Spring Integration接入Microsoft Outlook OAuth2认证改造咨询

问题描述 #

现有基于Spring Integration的Java应用，当前使用基本认证的IMAP邮件流入站适配器代码如下：

String emailStoreUri = emailProtocol + "://" + emailUsername + ":" + emailPassword + "@" + emailHost + ":" + emailPort + "/" + emailFolderInbox;

return IntegrationFlows.from(Mail.imapInboundAdapter(emailStoreUri)
        .shouldMarkMessagesAsRead(emailShouldMarkMessagesAsRead)
        .simpleContent(true).maxFetchSize(msgPerPoll)
        .searchTermStrategy(new AcceptAllEmailStrategy())
        .javaMailProperties(p -> {
            p.put("mail.store.protocol", emailProtocol);
            p.put("mail.debug", emailDebug);
            p.put("mail.imaps.timeout", "5000"); 
            p.put("mail.imaps.connectionpoolsize", "1");
            p.put("mail.imaps.connectiontimeout", "5000");
            p.put("mail.imaps.connectionpool.debug","true");
             p.put("mail.debug", "true");
        }).simpleContent(true),
        e -> e.autoStartup(emailAutoStart).poller(pollerMetadata))
        .channel(MessageChannels.rendezvous("inboundEmailChannel")).log("DEBUG").get();

需要修改代码以适配Microsoft Outlook的OAuth2认证。

解决方案 #

1. 准备依赖与OAuth2凭证 #

• 确保项目引入jakarta.mail（或javax.mail）最新版本，以及spring-security-oauth2-client依赖。
• 提前从Azure AD获取Outlook OAuth2凭证：Client ID、Client Secret、Refresh Token，确认Token Endpoint为https://login.microsoftonline.com/common/oauth2/v2.0/token。
• 给Azure AD应用配置IMAP.AccessAsUser.All委托权限，并完成授权流程。

2. 配置JavaMail OAuth2属性 #

Outlook IMAP使用imaps协议，需添加以下关键JavaMail属性以启用XOAUTH2认证：

Properties javaMailProps = new Properties();
javaMailProps.put("mail.store.protocol", "imaps");
javaMailProps.put("mail.debug", emailDebug);
javaMailProps.put("mail.imaps.timeout", "5000");
javaMailProps.put("mail.imaps.connectionpoolsize", "1");
javaMailProps.put("mail.imaps.connectiontimeout", "5000");
javaMailProps.put("mail.imaps.connectionpool.debug", "true");
// 启用XOAUTH2并禁用其他认证方式
javaMailProps.put("mail.imaps.auth.mechanisms", "XOAUTH2");
javaMailProps.put("mail.imaps.auth.plain.disable", "true");
javaMailProps.put("mail.imaps.auth.login.disable", "true");

3. 重构Spring Integration适配器配置 #

不再使用含密码的URI，直接通过ImapMailReceiver配置并注入OAuth2认证逻辑：

// 初始化ImapMailReceiver，仅传入服务器地址与邮箱文件夹
ImapMailReceiver mailReceiver = new ImapMailReceiver("imaps://outlook.office365.com:993/" + emailFolderInbox);
mailReceiver.setJavaMailProperties(javaMailProps);
mailReceiver.setShouldMarkMessagesAsRead(emailShouldMarkMessagesAsRead);
mailReceiver.setSimpleContent(true);
mailReceiver.setMaxFetchSize(msgPerPoll);
mailReceiver.setSearchTermStrategy(new AcceptAllEmailStrategy());

// 注入OAuth2令牌管理逻辑
@Autowired
private OAuth2AuthorizedClientManager authorizedClientManager;

// 设置自定义Authenticator，每次获取有效Access Token
mailReceiver.setAuthenticator(new Authenticator() {
    @Override
    protected PasswordAuthentication getPasswordAuthentication() {
        OAuth2AuthorizeRequest authorizeRequest = OAuth2AuthorizeRequest
                .withClientRegistrationId("your-azure-ad-client-reg-id")
                .principal(emailUsername)
                .build();
        OAuth2AuthorizedClient authorizedClient = authorizedClientManager.authorize(authorizeRequest);
        // XOAUTH2认证规则：用户名是邮箱，密码为Access Token
        return new PasswordAuthentication(emailUsername, authorizedClient.getAccessToken().getTokenValue());
    }
});

// 构建最终的Integration Flow
return IntegrationFlows.from(mailReceiver,
        e -> e.autoStartup(emailAutoStart).poller(pollerMetadata))
        .channel(MessageChannels.rendezvous("inboundEmailChannel"))
        .log("DEBUG")
        .get();

4. 令牌自动刷新说明 #

OAuth2AuthorizedClientManager会自动处理Access Token的过期刷新逻辑，无需手动维护令牌生命周期，确保每次邮件轮询时使用的都是有效令牌。

内容的提问来源于stack exchange，提问作者typed89