Mailbox with Google Workspace using X0AUTH2 doesn't work

[andreas.panozzo]

Hello,
I've installed and successfully configured MantisBT 2.28.0\ PHP ver. 8.1.2-1ubuntu2.25.
It works very well.
I'm trying now to add EMailReporting plug-in. I've installed Email Reporting 0.12.0.

In the configuration tab I created a Mailbox with Google Workspace using Authentication method X0AUTH2.
For this I created a ServiceAccount and then I created a new Key and generated a file JSON that I copied in /var/www/html/mantisbt.
I also managed the Domain-wide delegation in my Workspace linking my domain with the Service Account via ClientID.
All seems well done but when I Test my Mailbox I have the error message
Message: Google service-account JSON file was not found: /var/www/html/mantisbt

Obviously the JSON is present in that folder.
Any idea on what is wrong?

Thanks
Andreas

[SL-Gundam]

It should not only be present but you should set the filename.

So something like: "/var/www/html/mantisbt/serviceaccount.json"

I'm very happy you're testing this.
I've mentioned i was not able to test Google XOAUTH2 code. So very curious about the results.

Once you saved the entry it should show text next to the field in question when you edit or test the mailbox.
It should show 2 of these four texts

• File found
• Warning: file not found
• File readable
• Warning: file not readable

[andreas.panozzo]

Hello,
the good news is that now I have the messages:
File found
File readable
But when I test I get the error:
Failed to request Google Workspace access token: Client error: POST https://oauth2.googleapis.com/token resulted in a 401 Unauthorized response: {\x0A error : unauthorized_client ,\x0A error_description : Client is unauthorized to retrieve access tokens using this method, or client not authorized for any of the scopes requested. \x0A} ERRORCODE: 401

I'm investigating...

Andreas

[andreas.panozzo]

Hello,
to fix the problem I've been addressed on my Google workspace Admin Console and then Security > Access and Data control > API controls > Manage Domain-Wide Delegation.
When I create a new one, it is required to specify a 0Auth Scope (as example they mention "https://googleapis.com").
I added "https://mail.google.com/" but seems this is not the right one.

Any suggestion on which is the right URL, required by EMailReporting, I should add?

Andreas

[SL-Gundam]

Checked the documentation from google

https://developers.google.com/workspace ... 2-protocol

It says for normal IMAP usage the scope is: https://mail.google.com/

But in this case we use domain wide. It says the scope is then: https://www.googleapis.com/auth/gmail.imap_admin
Which is the one that is requested by EmailReporting.

[SL-Gundam]

If problems persist you can also try changing this line https://github.com/mantisbt-plugins/Ema ... i.php#L369

Change the scope to: "https://mail.google.com/" instead of "https://www.googleapis.com/auth/gmail.imap_admin"

[andreas.panozzo]

Hello,
when I run a test and a Complete test of the MailBox all is good:

Operation successful

Enabled: Yes
Description: MANTIS EMAIL REPORTING
Mailbox type: POP3
Hostname: ssl://pop.gmail.com
TCP port (optional): 995
Connection encryption: SSL
Verify SSL certificate: Yes
Authentication method: XOAUTH2
OAuth provider: Google
Mailbox email address: JJJJ@XXX.YY
Serviceaccount credentials (JSON file): /ZZZZ/KKKK.json

but when I execute /usr/bin/php /var/www/html/mantisbt/plugins/EmailReporting/scripts/bug_report_mail.php

I have the error:
Mailbox:
Message: Failed to connect to the mail server. This could possibly be because SSL certificate verification failed

Someone has any idea?

Thanks
Andreas

[SL-Gundam]

Good to know you're making progress.

Just out of curiosity. What was the correct scope to use? "https://www.googleapis.com/auth/gmail.imap_admin"?

It is weird this does not mention the mailbox description "MANTIS EMAIL REPORTING".

...
Mailbox:
Message: Failed to connect to the mail server. This could possibly be because SSL certificate verification failed
...

Its good it all works from within MantisBT. If it does not work on the commandline its likely a different php.ini is used then the one the webserver uses.
You can check this by running phpinfo.

From within the browser: Create a file (eg. phpinfo.php)

Code: Select all

<?php
phpinfo();
?>

From the commandline:

Code: Select all

/usr/bin/php -i

Source: https://stackoverflow.com/questions/719 ... g-php-info

In the first batch of information from phpinfo you should see something like "Loaded Configuration File => /any/dir/php.ini".
If these are different there are 2 solutions.

1. Edit the php.ini for the commandline accordingly so that it matches the one from the webserver (or just copy the webserver php.ini over de commandline php.ini).

2. Force the commandline to use the webservers php.ini

Code: Select all

/usr/bin/php -c /any/dir/php.ini /var/www/html/mantisbt/plugins/EmailReporting/scripts/bug_report_mail.php

make sure to replace the "/any/dir/php.ini" with the php.ini path and filename from the webserver.

If you want to keep the php.ini from the commandline unchanged. Use option 2 or only modify the [openssl] section accordingly based on the webserver php.ini

[andreas.panozzo]

Hi,
In my Google Workspace I used 'https://www.googleapis.com/auth/gmail.imap_admin' as 0AuthScope and it works.

About the php log.. my mistake.. I reported it partially. Below the complete one.

Start checking all mailboxes: Thursday 17th of September 2026 07:27:01

array(13) {
["enabled"]=>
int(1)
["description"]=>
string(22) "MANTIS EMAIL REPORTING"
["mailbox_type"]=>
string(4) "POP3"
["hostname"]=>
string(13) "pop.gmail.com"
["port"]=>
string(3) "995"
["encryption"]=>
string(3) "SSL"
["ssl_cert_verify"]=>
int(1)
["auth_method"]=>
string(7) "XOAUTH2"
["oauth_provider"]=>
string(6) "Google"
["g_mailbox"]=>
string(26) "****@***.**"
["g_serviceAccountCredentials"]=>
string(49) "/***/mantis-serviceaccount.json"
["project_id"]=>
int(12)
["global_category_id"]=>
int(1)
}

array(12) {
["enabled"]=>
int(1)
["description"]=>
string(0) ""
["mailbox_type"]=>
string(4) "POP3"
["hostname"]=>
string(26) "****@***.**"
["port"]=>
string(3) "465"
["encryption"]=>
string(3) "SSL"
["ssl_cert_verify"]=>
int(1)
["auth_method"]=>
string(4) "USER"
["erp_username"]=>
string(26) "****@***.**"
["erp_password"]=>
string(24) "********************"
["project_id"]=>
int(11)
["global_category_id"]=>
int(1)
}

Mailbox:
Message: Failed to connect to the mail server. This could possibly be because SSL certificate verification failed

Done checking all mailboxes

BR,
Andreas

[SL-Gundam]

Based on this you have 2 mailboxes.
One of them has an empty description. That one produces the error: "Failed to connect to the mail server. This could possibly be because SSL certificate verification failed"
Based on the port (465) this mailbox is actually a SMTP connection which is not supported in this way.

The "MANTIS EMAIL REPORTING" mailbox does not produce an error. In theory it should work. But POP3 can only retrieve an email one time. If there are no emails since the last check it should result in what you see now.

I would really suggest using IMAP. Everywhere google mentions IMAP for this auth method. POP3 is never mentioned. It might work but it might also have issues.