Microsoft账号IMAP Store认证失败，需在Talend项目实现OAuth2

问题描述 #

无法连接到IMAP Store，抛出认证失败错误：

Exception in thread "main" javax.mail.AuthenticationFailedException: AUTHENTICATE failed.
at com.sun.mail.imap.IMAPStore.protocolConnect(IMAPStore.java:732)
at javax.mail.Service.connect(Service.java:366)

尝试在Talend项目中通过OAuth2连接Microsoft账号，但现有代码未解决问题，代码如下：

import javax.mail.Flags;
import javax.mail.Folder;
import javax.mail.Message;
import javax.mail.Session;
import javax.mail.search.FlagTerm; 
import com.sun.mail.imap.IMAPStore; 

public class Email {
    public static void main(String[] args) throws Exception {
        final String username = "my_username";
        final String password = "my_password";
        final String clientId = "my_client_id";
        final String clientSecret = "my_client_secret";
        final String imapHost = "outlook.office365.com";
        final String imapPort = "993";         

        Properties props = new Properties();
        props.put("mail.imap.ssl.enable", "true");
        props.put("mail.imap.sasl.enable", "true");
        props.put("mail.imap.sasl.mechanisms", "XOAUTH2");
        props.put("mail.imap.auth.login.disable", "true");
        props.put("mail.imap.auth.plain.disable", "true");
        props.put("mail.imap.ssl.trust", imapHost);
        props.put("mail.imap.sasl.mechanisms.oauth2.clientId",clientId);
        props.put("mail.imap.sasl.mechanisms.oauth2.clientSecret", clientSecret);         

        Session session = Session.getInstance(props);
        IMAPStore store = (IMAPStore) session.getStore("imap");
        store.connect(imapHost, Integer.parseInt(imapPort), username, password);         

        Folder inbox = store.getFolder("inbox");
        inbox.open(Folder.READ_ONLY);         

        Flags seen = new Flags(Flags.Flag.SEEN);
        FlagTerm unseenFlagTerm = new FlagTerm(seen, false);
        Message[] messages = inbox.search(unseenFlagTerm);         

        for (Message message :messages){
            System.out.println("Subject: " + message.getSubject());
            System.out.println("From: " + message.getFrom()[0]);
            System.out.println("Sent Date: " + message.getSentDate());
            System.out.println();
        }     
    }
}

问题分析与修复方案 #

现有代码核心问题是未正确实现OAuth2令牌获取逻辑：JavaMail的XOAUTH2机制需要传递OAuth2访问令牌，而非账号密码，同时微软OAuth2有额外配置要求。

1. 确认Azure AD应用配置正确 #

• 在Azure门户注册应用，启用IMAP权限（IMAP.AccessAsUser.All），设置对应重定向URI（桌面应用可设为http://localhost）
• 确保应用已获得管理员或用户权限同意
• 优先使用授权码模式而非客户端凭证模式，适配用户账号场景

2. 修改代码实现OAuth2令牌获取与连接 #

以下是调整后的完整代码，核心是先获取访问令牌，再用令牌替代密码完成IMAP连接：

import javax.mail.Flags;
import javax.mail.Folder;
import javax.mail.Message;
import javax.mail.Session;
import javax.mail.search.FlagTerm;
import com.sun.mail.imap.IMAPStore;
import java.util.Properties;
import java.io.IOException;
import okhttp3.OkHttpClient;
import okhttp3.Request;
import okhttp3.RequestBody;
import okhttp3.MediaType;
import okhttp3.Response;
import org.json.JSONObject;

public class EmailOAuth2 {
    public static void main(String[] args) throws Exception {
        final String username = "your_microsoft_email@outlook.com";
        final String clientId = "your_client_id";
        final String clientSecret = "your_client_secret";
        final String refreshToken = "your_refresh_token"; // 需先通过授权码模式获取
        final String imapHost = "outlook.office365.com";
        final String imapPort = "993";

        // 获取OAuth2访问令牌
        String accessToken = getAccessToken(clientId, clientSecret, refreshToken);

        // 配置JavaMail属性
        Properties props = new Properties();
        props.put("mail.imap.ssl.enable", "true");
        props.put("mail.imap.sasl.enable", "true");
        props.put("mail.imap.sasl.mechanisms", "XOAUTH2");
        props.put("mail.imap.auth.login.disable", "true");
        props.put("mail.imap.auth.plain.disable", "true");
        props.put("mail.imap.ssl.trust", imapHost);

        Session session = Session.getInstance(props);
        // 用访问令牌作为密码参数连接IMAP
        IMAPStore store = (IMAPStore) session.getStore("imap");
        store.connect(imapHost, Integer.parseInt(imapPort), username, accessToken);

        Folder inbox = store.getFolder("inbox");
        inbox.open(Folder.READ_ONLY);

        Flags seen = new Flags(Flags.Flag.SEEN);
        FlagTerm unseenFlagTerm = new FlagTerm(seen, false);
        Message[] messages = inbox.search(unseenFlagTerm);

        for (Message message : messages) {
            System.out.println("Subject: " + message.getSubject());
            System.out.println("From: " + message.getFrom()[0]);
            System.out.println("Sent Date: " + message.getSentDate());
            System.out.println();
        }

        inbox.close(false);
        store.close();
    }

    // 从微软令牌端点获取访问令牌
    private static String getAccessToken(String clientId, String clientSecret, String refreshToken) throws IOException {
        OkHttpClient client = new OkHttpClient();
        MediaType mediaType = MediaType.parse("application/x-www-form-urlencoded");
        RequestBody body = RequestBody.create(mediaType,
                "client_id=" + clientId +
                "&scope=https%3A%2F%2Foutlook.office365.com%2FIMAP.AccessAsUser.All offline_access" +
                "&refresh_token=" + refreshToken +
                "&grant_type=refresh_token" +
                "&client_secret=" + clientSecret);
        Request request = new Request.Builder()
                .url("https://login.microsoftonline.com/common/oauth2/v2.0/token")
                .post(body)
                .build();

        try (Response response = client.newCall(request).execute()) {
            if (!response.isSuccessful()) throw new IOException("Unexpected code " + response);
            String responseBody = response.body().string();
            JSONObject json = new JSONObject(responseBody);
            return json.getString("access_token");
        }
    }
}

3. 依赖配置（Maven示例） #

确保项目包含以下依赖：

<dependencies>
    <!-- JavaMail API -->
    <dependency>
        <groupId>com.sun.mail</groupId>
        <artifactId>javax.mail</artifactId>
        <version>1.6.2</version>
    </dependency>
    <!-- OkHttp HTTP请求工具 -->
    <dependency>
        <groupId>com.squareup.okhttp3</groupId>
        <artifactId>okhttp</artifactId>
        <version>4.9.3</version>
    </dependency>
    <!-- JSON解析工具 -->
    <dependency>
        <groupId>org.json</groupId>
        <artifactId>json</artifactId>
        <version>20230227</version>
    </dependency>
</dependencies>

4. Talend项目集成要点 #

• 将代码封装为Talend自定义Java组件
• 将clientId、clientSecret、refreshToken配置为Talend上下文变量，便于维护
• 确保Talend项目类路径包含上述依赖jar包

内容的提问来源于stack exchange，提问作者aouadi