Re: [PATCH cluster/docs/manager/proxmox{,-perl-rs,-widget-toolkit} 00/17] fix #7238: Add XOAUTH2 authentication support for SMTP notification targets

["Lukas Wagner" <l.wagner@proxmox.com>]

On Fri Feb 13, 2026 at 5:03 PM CET, Arthur Bied-Charreton wrote:
> This series adds XOAUTH2 support for SMTP notification targets, motivated by Microsoft's
> upcoming deprecation of basic authentication for SMTP [0]. Google and Microsoft are supported as
> OAuth2 providers.
>
> OAuth2 refresh tokens may need to be rotated, therefore they are treated as state, not config.
> They are persisted in separate JSON files and managed entirely from the Rust side. Each endpoint
> has its own state file to avoid having to lock the entire file system everytime a state update
> is made.
>
> The oauth2 crate is used with a local ureq backend (newtype over ureq::Agent). oauth2's ureq
> feature is currently patched out in Debian due to a ureq 2/3 version mismatch (oauth2 still
> depends on ureq 2.x, and Debian only packages 3.x).
>
> Since tokens that are not used for extended periods of time may expire, token refresh is triggered
> proactively via pveupdate, additionally to every time a notification is sent, to prevent
> unused endpoints' tokens from expiring.
>
> The UI part of the OAuth2 flow is made opt-in in order to allow adding it only to PVE, and later
> to PBS in a follow-up series.
>
> This series requires the following version requirement bumps:
> * pve-manager requires bumped proxmox-widget-toolkit and proxmox-perl-rs
> * proxmox-perl-rs requires bumped proxmox-notify
>
> Known issues:
> - Microsoft OAuth2 support is untested (no test tenant, somehow impossible to create a free test
>   account). It is implemented by following the Microsoft Entra ID docs, but there might be something
>   I overlooked. I would highly appreciate it if someone was able to test it with their account.
>

Tested this with Gmail, seems to work fine!

Tested-by: Lukas Wagner <l.wagner@proxmox.com>

Very nice work overall!

I also verified that the feature-flag opt-in approach for the GUI works.
I installed the widget-toolkit .deb on a PBS installation, existing SMTP
with plain auth continued to work fine there.

See the individual patches for some suggestions for the next version,
but this is already in quite good shape, I think!