**As** an administrator
**I want to** configure Begin of the insertionIMAP authentication with anEnd of the insertion OAuth client credentials Begin of the insertionflowEnd of the insertion
**so that** I can use the inbound email feature with IMAP servers that support the OAuth client credentials flow - for example Microsoft Exchange.

The inbound emails feature is not usable with a Microsoft Exchange email server without this!

**Acceptance criteria**

* Auth method can be chosen from

* Basic Auth (username & password)

* OAuth Begin of the insertionclient credentialsEnd of the insertion

* When OAuth Begin of the insertionclient credentialsEnd of the insertion is chosen it's possible to either

* Custom:

* enter Begin of the insertion_client\_id_, _client\_secret_, _token\_url_End of the insertion Begin of the deletion client\_id, client\_secret, token\_urlEnd of the deletion and Begin of the insertion_scope_End of the insertion Begin of the deletion scopeEnd of the deletion

* Use existing OpenID provider configuration

* choose from list of existing OpenID provider Begin of the insertion

* enter _scope_End of the insertion

* Begin of the insertion**Bonus**:End of the insertion Begin of the deletion Bonus:End of the deletion Pre-fill known values when specific email servers are chosen

* When choosing OAuth Begin of the insertionclient credentialsEnd of the insertion the following options are shown

* Microsoft Exchange

* Use existing OpenID provider configuration

* Custom

* When choosing Microsoft Exchange, pre-fill

* token\_path (NOT URL) `/oauth2/v2.0/token`

* We'd need to make it obvious that the admin needs to set the full URL, maybe it's better not to pre-fill this at all.

* scope [`https://outlook.office.com/IMAP.AccessAsUser.All`](https://outlook.office.com/IMAP.AccessAsUser.All)


**Technical notes**

* Use [client credential flow](https://www.oauth.com/oauth2-servers/access-tokens/client-credentials/)

* When an existing OpenID provider is chose, we'll request a token from the OAuth Client chosen provider and inject the scope required for IMAP access

* Question: How do we store the correct scope to inject for this flow? The OpenID provider is configured with some scopes, but we'll need different scopes to get the emails via IMAP. Those scopes are not (completely) standardised, so users will need to be able to set them.  


**Permissions and visibility considerations**

* Administrators


**Translation considerations**

* Don't translate

* _Basic auth_

* _OAuth_

* _Client ID_

* Client secret

* Token URL

* Scope


**Out of scope**

* OAuth with authorization code flow for OAuth, as used by Gmail