Nodemailer: Fail to use 2LO authentication for service account

[wdetac]

I follow the page here: http://nodemailer.com/smtp/oauth2/

Here is my code:

var transport = {
    port: 587,
    host: "smtp-relay.gmail.com",
    secure: false,
    requireTLS: true,
    auth: {
        type: "OAuth2",
        user: config.client_email,
        serviceClient: config.client_id,
        privateKey: config.private_key
    }
};

transporter = nodemailer.createTransport(transport);

transporter.on('token', token => {
    console.log('A new access token was generated');
    console.log('User: %s', token.user);
    console.log('Access Token: %s', token.accessToken);
    console.log('Expires: %s', new Date(token.expires));
});

Promise.try(() => {
        return transporter.verify();
    })
    .then(() => {
        console.log("smtp ready");
    })
    .catch((err) => {
        console.error(err);
    });

Error message:

{
    code: 'EAUTH',
    response: '535-5.7.8 Username and Password not accepted. Learn more at\n535 5.7.8  https://support.google.com/mail/?p=BadCredentials b72-v6sm1263216iti.0 - gsmtp',
    responseCode: 535,
    command: 'AUTH XOAUTH2'
}

Access token is created successfully since I have seen A new access token was generated... in the console.
I have already read many articles and grant all scope for Gmail as far as I know still I failed.
Note: I successfully send email with 3LO authentication and plain login but I want to use service accounts.
I am using G suite and the service account and enable domain-wide delegation in case it matters.

[ghost]

did you solved it ? I have ecaxtly the same issue at the same point ...exactly

[wdetac]

I solved it. However many things are still not very clear. I think owner of Nodemailer should update the doc too.

First:

auth: {
    type: "OAuth2",
    user: config.client_email, <-- should be a real user email, not the [email protected] one
    serviceClient: config.client_id, <-- try [email protected], but I think the id should also be ok
    privateKey: config.private_key
}

Second:

Turn on and off the scopes in google admin console. It is the most mystery part. I cannot reproduce a reliable way to make it success. I just keep trying and stop when I success. I think it is an issue from Google.

Hope it helps!

[ghost]

thanks ... I tried to follow this post information ...

https://gypsyshen.com/2018/03/01/secure-gmail-access-with-oauth2-and-2lo-in-express/comment-page-1/#comment-287

but It's failing at the same point, upon . transporter.sendMail() with 401 status code...

[ghost]

Succeeded... it's running fine .. BUT the from: email sender email address is ALWAYS overwritten with the email address used for authentication...

when I use these options 👍

const mailOptions = { from: 'SITE CONTACT<' + sender + '>', to: KEY.contact_email, subject: 'Message', text: 'From: ' + sender + '\n\n' + msg, html: '<h1>Message</h1><p>From: ' + sender + '</p><p>' + msg + '</p>' };

we get from: sender . being the authenticated user
and text: 'From: ' + sender being the sender email address...

Is there anyway to force , change , bypass this Google modification ?

[wdetac]

Try this:
Go to Google Admin Console -> Apps -> G Suite -> Settings for Gmail -> Advanced settings -> SMTP relay service
Change Allowed senders: Only addresses in my domains

[cloakedninjas]

@erwin16 How did you solve the 401? I'm getting this at the moment too

[AaronBaldwin]

+1, would like to know what the trouble was. What format of private key data does this expect? Is there something that needs doing in the google api console?