How to implement Oauth 2.0 in PHPMailer for Exchange Online - php

Question

As many of you are aware, Microsoft is deprecating basic authentication (login and password) for Exchange online on 01/10/2022 onwards. You can read the full article over here:
https://www.microsoft.com/en-us/microsoft-365/blog/2022/09/01/microsoft-retires-basic-authentication-in-exchange-online/#:~:text=As%20previously%20announced%2C%20we%20are,users%20move%20to%20Modern%20Authentication
I am currently using PHPMailer to send e-mails via SMTP from an application.
Working example of the current code:
<?php
include "vendor/autoload.php";
use PHPMailer\PHPMailer\PHPMailer;
use PHPMailer\PHPMailer\Exception;
$mail = new PHPMailer;
$mail->IsSMTP();
$mail->Host = "smtp.office365.com";
$mail->Port = "587";
$mail->SMTPAuth = true;
$mail->Username = "my_email#my-company.com";
$mail->Password = "my_password";
$mail->SMTPSecure = "tls";
$mail->From = "my_email#my-company.com";
$mail->FromName = "my_name";
$mail->AddAddress("my_email#my-company.com");
$mail->IsHTML(true);
$mail->Subject = "This is a test subject";
$mail->Body = "Hello, how are you?";
$mail->Send();
?>
I want to transfer from basic authentication to OAuth 2.0. After reading a lot of documentation, searching the web for 3 days, trying and trying, I am not able to get it working.
Example of my new code:
<?php
include "vendor/autoload.php";
use PHPMailer\PHPMailer\Exception;
use PHPMailer\PHPMailer\OAuth;
use PHPMailer\PHPMailer\PHPMailer;
use PHPMailer\PHPMailer\SMTP;
use Stevenmaguire\OAuth2\Client\Provider\Microsoft;
$mail = new PHPMailer;
$mail->isSMTP();
$mail->Host = "smtp.office365.com";
$mail->SMTPAuth = true;
$mail->AuthType = "XOAUTH2";
$mail->SMTPDebug = SMTP::DEBUG_LOWLEVEL;
$mail->SMTPSecure = "tls";
$mail->Port = 587;
$username = "my_email#my-company.com";
$clientId = "client_id_from_azure_app_registration";
$clientSecret = "client_secret_from_azure_app_registration";
$redirectURI = "my_redirect_uri";
$Token = "my_token";
$mail->refresh_token = $Token;
$provider = new Stevenmaguire\OAuth2\Client\Provider\Microsoft(
[
"clientId" => $clientId,
"clientSecret" => $clientSecret,
"redirectUri" => $redirectURI
]
);
$provider->urlAPI = "https://outlook.office365.com/.default";
$provider->scope = "Mail.Send";
$mail->setOAuth(
new OAuth(
[
"provider" => $provider,
"clientId" => $clientId,
"clientSecret" => $clientSecret,
"refreshToken" => $Token,
"userName" =>$username
]
)
);
$mail->From = $username;
$mail->AddAddress("my_email#my-company.com");
$mail->IsHTML(true);
$mail->Subject = "This is a test subject";
$mail->Body = "Hello, how are you?";
$mail->Send();
?>
I generate an access token via Postman and use this token in the code above:
The application is configured in Microsoft Azure with the required permissions:
This is the output I get:
2022-09-27 13:51:38 Connection: opening to smtp.office365.com:587, timeout=300, options=array()
2022-09-27 13:51:38 Connection: opened
2022-09-27 13:51:38 SMTP INBOUND: "220 AS4P191CA0011.outlook.office365.com Microsoft ESMTP MAIL Service ready at Tue, 27 Sep 2022 13:51:37 +0000"
2022-09-27 13:51:38 SERVER -> CLIENT: 220 AS4P191CA0011.outlook.office365.com Microsoft ESMTP MAIL Service ready at Tue, 27 Sep 2022 13:51:37 +0000
2022-09-27 13:51:38 CLIENT -> SERVER: EHLO
2022-09-27 13:51:38 SMTP INBOUND: "250-AS4P191CA0011.outlook.office365.com Hello [2a02:4780:8:2::25]"
2022-09-27 13:51:38 SMTP INBOUND: "250-SIZE 157286400"
2022-09-27 13:51:38 SMTP INBOUND: "250-PIPELINING"
2022-09-27 13:51:38 SMTP INBOUND: "250-DSN"
