OAuth Authentication for Mail Server

OAuth 2.0 is a standard authorization protocol that allows applications to securely access protected resources using access tokens instead of passwords.

OAuth 2.0 Terminology 

The following terms are used in OAuth 2.0 authentication:

• Resource Owner: The entity that owns the protected resource and can grant access to it. In Delegated Access, this is usually the user.

• Client: The application that requests access to a protected resource.

• Authorization Server: The server that authenticates the user or client and issues access tokens.

• Resource Server: The server that hosts the protected resource and allows access when a valid access token is provided.
   

ServiceDesk Plus supports the following OAuth 2.0 access models based on how it accesses the protected resource:

• Delegated access

• Application access

Delegated Access 

Delegated Access is an OAuth 2.0 access model in which the client accesses a protected resource on behalf of a user. ServiceDesk Plus uses the Authorization Code Grant Type for Delegated Access.
 

Authorization Code Grant Type: The client sends an authorization request to the authorization server using its authentication credentials. The user signs in and grants the required permissions.
 

The authorization server then provides an authorization code. The client exchanges this code for an access token and uses the token to access the protected resource on behalf of the user.

 

Application Access 

Application Access is an OAuth 2.0 access model in which the client accesses a protected resource as the application itself, without user involvement in the authorization process. ServiceDesk Plus uses the Client Credentials Grant Type for Application Access.
 

Client Credentials Grant Type: The client authenticates with the authorization server using its authentication credentials. After validating the client and its permissions, the authorization server issues an access token.
 

The client then uses the access token to access the protected resource.

 

 

Generating Client Details from the Authorization Server   

To configure mail server settings using OAuth authentication, you must configure ServiceDesk Plus with the authorization server of your mailbox. We have tested ServiceDesk Plus with the following authorization servers:

• Microsoft Azure for O365
• G Suite for Gmail
   

Configuring OAuth for Mail Server 

Upon generating the auth tokens, you can configure incoming and outgoing mail settings of your organization to connect using:

• POP/IMAP/POPS/IMAPS (For incoming mail servers)
• SMTP/SMTPS (For outgoing mail servers in service desk instance or ESM Directory)
• Exchange Web Services (For incoming mail servers and outgoing mail servers in service desk instance or ESM Directory)
• Microsoft Graph (For incoming mail servers and outgoing mail servers in service desk instance or ESM Directory)