Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:107951
MIME-Version: 1.0
References: <b85f9c5c757e75ffae3f8c07906471cb3a14d01b@webmail.likebtn.com> <CAF+90c_Kt9SsqAzdL439gjCOq8nyTM=mkkh-whDqSH4WKi5Akw@mail.gmail.com>
In-Reply-To: <CAF+90c_Kt9SsqAzdL439gjCOq8nyTM=mkkh-whDqSH4WKi5Akw@mail.gmail.com>
Reply-To: bishop@php.net
Date: Fri, 27 Dec 2019 12:18:27 -0500
Message-ID: <CAEYWF=5hgDjUBcmAbrBd50pGRVPY4WZ9Wb0B2aRY1AiXs2==HA@mail.gmail.com>
To: Nikita Popov <nikita.ppv@gmail.com>
Cc: FreeScout <info@freescout.net>, PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="000000000000243065059ab2b040"
Subject: Re: [PHP-DEV] XOAUTH2 support in PHP IMAP
From: bishop@php.net (Bishop Bettini)

--000000000000243065059ab2b040
Content-Type: text/plain; charset="UTF-8"

On Thu, Dec 26, 2019 at 6:45 AM Nikita Popov <nikita.ppv@gmail.com> wrote:

> On Wed, Dec 25, 2019 at 7:11 PM FreeScout <info@freescout.net> wrote:
>
> >
> > Hi Team!
> >
> > Could you please take a look at
> > https://github.com/google/gmail-oauth2-tools/issues/18
> >
> > What do you think? Will it be possible to add XOAUTH2 support to PHP
> > IMAP extension?
> >
> > Thanks
> >
>
> The IMAP extension is based on a C library that has not been maintained for
> the last decade. As such, it is highly unlikely that the IMAP extension
> will ever see new features.
>
> In fact, it is quite likely that the extension will be removed from the PHP
> distribution for PHP 8, though no decision has been made on this yet. I
> would encourage anyone still using the IMAP extension to instead switch to
> one of the pure-PHP mailing libraries. I'm not particularly familiar with
> mailing libraries, so don't know which of them already support XOAUTH2,
> maybe someone else knows?
>

In Horde/Imap_client, the API looks like this:

$credential = new \Horde_Imap_Client_Password_Xoauth2($username,
$accesstoken);

The important thing for mail-consuming applications is the realization that
the second argument there (accesstoken) comes from an auth flow. It's not
provided by a user, and it's not provided by the IMAP library.

So to access email over IMAP using PHP, applications need two things (1) an
OAuth library capable of carrying out an OAuth exchange and (2) an IMAP
library capable of submitting an OAuth token to an OAuth aware IMAP server.

Horde/Imap_Client has #2 built in per above. Zend/Mail has third-party
patches, but nothing yet built-in. I'm sure there are other libraries out
there as well. AFAIK, there isn't a single package capable of initiating an
oauth flow exchange and submitting that to an IMAP server. For example,
here's what Moodle did[1]. (They used their in-built oauth2 consumer and
joined it with Horde/Imap per above.)

It would be possible for us to add an imap_open_token($username, $token)
interface that did effectively what Horde does above. It is, after all,
just passing a certain encoded line string to the IMAP server and handling
the response. But even if we did add that, it still wouldn't solve the
problem consumers have: they need to initiate an oauth flow to get a token,
and that's something no drop-in replacement can solve. It's legitimately
new code.

[1]: https://moodle.org/mod/forum/discuss.php?d=366716

--000000000000243065059ab2b040--