2022-09-27 13:51:38 SMTP INBOUND: "250-ENHANCEDSTATUSCODES"
2022-09-27 13:51:38 SMTP INBOUND: "250-STARTTLS"
2022-09-27 13:51:38 SMTP INBOUND: "250-8BITMIME"
2022-09-27 13:51:38 SMTP INBOUND: "250-BINARYMIME"
2022-09-27 13:51:38 SMTP INBOUND: "250-CHUNKING"
2022-09-27 13:51:38 SMTP INBOUND: "250 SMTPUTF8"
2022-09-27 13:51:38 SERVER -> CLIENT: 250-AS4P191CA0011.outlook.office365.com Hello [2a02:4780:8:2::25]250-SIZE 157286400250-PIPELINING250-DSN250-ENHANCEDSTATUSCODES250-STARTTLS250-8BITMIME250-BINARYMIME250-CHUNKING250 SMTPUTF8
2022-09-27 13:51:38 CLIENT -> SERVER: STARTTLS
2022-09-27 13:51:38 SMTP INBOUND: "220 2.0.0 SMTP server ready"
2022-09-27 13:51:38 SERVER -> CLIENT: 220 2.0.0 SMTP server ready
2022-09-27 13:51:38 CLIENT -> SERVER: EHLO
2022-09-27 13:51:38 SMTP INBOUND: "250-AS4P191CA0011.outlook.office365.com Hello [2a02:4780:8:2::25]"
2022-09-27 13:51:38 SMTP INBOUND: "250-SIZE 157286400"
2022-09-27 13:51:38 SMTP INBOUND: "250-PIPELINING"
2022-09-27 13:51:38 SMTP INBOUND: "250-DSN"
2022-09-27 13:51:38 SMTP INBOUND: "250-ENHANCEDSTATUSCODES"
2022-09-27 13:51:38 SMTP INBOUND: "250-AUTH LOGIN XOAUTH2"
2022-09-27 13:51:38 SMTP INBOUND: "250-8BITMIME"
2022-09-27 13:51:38 SMTP INBOUND: "250-BINARYMIME"
2022-09-27 13:51:38 SMTP INBOUND: "250-CHUNKING"
2022-09-27 13:51:38 SMTP INBOUND: "250 SMTPUTF8"
2022-09-27 13:51:38 SERVER -> CLIENT: 250-AS4P191CA0011.outlook.office365.com Hello [2a02:4780:8:2::25]250-SIZE 157286400250-PIPELINING250-DSN250-ENHANCEDSTATUSCODES250-AUTH LOGIN XOAUTH2250-8BITMIME250-BINARYMIME250-CHUNKING250 SMTPUTF8
2022-09-27 13:51:38 Auth method requested: XOAUTH2
2022-09-27 13:51:38 Auth methods available on the server: LOGIN,XOAUTH2
Fatal error: Uncaught League\OAuth2\Client\Provider\Exception\IdentityProviderException: Bad Request in /home/u760208683/vendor/stevenmaguire/oauth2-microsoft/src/Provider/Microsoft.php:79 Stack trace: #0 /home/u760208683/vendor/league/oauth2-client/src/Provider/AbstractProvider.php(628): Stevenmaguire\OAuth2\Client\Provider\Microsoft->checkResponse(Object(GuzzleHttp\Psr7\Response), Array) #1 /home/u760208683/vendor/league/oauth2-client/src/Provider/AbstractProvider.php(537): League\OAuth2\Client\Provider\AbstractProvider->getParsedResponse(Object(GuzzleHttp\Psr7\Request)) #2 /home/u760208683/vendor/phpmailer/phpmailer/src/OAuth.php(115): League\OAuth2\Client\Provider\AbstractProvider->getAccessToken(Object(League\OAuth2\Client\Grant\RefreshToken), Array) #3 /home/u760208683/vendor/phpmailer/phpmailer/src/OAuth.php(128): PHPMailer\PHPMailer\OAuth->getToken() #4 /home/u760208683/vendor/phpmailer/phpmailer/src/SMTP.php(598): PHPMailer\PHPMailer\OAuth->getOauth64() #5 /home/u760208683/vendor/phpmailer/phpmailer/src/PHPMailer in /home/u760208683/vendor/stevenmaguire/oauth2-microsoft/src/Provider/Microsoft.php on line 79
Can anyone point me in the right direction?
Many thanks in advance!
Kind regards,
Laurents

Answer 1

Fatal error: Uncaught League\OAuth2\Client\Provider\Exception\IdentityProviderException:
This error is due to the fact you are providing an access_token to send the mail instead of a refresh_token.
First of all, add the scope offline_access to get a refresh_token in your authorise url and save it somewhere in your app ( expiration is 24 hour or 90 days depends on type of app)
once you have the refresh token you can send as many mails as you want with the same token.
you can get new one by providing another non expired refresh token in the url and change grant_type to refresh_token and add the key refresh_token.