Using oama with Gmail and Outlook personal accounts

[hpfr]

I use oama for a personal Gmail account and a Microsoft organization account. In light of Keeping our Outlook Personal Email Users Safe: Reinforcing Our Commitment to Security - Microsoft Community Hub, I would like to use it for an Outlook Personal account as well.

• For the Microsoft-based organization account, I was able to use the Azure portal to register an application as described in various blog posts. Setting up oama was straightforward.

• For the personal Gmail account, Google makes you log in every seven days unless you submit your app for verification:

  Authorizations by a test user will expire seven days from the time of consent. If your OAuth client requests an offline access type and receives a refresh token, that token will also expire. —Setting up your OAuth consent screen - Google Cloud Platform Console Help

  I resorted to using the Thunderbird credentials assuming that the verification would be rejected since it’s not a “real” application, just a registration for personal use: Verification requirements - Google Cloud Platform Console Help.

• For the Outlook personal account, using the Azure portal requires signing up for a developer program with a phone number:

  However, starting June 2024, all applications must be registered in a directory. This could be an existing directory, or a new one that the personal Microsoft account user creates to house their Entra applications and other Microsoft resources. Users can easily create a new directory to use for this purpose by joining the M365 Developer Program or signing up for Azure. —Updates and breaking changes - Microsoft identity platform | Microsoft Learn

  I tried using the Thunderbird credentials, but I ran into issues where the redirect URI was HTTPS-based. I ultimately had to revert to using mutt_oauth2.py, which provides a manual auth flow that doesn’t use the redirect URI and just lets you copy a code in the URL that shows up after authentication.

I guess Thunderbird is doing the HTTPS localhost redirect somehow. Is it possible to get this working with oama? Presumably the “manual” flow is out of scope for oama as a “general-purpose” OAuth credential manager.

Even if it’s possible to get oama working with Outlook Personal and the Thunderbird credentials, I’m also curious if anyone has had more success with registering personal OAuth applications for Gmail and Outlook Personal accounts. I know this is basically off-topic with respect to oama, but I’m not sure of a better place to ask? Since the mutt_oauth2.py README covers app registrations, I opened an issue there: mutt_oauth2.py.README: Outdated app registration instructions (#485) · Issues · Mutt Project / mutt · GitLab

[hpfr]

The device code flow implemented in 0.19 (#75) means Outlook Personal accounts work again with the Thunderbird client ID. So now I guess this discussion can lie dormant until the Thunderbird hack breaks…