Spring Integration IMAP连接Office365认证失败问题求助

我们计划使用Spring Integration Mail Support通过IMAP协议连接Office365，但未达到预期效果，出现认证失败错误：

2022-12-19 08:45:12.257 ERROR --- [   scheduling-1] o.s.i.h.LoggingHandler                   : org.springframework.messaging.MessagingException: failure occurred while polling for mail; nested exception is javax.mail.AuthenticationFailedException: AUTHENTICATE failed.
    at org.springframework.integration.mail.MailReceivingMessageSource.doReceive(MailReceivingMessageSource.java:74)
    at org.springframework.integration.endpoint.AbstractMessageSource.receive(AbstractMessageSource.java:142)
    at org.springframework.integration.endpoint.SourcePollingChannelAdapter.receiveMessage(SourcePollingChannelAdapter.java:212)
    at org.springframework.integration.endpoint.AbstractPollingEndpoint.doPoll(AbstractPollingEndpoint.java:444)
    at org.springframework.integration.endpoint.AbstractPollingEndpoint.pollForMessage(AbstractPollingEndpoint.java:413)
    at org.springframework.integration.endpoint.AbstractPollingEndpoint.lambda$createPoller$4(AbstractPollingEndpoint.java:348)
    at org.springframework.integration.util.ErrorHandlingTaskExecutor.lambda$execute$0(ErrorHandlingTaskExecutor.java:57)
    at org.springframework.core.task.SyncTaskExecutor.execute(SyncTaskExecutor.java:50)
    at org.springframework.integration.util.ErrorHandlingTaskExecutor.execute(ErrorHandlingTaskExecutor.java:55)
    at org.springframework.integration.endpoint.AbstractPollingEndpoint.lambda$createPoller$5(AbstractPollingEndpoint.java:341)
    at org.springframework.scheduling.support.DelegatingErrorHandlingRunnable.run(DelegatingErrorHandlingRunnable.java:54)
    at org.springframework.scheduling.concurrent.ReschedulingRunnable.run(ReschedulingRunnable.java:95)
    at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:539)
    at java.base/java.util.concurrent.FutureTask.run$$$capture(FutureTask.java:264)
    at java.base/java.util.concurrent.FutureTask.run(FutureTask.java)
    at java.base/java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:304)
    at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
    at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
    at java.base/java.lang.Thread.run(Thread.java:833)
Caused by: javax.mail.AuthenticationFailedException: AUTHENTICATE failed.
    at com.sun.mail.imap.IMAPStore.protocolConnect(IMAPStore.java:708)

注：使用Gmail的应用密码可正常运行，但Office365无法正常工作。以下是示例Bean：

@Bean
public IntegrationFlow iMapIntegrationFlow(
        // Remove for brevity
) {
    log.info("[Email Integration] Creating Spring Integration Flow Bean");
    var pollerSpec = Pollers
            .fixedRate(5000)
            .maxMessagesPerPoll(1);
    return IntegrationFlows
            .from(Mail.imapInboundAdapter("imap://username%40domain:PASSWORD@outlook.office365.com:993/INBOX")
                            .javaMailProperties(myJavaMailProperties)
                            .simpleContent(true)
                            .maxFetchSize(1),
                    e -> e.poller(pollerSpec))
            .transform(myTransformer)
            .handle(myHandler)
            .get();
}

Java Mail属性如下：

mail.imap.port=993
mail.imaps.ssl.enable=true
mail.debug=true

问题解答 #

1. 配置是否存在遗漏或错误？

• 协议头错误：当前使用imap://，但Office365 IMAP推荐使用imaps://（SSL加密协议），即使配置了mail.imaps.ssl.enable=true，协议头不匹配也可能导致认证流程异常，应调整为imaps://username%40domain:PASSWORD@outlook.office365.com:993/INBOX
• JavaMail属性不匹配：mail.imap.port=993应改为mail.imaps.port=993，对应IMAPS协议的端口配置
• 密码有效性：如果Office365账号开启了MFA，普通密码无法用于基础认证，需使用应用密码（但前提是基础认证未被租户禁用）

2. 微软对基础认证的停用是否导致该问题？

是的，微软已在Exchange Online中全面停用IMAP等协议的基础认证，这是本次认证失败的核心原因。Gmail的应用密码属于其生态内的替代认证方案，但Office365停用基础认证后，不再支持任何用户名+密码（包括应用密码）的基础认证方式，必须切换到OAuth2认证。

3. Spring Integration Mail是否有支持OAuth2的官方文档方案？

Spring Integration Mail支持OAuth2认证，官方推荐实现方式如下：

• 配置JavaMail属性添加mail.imap.auth.mechanisms=XOAUTH2，指定使用OAuth2认证机制
• 通过Spring Security OAuth2客户端组件获取并自动刷新Office365的OAuth2访问令牌
• 自定义MailReceiver或使用DefaultOAuth2ProtocolProvider，将令牌注入到JavaMail的IMAPStore完成认证
• 可参考Spring Integration官方文档中Mail模块与OAuth2集成的章节，实现完整的OAuth2认证流程

内容的提问来源于stack exchange，提问作者junbetterway