XOAUTH2 support in PHP IMAP

Hi Team!

Could you please take a look at
https://github.com/google/gmail-oauth2-tools/issues/18

What do you think? Will it be possible to add XOAUTH2 support to PHP
IMAP extension?

Thanks

The IMAP extension is based on a C library that has not been maintained for
the last decade. As such, it is highly unlikely that the IMAP extension
will ever see new features.

In fact, it is quite likely that the extension will be removed from the PHP
distribution for PHP 8, though no decision has been made on this yet. I
would encourage anyone still using the IMAP extension to instead switch to
one of the pure-PHP mailing libraries. I'm not particularly familiar with
mailing libraries, so don't know which of them already support XOAUTH2,
maybe someone else knows?

In Horde/Imap_client, the API looks like this:

$credential = new \Horde_Imap_Client_Password_Xoauth2($username,
$accesstoken);

The important thing for mail-consuming applications is the realization that
the second argument there (accesstoken) comes from an auth flow. It's not
provided by a user, and it's not provided by the IMAP library.

So to access email over IMAP using PHP, applications need two things (1) an
OAuth library capable of carrying out an OAuth exchange and (2) an IMAP
library capable of submitting an OAuth token to an OAuth aware IMAP server.

Horde/Imap_Client has #2 built in per above. Zend/Mail has third-party
patches, but nothing yet built-in. I'm sure there are other libraries out
there as well. AFAIK, there isn't a single package capable of initiating an
oauth flow exchange and submitting that to an IMAP server. For example,
here's what Moodle did1. (They used their in-built oauth2 consumer and
joined it with Horde/Imap per above.)

It would be possible for us to add an imap_open_token($username, $token)
interface that did effectively what Horde does above. It is, after all,
just passing a certain encoded line string to the IMAP server and handling
the response. But even if we did add that, it still wouldn't solve the
problem consumers have: they need to initiate an oauth flow to get a token,
and that's something no drop-in replacement can solve. It's legitimately
new code.