使用MailKit连接Outlook IMAP服务器遇认证后无法连接问题求助

问题描述 #

使用MailKit连接Outlook Office 365的IMAP服务器时，认证步骤显示成功，但执行后续NAMESPACE命令时返回错误：BAD User is authenticated but not connected.，偶尔能成功连接一次，但大部分时间失败。

错误日志 #

Connected to imaps://outlook.office365.com:993/
S: * OK The Microsoft Exchange IMAP4 service is ready. [QgBFADEAUAAyADgAMQBDAEEAMAAxADEAMgAuAEQARQBVAFAAMgA4ADEALgBQAFIATwBEAC4ATwBVAFQATABPAE8ASwAuAEMATwBNAA==]
C: A00000000 CAPABILITY
S: * CAPABILITY IMAP4 IMAP4rev1 AUTH=PLAIN AUTH=XOAUTH2 SASL-IR UIDPLUS ID UNSELECT CHILDREN IDLE NAMESPACE LITERAL+
S: A00000000 OK CAPABILITY completed.
C: A00000001 AUTHENTICATE XOAUTH2 ********
S: A00000001 OK AUTHENTICATE completed.
C: A00000002 CAPABILITY
S: * CAPABILITY IMAP4 IMAP4rev1 AUTH=PLAIN AUTH=XOAUTH2 SASL-IR UIDPLUS MOVE ID UNSELECT CLIENTACCESSRULES CLIENTNETWORKPRESENCELOCATION BACKENDAUTHENTICATE CHILDREN IDLE NAMESPACE LITERAL+
S: A00000002 OK CAPABILITY completed.
C: A00000003 NAMESPACE
S: A00000003 BAD User is authenticated but not connected.

解码后的Token信息 #

{  
  "aud": "https://outlook.office365.com",
  "iss": "https://sts.windows.net/b31248b9-b6a2-4977-98dd-3acb1524975b/",
  "iat": 1727428055,
  "nbf": 1727428055,
  "exp": 1727431955,
  "aio": "hidden",
  "app_displayname": "EmailScannerSingleTenant",
  "appid": "hidden",
  "appidacr": "1",
  "idp": "hidden",
  "idtyp": "app",
  "oid": "hidden",
  "rh": "hidden",
  "roles": [
    "User.Read.All",
    "full_access_as_app",
    "Mail.ReadWrite",
    "POP.AccessAsApp",
    "User.ReadBasic.All",
    "Mail.Read",
    "IMAP.AccessAsApp",
    "SMTP.SendAsApp",
    "Exchange.ManageAsApp"
  ],
  "sid": "hidden",
  "sub": "hidden",
  "tid": "hidden",
  "uti": "hidden",
  "ver": "1.0",
  "wids": [
    "hidden"
  ],
  "xms_idrel": "7 8"
}

连接代码 #

else if (settings.Protocol.Equals("IMAP"))
{
    try
    {
        var protocolLogger = new ProtocolLogger("imap-log.txt");
        using (var client = new ImapClient(protocolLogger))
        {
            await client.ConnectAsync("outlook.office365.com", 993, SecureSocketOptions.SslOnConnect);
            // 邮箱格式示例：hidden@62tlhv.onmicrosoft.com
            await client.AuthenticateAsync(new SaslMechanismOAuth2(settings.ClientLogin, result.AccessToken));

            var a = client.Inbox.Open(FolderAccess.ReadWrite);
            await client.DisconnectAsync(true);
        }
    }
    catch (Exception ex)
    {
    }
}

已尝试的操作 #

• 使用https://outlook.office365.com/.default和https://ps.outlook.com/.default两种Scope
• 已配置所有必要权限（包含IMAP.AccessAsApp、full_access_as_app等核心权限）

