otobo/index.pl?Action=AdminMailAccount. You must replace <YOUR-OTOBO-ADDRESS> with the actual domain or IP address where your OTOBO system is accessible. This endpoint is specifically designed to handle the OAuth2 callback for mail account administration within OTOBO.

Quellen / Sources

What specific API permissions are required in Azure for OTOBO to access POP3 and IMAP mailboxes using OAuth2?

For OTOBO to successfully access POP3 and IMAP mailboxes via OAuth2 authentication with Microsoft Azure, you must grant specific API permissions within your Azure app registration. The two essential permissions to add are IMAP.AccessAsUser.All and POP.AccessAsUser.All. These permissions ensure that your OTOBO application has the necessary rights to access email accounts on behalf of the user for both IMAP (Internet Message Access Protocol) and POP3 (Post Office Protocol version 3) protocols. Without these explicit permissions, OTOBO will not be able to fetch emails from the configured mailboxes, even if all other OAuth2 settings are correctly in place.

Quellen / Sources

Which OTOBO System Configuration settings are crucial for enabling and finalizing OAuth2 authentication for mail accounts?

After completing the Azure setup, several key System Configuration settings in OTOBO must be adjusted to enable and finalize OAuth2 authentication for your mail accounts. First, you need to activate the specific OAuth2 profile, typically found under OAuth2::MailAccount::Profiles###Custom1. Next, you must accurately enter the Application/Client ID and the Client Secret obtained from your Azure app registration into their respective fields within OTOBO's configuration. Finally, for the OAuth2::MailAccount::Providers###MicrosoftAzure setting, it is critical to replace the default placeholder, often "common", with your specific Tenant ID. These configurations link your OTOBO instance to your Azure application, allowing it to use OAuth2 for secure email retrieval.

Quellen / Sources

Where can I find the Application ID (Client ID) and Tenant ID required for OTOBO's OAuth2 configuration?

The Application ID (also referred to as Client ID) and Tenant ID are essential identifiers obtained during the Azure application registration process and are crucial for configuring OAuth2 in OTOBO. You can find the Application (client) ID within the "Overview" section of your registered application in the Azure Portal, typically after you've created and named your app. The Tenant ID is associated with your Azure Active Directory instance and can usually be found in the "Overview" section of your Azure Active Directory or by checking the properties of your domain. Both IDs are unique to your Azure setup and must be accurately copied into the corresponding fields in OTOBO's System Configuration to establish the secure OAuth2 connection.

Quellen / Sources