SMTP and OAuth 2

Question

Does .NET support SMTP authentication via OAuth protocol? Basically, I would like to be able to send emails on users' behalves using OAuth access tokens. However, I couldn't find a support for this in the .NET framework.

Google provides some samples for this in other environments but not .NET.

Answer 1

System.Net.Mail does not support OAuth or OAuth2. However, you can use MailKit's (note: only supports OAuth2) SmtpClient to send messages as long as you have the user's OAuth access token (MailKit does not have code that will fetch the OAuth token, but it can use it if you have it).

The first thing you need to do is follow Google's instructions for obtaining OAuth 2.0 credentials for your application.

Once you've done that, the easiest way to obtain an access token is to use Google's Google.Apis.Auth library:

var certificate = new X509Certificate2 (@"C:\path\to\certificate.p12", "password", X509KeyStorageFlags.Exportable);
var credential = new ServiceAccountCredential (new ServiceAccountCredential
    .Initializer ("your-developer-id@developer.gserviceaccount.com") {
    // Note: other scopes can be found here: https://developers.google.com/gmail/api/auth/scopes
    Scopes = new[] { "https://mail.google.com/" },
    User = "username@gmail.com"
}.FromCertificate (certificate));

bool result = await credential.RequestAccessTokenAsync (CancellationToken.None);

// Note: result will be true if the access token was received successfully

Now that you have an access token (credential.Token.AccessToken), you can use it with MailKit as if it were the password:

using (var client = new SmtpClient ()) {
    client.Connect ("smtp.gmail.com", 587, SecureSocketOptions.StartTls);

    // use the access token
    var oauth2 = new SaslMechanismOAuth2 ("username@gmail.com", credential.Token.AccessToken);
    client.Authenticate (oauth2);

    client.Send (message);

    client.Disconnect (true);
}

Answer 2

I got it working by using Microsoft.Identity.Client and MailKit.Net.Smtp.SmtpClient like this using Office 365 / Exchange Online. App registration requires API permissions SMTP.Send.

var options = new PublicClientApplicationOptions
{
    ClientId = "00000000-0000-0000-0000-000000000000",
    TenantId = " 00000000-0000-0000-0000-000000000000",
    RedirectUri = "http://localhost"
};

var publicClientApplication = PublicClientApplicationBuilder
    .CreateWithApplicationOptions(options)
    .Build();

var scopes = new string[] {
    "email",
    "offline_access",
    "https://outlook.office.com/SMTP.Send" // Only needed for SMTP
};

var authToken = await publicClientApplication.AcquireTokenInteractive(scopes).ExecuteAsync();

//Test refresh token
var newAuthToken = await publicClientApplication.AcquireTokenSilent(scopes, authToken.Account).ExecuteAsync(cancellationToken);

var oauth2 = new SaslMechanismOAuth2(authToken.Account.Username, authToken.AccessToken);

using (var client = new SmtpClient())
{
    await client.ConnectAsync("smtp.office365.com", 587, SecureSocketOptions.StartTls);
    await client.AuthenticateAsync(oauth2);

    var message = new MimeMessage();
    message.From.Add(MailboxAddress.Parse(authToken.Account.Username));
    message.To.Add(MailboxAddress.Parse("toEmail"));
    message.Subject = "Test";
    message.Body = new TextPart("plain") { Text = @"Oscar Testar" };

    await client.SendAsync(message, cancellationToken);

    await client.DisconnectAsync(true);
}

Based on this example:

https://github.com/jstedfast/MailKit/blob/master/ExchangeOAuth2.md

Answer 3

Just adding to the above answer. I also spend lot of time to find out things for sending email using gmail oAuth2 with mailkit in .net. As I am using this to send email to my App users. Thanks to mailkit developers.

Now we need:

• Authorization code
• Client ID
• Client Secret
• Refresh Token
• Access Token

You can directly get the Client Id and Client Secret from google console by creating your project.

Next you can enable gmail app from the Google Developers OAuth Playground by using your own OAuth credentials in left top setting button.

After that Select and Authorize the API https://mail.google.com/.

Now you can directly refresh token by this http POST request https://developers.google.com/oauthplayground/refreshAccessToken. you will find the parameter in there.

Now you can directly use this code in your C# code using MailKit:

using (var client = new SmtpClient())
{
    client.Connect("smtp.gmail.com", 587, SecureSocketOptions.StartTls);
    
    var oauth2 = new SaslMechanismOAuth2(GMailAccount, token.AccessToken);
    client.Authenticate(oauth2);
    
    await client.SendAsync(mailMessage);
    client.Disconnect(true);
}

Now you will be able to send email through your gmail account from server side.

Answer 4

Using MailKit as referenced in the other answers, I was hitting an authentication issue requiring more scopes to be requested from Gmail. For anyone experiencing "Authentication Failed error" with either of the other answers, this answer uses the Gmail API instead in order to avoid requesting more scopes.

Using some pieces from this answer: https://stackoverflow.com/a/35795756/7242722

Here's a complete example which worked for me:

var fromAddress = new MailboxAddress(fromName, fromEmail);
var toAddress = new MailboxAddress(toName, toEmail);

List<MailboxAddress> ccMailAddresses = new List<MailboxAddress>();
if (ccEmails != null)
    foreach (string ccEmail in ccEmails)
        ccMailAddresses.Add(new MailboxAddress(string.Empty, ccEmail));

var message = new MimeMessage();
message.To.Add(toAddress);
message.From.Add(fromAddress);
message.Subject = subject;

var bodyBuilder = new BodyBuilder();
bodyBuilder.HtmlBody = body;
bodyBuilder.TextBody = HtmlUtilities.ConvertToPlainText(body);
message.Body = bodyBuilder.ToMessageBody();

foreach (MailboxAddress ccMailAddress in ccMailAddresses)
    message.Cc.Add(ccMailAddress);
    
GoogleAuthorizationCodeFlow authorizationCodeFlow = new GoogleAuthorizationCodeFlow(new GoogleAuthorizationCodeFlow.Initializer
{
    ClientSecrets = new ClientSecrets()
    {
        ClientId = <ClientId>,
        ClientSecret = <ClientSecret>
    },
});

TokenResponse tokenResponse = await authorizationCodeFlow.RefreshTokenAsync("id", <RefreshToken>, CancellationToken.None);

UserCredential credential = new UserCredential(authorizationCodeFlow, "id", tokenResponse);

var gmailService = new GmailService(new BaseClientService.Initializer()
{
    ApplicationName = <AppName>,
    HttpClientInitializer = credential,
});

Google.Apis.Gmail.v1.Data.Message gmailMessage = new Google.Apis.Gmail.v1.Data.Message();
gmailMessage.Raw = Utilities.Base64UrlEncode(message.ToString());
var result = gmailService.Users.Messages.Send(gmailMessage, "me").Execute();