使用OAuth 2与Jakarta Mail访问共享邮箱时认证失败问题

使用Jakarta Mail 2.0.1版本，通过OAuth2授权码流获取了有效access token，尝试访问用户AdeleV@tm6gs.onmicrosoft.com有权限的共享邮箱noreply@tm6gs.onmicrosoft.com（别名noreply_alias），采用<主邮箱>\<共享邮箱别名>的用户名格式，调用store.connect时抛出AUTHENTICATE failed异常。

测试代码 #

void testSharedMailBox() throws MessagingException {
        Properties props = new Properties();
        props.put("mail.imaps.starttls.enable", "true");
        props.put("mail.imaps.ssl.enable", "true");
        props.put("mail.imaps.auth", "true");
        props.put("mail.imaps.auth.mechanisms", "XOAUTH2");
        props.put("mail.imaps.auth.login.disable", "true");
        props.put("mail.imaps.auth.plain.disable", "true");
        props.put("mail.imaps.auth.ntlm.disable", "true");
        props.put("mail.imaps.auth.gssapi.disable", "true");

        props.put("mail.imaps.host", "outlook.office365.com");
        props.put("mail.imaps.port", 993);
        props.put("mail.debug.auth", "true");
        Session session = Session.getInstance(props);
        session.setDebug(true);
        Store _store = session.getStore("imaps");


        _store.connect("outlook.office365.com", 993, "AdeleV@tm6gs.onmicrosoft.com\\noreply_alias",
                "valid_access_code_here");

        // also tried below but didn't work
        // _store.connect("outlook.office365.com", 993, "AdeleV@tm6gs.onmicrosoft.com\\noreply@tm6gs.onmicrosoft.com",
                "valid_access_code_here");

        Folder inbox = _store.getFolder("INBOX");
        // inbox.open(Folder.READ_ONLY);
        int messageCount = inbox.getMessageCount();
        System.out.println(messageCount);


        _store.close();
    }

异常信息 #

AUTHENTICATE failed.
jakarta.mail.AuthenticationFailedException: AUTHENTICATE failed.
    at app//com.sun.mail.imap.IMAPStore.protocolConnect(IMAPStore.java:708)
    at app//jakarta.mail.Service.connect(Service.java:342)
    at app//AccountTest.testSharedMailBox(AccountTest.java:48)
    at java.base@11.0.11/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at java.base@11.0.11/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    at java.base@11.0.11/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.base@11.0.11/java.lang.reflect.Method.invoke(Method.java:566)
    at app//org.junit.platform.commons.util.ReflectionUtils.invokeMethod(ReflectionUtils.java:725)
    ... <truncated more stack trace>

调试日志 #

DEBUG: setDebug: Jakarta Mail version 2.0.1
DEBUG: getProvider() returning jakarta.mail.Provider[STORE,imaps,com.sun.mail.imap.IMAPSSLStore,Oracle]
DEBUG IMAPS: mail.imap.fetchsize: 16384
DEBUG IMAPS: mail.imap.ignorebodystructuresize: false
DEBUG IMAPS: mail.imap.statuscachetimeout: 1000
DEBUG IMAPS: mail.imap.appendbuffersize: -1
DEBUG IMAPS: mail.imap.minidletime: 10
DEBUG IMAPS: enable STARTTLS
DEBUG IMAPS: closeFoldersOnStoreFailure
DEBUG IMAPS: trying to connect to host "outlook.office365.com", port 993, isSSL true
* OK The Microsoft Exchange IMAP4 service is ready. [some_lomg_string_removed_for_privacy]
A0 CAPABILITY
* CAPABILITY IMAP4 IMAP4rev1 AUTH=PLAIN AUTH=XOAUTH2 SASL-IR UIDPLUS ID UNSELECT CHILDREN IDLE NAMESPACE LITERAL+
A0 OK CAPABILITY completed.
DEBUG IMAPS: AUTH: PLAIN
DEBUG IMAPS: AUTH: XOAUTH2
DEBUG IMAPS: protocolConnect login, host=outlook.office365.com, user=AdeleV@tm6gs.onmicrosoft.com\noreply_alias, password=<non-null>
A1 AUTHENTICATE XOAUTH2 some_lomg_string_removed_for_privacy
A1 NO AUTHENTICATE failed.

问题原因及解决方法 #

1. OAuth2令牌权限不足 #

确保获取access token时，请求的scope包含共享邮箱的访问权限：

• 必须包含https://outlook.office365.com/IMAP.AccessAsUser.All
• 如果需要读写权限，补充https://outlook.office365.com/Mail.ReadWrite
• 注意：不要仅请求主邮箱的窄范围权限，需覆盖共享邮箱的访问需求

2. 用户名格式错误（OAuth2下不适用传统格式） #

Office365的XOAUTH2认证中，访问共享邮箱不需要使用<主邮箱>\<共享邮箱>的格式，正确流程是：

• 登录时直接使用主邮箱地址（即AdeleV@tm6gs.onmicrosoft.com）
• 认证成功后，通过指定共享邮箱的完整地址来打开对应文件夹

修改后的核心代码：

// 用主邮箱直接登录
_store.connect("outlook.office365.com", 993, "AdeleV@tm6gs.onmicrosoft.com", "valid_access_token_here");

// 打开共享邮箱的收件箱，格式为"共享邮箱地址/INBOX"
Folder sharedInbox = _store.getFolder("noreply@tm6gs.onmicrosoft.com/INBOX");
sharedInbox.open(Folder.READ_ONLY);
int messageCount = sharedInbox.getMessageCount();
System.out.println(messageCount);

3. 确认共享邮箱权限配置 #

• 检查Exchange Admin Center，确保用户AdeleV@tm6gs.onmicrosoft.com被授予共享邮箱的完全访问权限或读取权限
• 确认权限已正确应用，避免因权限未同步导致的访问失败

4. 升级Jakarta Mail版本 #

当前使用的2.0.1版本支持XOAUTH2，但建议升级到最新稳定版（如2.1.0+），修复潜在的OAuth2认证兼容性问题

内容的提问来源于stack exchange，提问作者Amogh