From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) by lore.proxmox.com (Postfix) with ESMTPS id 25F3E1FF141 for ; Fri, 13 Feb 2026 17:03:50 +0100 (CET) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 474C9947C; Fri, 13 Feb 2026 17:04:30 +0100 (CET) From: Arthur Bied-Charreton To: pve-devel@lists.proxmox.com Subject: [PATCH cluster/docs/manager/proxmox{,-perl-rs,-widget-toolkit} 00/17] fix #7238: Add XOAUTH2 authentication support for SMTP notification targets Date: Fri, 13 Feb 2026 17:03:58 +0100 Message-ID: <20260213160415.609868-1-a.bied-charreton@proxmox.com> X-Mailer: git-send-email 2.47.3 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 0 AWL -0.094 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment KAM_LAZY_DOMAIN_SECURITY 1 Sending domain does not have any anti-forgery methods RCVD_IN_VALIDITY_CERTIFIED_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. RCVD_IN_VALIDITY_RPBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. RCVD_IN_VALIDITY_SAFE_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. RDNS_NONE 0.793 Delivered to internal network by a host with no rDNS SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_NONE 0.001 SPF: sender does not publish an SPF Record Message-ID-Hash: 6RS5IM3D6A3F6PSYWZVGEB3TREQJDFBI X-Message-ID-Hash: 6RS5IM3D6A3F6PSYWZVGEB3TREQJDFBI X-MailFrom: abied-charreton@jett.proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: This series adds XOAUTH2 support for SMTP notification targets, motivated by Microsoft's upcoming deprecation of basic authentication for SMTP [0]. Google and Microsoft are supported as OAuth2 providers. OAuth2 refresh tokens may need to be rotated, therefore they are treated as state, not config. They are persisted in separate JSON files and managed entirely from the Rust side. Each endpoint has its own state file to avoid having to lock the entire file system everytime a state update is made. The oauth2 crate is used with a local ureq backend (newtype over ureq::Agent). oauth2's ureq feature is currently patched out in Debian due to a ureq 2/3 version mismatch (oauth2 still depends on ureq 2.x, and Debian only packages 3.x). Since tokens that are not used for extended periods of time may expire, token refresh is triggered proactively via pveupdate, additionally to every time a notification is sent, to prevent unused endpoints' tokens from expiring. The UI part of the OAuth2 flow is made opt-in in order to allow adding it only to PVE, and later to PBS in a follow-up series. This series requires the following version requirement bumps: * pve-manager requires bumped proxmox-widget-toolkit and proxmox-perl-rs * proxmox-perl-rs requires bumped proxmox-notify Known issues: - Microsoft OAuth2 support is untested (no test tenant, somehow impossible to create a free test account). It is implemented by following the Microsoft Entra ID docs, but there might be something I overlooked. I would highly appreciate it if someone was able to test it with their account. Changes since RFC: proxmox-notify: * Simplify state handling logic simplified by special-casing SMTP endpoints instead of making it generic * Only pull oauth2 and ureq crates with the smtp feature * Create state files in `/etc/pve/priv/notifications` subdirectory * Create one state file per endpoint (as opposed to one for all) to avoid races * Fix TOCTOU errors by using `proxmox_sys::fs::file_get_optional_contents` for IO * Add logging and state-related error types * Factor out SMTP transport building to its own function pve-manager,proxmox-perl-rs: * Pass SMTP endpoints configs as hash instead of flat list of parameters pve-manager: * Use `let` instead of `const` for JS variables * Rename endpoint for triggering endpoint state refresh from `refresh-targets` to `trigger-state-refresh` pve-docs: * Add some more provider-related tips/warnings * Explain what is meant by "manual intervention" * Show how to add an XOAUTH2 SMTP endpoint via `pvesh` [0] https://techcommunity.microsoft.com/blog/exchange/updated-exchange-online-smtp-auth-basic-authentication-deprecation-timeline/4489835 [1] https://git.proxmox.com/?p=debcargo-conf.git;a=blob;f=src/oauth2/debian/patches/disable-ureq.patch;h=828b883a83a86927c5cd32df055226a5e78e8bea;hb=refs/heads/proxmox/trixie proxmox: Arthur Bied-Charreton (7): notify (smtp): Introduce xoauth2 module notify (smtp): Introduce state module notify (smtp): Factor out transport building logic into own function notify (smtp): Update API with OAuth2 parameters notify (smtp): Add state handling logic notify (smtp): Add XOAUTH2 authentication support notify (smtp): Add logging and state-related error types proxmox-notify/Cargo.toml | 6 +- proxmox-notify/debian/control | 14 +- proxmox-notify/src/api/common.rs | 16 ++ proxmox-notify/src/api/smtp.rs | 120 ++++++++-- proxmox-notify/src/context/mod.rs | 6 + proxmox-notify/src/context/pbs.rs | 8 + proxmox-notify/src/context/pve.rs | 8 + proxmox-notify/src/context/test.rs | 8 + proxmox-notify/src/endpoints/smtp.rs | 237 +++++++++++++++++-- proxmox-notify/src/endpoints/smtp/state.rs | 76 ++++++ proxmox-notify/src/endpoints/smtp/xoauth2.rs | 167 +++++++++++++ proxmox-notify/src/lib.rs | 35 ++- 12 files changed, 649 insertions(+), 52 deletions(-) create mode 100644 proxmox-notify/src/endpoints/smtp/state.rs create mode 100644 proxmox-notify/src/endpoints/smtp/xoauth2.rs proxmox-perl-rs: Arthur Bied-Charreton (1): notify (smtp): add oauth2 parameters to bindings common/src/bindings/notify.rs | 82 ++++++++++++----------------------- 1 file changed, 28 insertions(+), 54 deletions(-) proxmox-widget-toolkit: Arthur Bied-Charreton (2): utils: Add OAuth2 flow handlers notifications: Add opt-in OAuth2 support for SMTP targets src/Utils.js | 88 +++++++++++++++ src/panel/SmtpEditPanel.js | 200 +++++++++++++++++++++++++++++++-- src/window/EndpointEditBase.js | 1 + 3 files changed, 278 insertions(+), 11 deletions(-) pve-manager: Arthur Bied-Charreton (5): notifications: Add OAuth2 parameters to schema and add/update endpoints notifications: Add trigger-state-refresh endpoint notifications: Trigger notification target refresh in pveupdate notifications: Handle OAuth2 callback in login handler notifications: Opt into OAuth2 authentication PVE/API2/Cluster/Notifications.pm | 144 +++++++++++++++++++++++++----- bin/pveupdate | 9 ++ www/manager6/Utils.js | 10 +++ www/manager6/Workspace.js | 20 +++++ 4 files changed, 160 insertions(+), 23 deletions(-) pve-cluster: Arthur Bied-Charreton (1): notifications: Add refresh_targets subroutine to PVE::Notify src/PVE/Notify.pm | 6 ++++++ 1 file changed, 6 insertions(+) pve-docs: Arthur Bied-Charreton (1): notifications: Add section about OAuth2 to SMTP targets docs notifications.adoc | 99 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 99 insertions(+) Summary over all repositories: 22 files changed, 1220 insertions(+), 140 deletions(-) -- Generated by murpp 0.9.0