成功连接时的日志参考 #

Connected to imaps://outlook.office365.com:993/
S: * OK The Microsoft Exchange IMAP4 service is ready. [RgBSADIAUAAyADgAMQBDAEEAMAAxADEAMgAuAEQARQBVAFAAMgA4ADEALgBQAFIATwBEAC4ATwBVAFQATABPAE8ASwAuAEMATwBNAA==]
C: A00000000 CAPABILITY
S: * CAPABILITY IMAP4 IMAP4rev1 AUTH=PLAIN AUTH=XOAUTH2 SASL-IR UIDPLUS ID UNSELECT CHILDREN IDLE NAMESPACE LITERAL+
S: A00000000 OK CAPABILITY completed.
C: A00000001 AUTHENTICATE XOAUTH2 ********
S: A00000001 OK AUTHENTICATE completed.
C: A00000002 CAPABILITY
S: * CAPABILITY IMAP4 IMAP4rev1 AUTH=PLAIN AUTH=XOAUTH2 SASL-IR UIDPLUS MOVE ID UNSELECT CLIENTACCESSRULES CLIENTNETWORKPRESENCELOCATION BACKENDAUTHENTICATE CHILDREN IDLE NAMESPACE LITERAL+
S: A00000002 OK CAPABILITY completed.
C: A00000003 NAMESPACE
S: * NAMESPACE (("" "/")) NIL NIL
S: A00000003 OK NAMESPACE completed.
C: A00000004 LIST "" "INBOX"
S: * LIST (\Marked \HasNoChildren) "/" INBOX
S: A00000004 OK LIST completed.
C: A00000005 SELECT INBOX
S: * 1 EXISTS
S: * 1 RECENT
S: * FLAGS (\Seen \Answered \Flagged \Deleted \Draft $MDNSent)
S: * OK [PERMANENTFLAGS (\Seen \Answered \Flagged \Deleted \Draft $MDNSent)] Permanent flags
S: * OK [UNSEEN 1] Is the first unseen message
S: * OK [UIDVALIDITY 14] UIDVALIDITY value
S: * OK [UIDNEXT 16] The next unique identifier value
S: A00000005 OK [READ-WRITE] SELECT completed.
C: A00000006 LOGOUT
S: * BYE Microsoft Exchange Server IMAP4 server signing off.
S: A00000006 OK LOGOUT completed.

解决方案建议 #

1. 添加延迟或重试机制
   该错误多由Exchange服务器端会话同步延迟导致——认证成功后，服务器尚未完成会话初始化就收到后续命令。可在认证后添加短暂延迟，或对Inbox.Open操作包裹重试逻辑：

await client.AuthenticateAsync(new SaslMechanismOAuth2(settings.ClientLogin, result.AccessToken));
// 添加1秒延迟等待服务器会话初始化
await Task.Delay(1000);

// 或用重试逻辑处理异常
var retryCount = 3;
while (retryCount > 0)
{
    try
    {
        var a = client.Inbox.Open(FolderAccess.ReadWrite);
        break;
    }
    catch (ImapCommandException ex) when (ex.Message.Contains("User is authenticated but not connected"))
    {
        retryCount--;
        await Task.Delay(500);
        if (retryCount == 0) throw;
    }
}

2. 验证Token与邮箱的租户一致性
   确认settings.ClientLogin对应的邮箱属于Token中tid字段指定的租户，且应用权限已正确授予该租户下的目标邮箱。

3. 升级MailKit到最新版本
   旧版本MailKit可能存在与Exchange IMAP会话的兼容性问题，升级到最新稳定版可解决部分隐性bug。

4. 减少不必要的CAPABILITY请求
   从日志可见，认证前后重复发送了CAPABILITY命令，虽然不是直接诱因，但可移除认证后的重复请求，降低服务器负载：

await client.ConnectAsync("outlook.office365.com", 993, SecureSocketOptions.SslOnConnect);
// 移除认证后的CAPABILITY请求，MailKit内部会自动处理必要的能力协商
await client.AuthenticateAsync(new SaslMechanismOAuth2(settings.ClientLogin, result.AccessToken));

内容的提问来源于stack exchange，提问作者Michał Tulej