# Feature ITSM-29 - Enable OAuth Authorization Code flow for IMAP authorisation

Project: Stream IT service management (ITSM)
Status: rejected
URL: https://community.openproject.org/work_packages/ITSM-29

## Planning

| Attribute | Value |
| --- | --- |
| Date |  |
| Priority | Medium |
| Target versions | Product Backlog |
| Votes |  |
| List |  |
| Roadmap |  |
| Relevance |  |

## OPEN POINTS / FEEDBACK

_No work packages_

## Features and Chunks

_No work packages_

## Bugs and other work packages

_No work packages_

## Technical Details

| Attribute | Value |
| --- | --- |
| Module | Authentication / OAuth, Administration / Incoming emails |
| Feature Flag |  |
| Requires doc change | Yes |
| Enterprise plan |  |

## Details

| Attribute | Value |
| --- | --- |
| Pull preview |  |
| Mockups |  |
| Build Number |  |
| Found in mobile app version |  |
| Follow-up feedback e-mail |  |
| Accessibility | No |

## People

| Attribute | Value |
| --- | --- |
| Assignee |  |
| Accountable |  |
| Product manager |  |
| Developers |  |
| Designer |  |
| Ordered by |  |
| Signed off by |  |
| Interest by |  |

## Estimates and progress

| Attribute | Value |
| --- | --- |
| PD (min) |  |
| PD (max) |  |
| Work |  |
| Labor costs |  |

## Description

**As** an administrator  
**I want to** configure IMAP authentication with an OAuth authorization code flow  
**so that** I can use the inbound email feature with IMAP servers that support the OAuth authorization code flow - for example Gmail.

The inbound emails feature is not usable with a Gmail email server without this!

**Acceptance criteria**

*   Additional auth method  that can be chosen
    
    *   OAuth authorization code
        
*   When OAuth authorization code is chosen
    
    *   Enter _auth\_server\_URL, client\_id_, _client\_secret, scope_
        
    *   Click _Authorise button_
        
    *   Send user to auth server
        
        *   Auth server shows auth prompt (user needs to login/approve as user with access to the email inbox)
            
        *   Auth server redirects to _redirect\_URL_ with _authorization\_code_
            
    *   Use _authorization\_code_ to get _access\_token_ and _refresh\_token_
        
    *   Store _access\_token_ and _refresh\_token_
        
*   **Bonus**: Pre-fill known values when specific email servers are chosen
    
    *   When choosing OAuth authorization code the following options are shown
        
        *   Gmail
            
        *   Custom
            
    *   When choosing Gmail, pre-fill
        
        *   auth\_server\_URL `value unknown`
            
        *   scope [`value unknown`](https://outlook.office.com/IMAP.AccessAsUser.All)
            

**Technical notes**

*   _redirect\_URL_ is built by us
    
*   Use [authorization code flow](https://oauth.net/2/grant-types/authorization-code/)
    

**Permissions and visibility considerations**

*   Administrators
    

**Translation considerations**

*   Don't translate
    
    *   authorization code
        
    *   _auth\_server\_URL_
        

**Out of scope**

*   OAuth with client credentials flow for OAuth, as used by Microsoft Exchange