WPF项目用MailKit+OAuth连接Office365 SMTP/IMAP认证故障求助

背景 #

我刚启动一个新的WPF项目，需要连接Office 365以实现SMTP和IMAP功能。已从Entra获取以下信息：

• ClientID
• TenantID
• SecretValue
• SecretID

先从基础认证开始尝试，以下代码可正常运行：

Public Function SendMail(MailBody As String, MailSubject As String, SendTo As String, SentFrom As String) As String
Try
    Dim vEmail = New MimeMessage()
    vEmail.From.Add(MailboxAddress.Parse(SentFrom))
    vEmail.To.Add(MailboxAddress.Parse(SendTo))
    vEmail.Subject = MailSubject
    vEmail.Body = New TextPart(TextFormat.Html) With {.Text = MailBody}
    Using vClient = New SmtpClient
        vClient.Connect("smtp-legacy.office365.com", 587, SecureSocketOptions.StartTls)
        vClient.Authenticate(MailUserName, MailPasssword)
        vClient.Send(vEmail)
        vClient.Disconnect(True)
    End Using
    Return "Email was sent!"
Catch ex As Exception
    EmailError(ex)
    Return "Email sending failed"
End Try
End Function

首次OAuth2尝试及错误 #

随后参考MailKit官网示例尝试OAuth2认证，代码如下：

Public Function SendAuthMail(MailBody As String, Mailsubject As String, SendTo As String, SentFrom As String) As String
Try
    Dim vEmail = New MimeMessage()
    vEmail.From.Add(MailboxAddress.Parse(SentFrom))
    vEmail.To.Add(MailboxAddress.Parse(SendTo))
    vEmail.Subject = Mailsubject
    vEmail.Body = New TextPart(TextFormat.Html) With {.Text = MailBody}
    Dim options = New PublicClientApplicationOptions With {.ClientId = vClientID,
    .TenantId = vTenantID,
    .RedirectUri = "https://login.microsoftonline.com/common/oauth2/nativeclient"}
    Dim scopes = New String() {"email", "offline_access", "https://outlook.office.com/SMTP.Send"}
    Dim publicClientApplication = PublicClientApplicationBuilder.CreateWithApplicationOptions(options).Build()
    Dim authToken = publicClientApplication.AcquireTokenInteractive(scopes).ExecuteAsync()
    Dim v2 = New SaslMechanismOAuth2(authToken.Account.Username, authToken.AccessToken)

    Using vClient = New SmtpClient
        vClient.Connect("smtp.office365.com", 587, SecureSocketOptions.StartTls)
        vClient.Authenticate(v2)
        vClient.Send(vEmail)
        vClient.Disconnect(True)
    End Using
    Return "Email was sent"
Catch ex As Exception
    EmailError(ex)
    Return "Email sending failed"
End Try
End Function

但authToken.Account.Username和authToken.AccessToken均报错，提示*'Account' 不是 'Task(Of AuthenticationResult)' 的成员以及'AccessToken' 不是 'Task(Of AuthenticationResult)' 的成员*。

编辑更新：改用ConfidentialClientApplication #

尝试使用ConfidentialClientApplication实现认证，代码如下：

Dim AuthClient = ConfidentialClientApplicationBuilder.Create(vClientID).
                                 WithAuthority(AzureCloudInstance.AzurePublic, vTenantID).
                                 WithClientSecret(SecretValue).
                                 Build

Dim AuthResult = AuthClient.AcquireTokenForClient({"https://outlook.office365.com/.default"}).ExecuteAsync.Result
Dim vAuth As New SaslMechanismOAuth2(SentFrom, AuthResult.AccessToken)

现在能看到“authentication failed”的提示，但没有明确的失败原因。

进一步更新：认证环节细节问题 #

主要问题集中在认证环节，与SaslMechanismOAuth2和认证令牌有关。根据查阅的所有示例，AuthenticationResult应该暴露.Account.UserName和.AccessToken属性，但这些属性实际不可用。

查看IMAP连接对话日志：

Connected to imap://outlook.office365.com:993/?starttls=always
Connected to imap://outlook.office365.com:993/?starttls=always
Connected to imap://outlook.office365.com:993/?starttls=always
Connected to imaps://outlook.office365.com:993/
S: * OK The Microsoft Exchange IMAP4 service is ready. [TABPADQAUAAxADIAMwBDAEEAMAAxADAAMgAuAEcAQgBSAFAAMQAyADMALgBQAFIATwBEAC4ATwBVAFQATABPAE8ASwAuAEMATwBNAA==]
C: A00000000 CAPABILITY
S: * CAPABILITY IMAP4 IMAP4rev1 AUTH=PLAIN AUTH=XOAUTH2 SASL-IR UIDPLUS ID UNSELECT CHILDREN IDLE NAMESPACE LITERAL+
S: A00000000 OK CAPABILITY completed.
C: A00000001 AUTHENTICATE XOAUTH2 ********
S: A00000001 NO AUTHENTICATE failed.

日志显示：使用starttls时服务器会断开连接，但使用SSL可以连接；不过AUTHENTICATE XOAUTH2认证失败，本该传递的长字符串未正常生成。

内容的提问来源于stack exchange，提问作者gchq