Java客户端Office365 SMTP+OAuth2遇STARTTLS支持错误排查

我们在Java客户端尝试为Office365邮箱配置SMTP+OAuth2功能，指定使用TLS 1.2版本。

已完成的配置步骤 #

1. OAuth2令牌获取 #

已通过以下代码成功获取令牌：

URL url = new URL("https://login.microsoftonline.com/" + tenantID + "/oauth2/v2.0/token");

HashMap<String, String> hm = new HashMap<String, String>();
hm.put("client_id", appID);
hm.put("scope", "https://outlook.office365.com/.default");
hm.put("grant_type", "client_credentials");
hm.put("client_secret", secret);

2. Jakarta Mail会话配置 #

采用以下代码配置邮件会话：

Properties prop = new Properties(System.getProperties());
prop.put("mail.debug", "true");
prop.put("mail.smtp.port", "587");
prop.put("mail.smtp.host", "smtp.office365.com");
prop.put("mail.smtp.auth.mechanisms", "XOAUTH2");
prop.put("mail.smtp.starttls.enable", "true");
prop.put("mail.smtp.starttls.required", "true");
prop.put("mail.smtp.auth", "true");
session = jakarta.mail.Session.getInstance(prop, null);

3. 连接代码 #

执行以下连接代码时失败：

tr = session.getTransport("smtp");
tr.connect(host, username, password);

错误日志 #

连接时抛出如下异常及日志：

DEBUG: Jakarta Mail version 2.0.1
DEBUG: successfully loaded resource: /META-INF/javamail.default.providers
DEBUG: Tables of loaded providers
DEBUG: Providers Listed By Class Name: {com.sun.mail.smtp.SMTPTransport=jakarta.mail.Provider[TRANSPORT,smtp,com.sun.mail.smtp.SMTPTransport,Oracle], com.sun.mail.imap.IMAPSSLStore=jakarta.mail.Provider[STORE,imaps,com.sun.mail.imap.IMAPSSLStore,Oracle], com.sun.mail.pop3.POP3Store=jakarta.mail.Provider[STORE,pop3,com.sun.mail.pop3.POP3Store,Oracle], com.sun.mail.smtp.SMTPSSLTransport=jakarta.mail.Provider[TRANSPORT,smtps,com.sun.mail.smtp.SMTPSSLTransport,Oracle], com.sun.mail.imap.IMAPStore=jakarta.mail.Provider[STORE,imap,com.sun.mail.imap.IMAPStore,Oracle], com.sun.mail.pop3.POP3SSLStore=jakarta.mail.Provider[STORE,pop3s,com.sun.mail.pop3.POP3SSLStore,Oracle]}
DEBUG: Providers Listed By Protocol: {imap=jakarta.mail.Provider[STORE,imap,com.sun.mail.imap.IMAPStore,Oracle], smtp=jakarta.mail.Provider[TRANSPORT,smtp,com.sun.mail.smtp.SMTPTransport,Oracle], pop3=jakarta.mail.Provider[STORE,pop3,com.sun.mail.pop3.POP3Store,Oracle], imaps=jakarta.mail.Provider[STORE,imaps,com.sun.mail.imap.IMAPSSLStore,Oracle], smtps=jakarta.mail.Provider[TRANSPORT,smtps,com.sun.mail.smtp.SMTPSSLTransport,Oracle], pop3s=jakarta.mail.Provider[STORE,pop3s,com.sun.mail.pop3.POP3SSLStore,Oracle]}
DEBUG: successfully loaded resource: /META-INF/javamail.default.address.map
DEBUG: getProvider() returning jakarta.mail.Provider[TRANSPORT,smtp,com.sun.mail.smtp.SMTPTransport,Oracle]
DEBUG SMTP: useEhlo true, useAuth true
DEBUG SMTP: trying to connect to host "smtp.office365.com", port 587, isSSL false
220 SMTP Welcome
DEBUG SMTP: connected to host "smtp.office365.com", port: 587
EHLO xxx.xxx.xxx
250-SIZE 10240000
250-DSN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 OK
DEBUG SMTP: Found extension "DSN", arg ""
DEBUG SMTP: Found extension "ENHANCEDSTATUSCODES", arg ""
DEBUG SMTP: Found extension "8BITMIME", arg ""
DEBUG SMTP: Found extension "OK", arg ""
DEBUG SMTP: STARTTLS required but not supported
jakarta.mail.MessagingException: STARTTLS is required but host does not support STARTTLS
    at com.sun.mail.smtp.SMTPTransport.protocolConnect(SMTPTransport.java:744)
    at jakarta.mail.Service.connect(Service.java:342)
    at jakarta.mail.Service.connect(Service.java:222)
...

排查与解决方案 #

• 已确认Azure门户中应用已授予SMTP.SendAsApp权限
• 已确认admin.microsoft.com门户已开启现代认证选项
• 最终排查发现问题源于防火墙限制，解除限制后连接成功。

内容的提问来源于stack exchange，提问作者ExecutionSommaire