O365 certificate based OAuth

[CptKirk]

Hey everyone,

we have problems configuring the email-oauth2-proxy to work for our use case. We thought maybe the community could help and maybe explain what is wrong with our config.

We are trying to get the proxy to work with Microsoft Office 365 certificate based authentication. We want to use the client_credentials OAuth2 Flow for M2M authentication. When trying to send an E-Mail through the proxy we get the following error: Client not authenticated to send mail.

Our config file:

[dev@*********]
oauth2_flow = client_credentials
token_url   = https://login.microsoftonline.com/**************************/oauth2/v2.0/token
oauth2_scope = https://outlook.office365.com/.default
client_id   = **************************
jwt_certificate_path = /config/email-cert.crt
jwt_key_path = /config/email-cert-key.pem
smtp_server = SMTP-1993

[SMTP-1993]
server_address = smtp.office365.com
server_port = 587
server_starttls = True
local_address = 0.0.0.0

Debug log:

2026-01-29 10:26:18,282: Initialised Email OAuth 2.0 Proxy - listening for authentication requests. Connect your email client to begin
2026-01-29 10:27:07,848: New incoming connection to SMTP server at 0.0.0.0:1993 (unsecured) proxying smtp.office365.com:587 (STARTTLS)
2026-01-29 10:27:07,848: Accepting new connection from 172.20.0.1:33114 to SMTP server at 0.0.0.0:1993 (unsecured) proxying smtp.office365.com:587 (STARTTLS)
2026-01-29 10:27:07,856: SMTP (172.20.0.1:33114-{172.20.0.2:1993}-smtp.office365.com:587) --> [ Client connected ]
2026-01-29 10:27:07,861: SMTP (172.20.0.1:33114-{172.20.0.2:1993}-smtp.office365.com:587)     <-- b'220 FR2P281CA0117.outlook.office365.com Microsoft ESMTP MAIL Service ready at Thu, 29 Jan 2026 10:27:07 +0000 [08DE5EEE6171E68C]\r\n'
2026-01-29 10:27:07,861: SMTP (172.20.0.1:33114-{172.20.0.2:1993}-smtp.office365.com:587) <-- b'220 FR2P281CA0117.outlook.office365.com Microsoft ESMTP MAIL Service ready at Thu, 29 Jan 2026 10:27:07 +0000 [08DE5EEE6171E68C]\r\n'
2026-01-29 10:27:07,864: SMTP (172.20.0.1:33114-{172.20.0.2:1993}-smtp.office365.com:587) --> b'EHLO node1.devel.********\r\n'
2026-01-29 10:27:07,865: SMTP (172.20.0.1:33114-{172.20.0.2:1993}-smtp.office365.com:587)     --> b'EHLO node1.devel.********\r\n'
2026-01-29 10:27:07,870: SMTP (172.20.0.1:33114-{172.20.0.2:1993}-smtp.office365.com:587)     <-- b'250-FR2P281CA0117.outlook.office365.com Hello [********]\r\n'
2026-01-29 10:27:07,872: SMTP (172.20.0.1:33114-{172.20.0.2:1993}-smtp.office365.com:587)     <-- b'250-SIZE 157286400\r\n'
2026-01-29 10:27:07,872: SMTP (172.20.0.1:33114-{172.20.0.2:1993}-smtp.office365.com:587)     <-- b'250-PIPELINING\r\n'
2026-01-29 10:27:07,872: SMTP (172.20.0.1:33114-{172.20.0.2:1993}-smtp.office365.com:587)     <-- b'250-DSN\r\n'
2026-01-29 10:27:07,872: SMTP (172.20.0.1:33114-{172.20.0.2:1993}-smtp.office365.com:587)     <-- b'250-ENHANCEDSTATUSCODES\r\n'
2026-01-29 10:27:07,873: SMTP (172.20.0.1:33114-{172.20.0.2:1993}-smtp.office365.com:587)     <-- b'250-STARTTLS\r\n'
2026-01-29 10:27:07,873: SMTP (172.20.0.1:33114-{172.20.0.2:1993}-smtp.office365.com:587)     <-- b'250-8BITMIME\r\n'
2026-01-29 10:27:07,873: SMTP (172.20.0.1:33114-{172.20.0.2:1993}-smtp.office365.com:587)     <-- b'250-BINARYMIME\r\n'
2026-01-29 10:27:07,874: SMTP (172.20.0.1:33114-{172.20.0.2:1993}-smtp.office365.com:587)     <-- b'250-CHUNKING\r\n'
2026-01-29 10:27:07,874: SMTP (172.20.0.1:33114-{172.20.0.2:1993}-smtp.office365.com:587)     <-- b'250 SMTPUTF8\r\n'
2026-01-29 10:27:07,874: SMTP (172.20.0.1:33114-{172.20.0.2:1993}-smtp.office365.com:587)     --> b'STARTTLS\r\n'
2026-01-29 10:27:07,880: SMTP (172.20.0.1:33114-{172.20.0.2:1993}-smtp.office365.com:587)     <-- b'220 2.0.0 SMTP server ready\r\n'
2026-01-29 10:27:07,880: SMTP (172.20.0.1:33114-{172.20.0.2:1993}-smtp.office365.com:587) <-> [ Starting TLS handshake ]
2026-01-29 10:27:07,905: SMTP (172.20.0.1:33114-{172.20.0.2:1993}-smtp.office365.com:587) [ Successfully negotiated SMTP server STARTTLS connection - re-sending greeting ]
2026-01-29 10:27:07,905: SMTP (172.20.0.1:33114-{172.20.0.2:1993}-smtp.office365.com:587)     --> b'EHLO node1.devel.********\r\n'
2026-01-29 10:27:07,921: SMTP (172.20.0.1:33114-{172.20.0.2:1993}-smtp.office365.com:587) <-> [ TLSv1.3 handshake complete ]
2026-01-29 10:27:07,931: SMTP (172.20.0.1:33114-{172.20.0.2:1993}-smtp.office365.com:587)     <-- b'250-FR2P281CA0117.outlook.office365.com Hello [********]\r\n'
2026-01-29 10:27:07,931: SMTP (172.20.0.1:33114-{172.20.0.2:1993}-smtp.office365.com:587)     <-- b'250-SIZE 157286400\r\n'
2026-01-29 10:27:07,931: SMTP (172.20.0.1:33114-{172.20.0.2:1993}-smtp.office365.com:587)     <-- b'250-PIPELINING\r\n'
2026-01-29 10:27:07,932: SMTP (172.20.0.1:33114-{172.20.0.2:1993}-smtp.office365.com:587)     <-- b'250-DSN\r\n'
2026-01-29 10:27:07,932: SMTP (172.20.0.1:33114-{172.20.0.2:1993}-smtp.office365.com:587)     <-- b'250-ENHANCEDSTATUSCODES\r\n'
2026-01-29 10:27:07,932: SMTP (172.20.0.1:33114-{172.20.0.2:1993}-smtp.office365.com:587)     <-- b'250-AUTH LOGIN XOAUTH2\r\n'
2026-01-29 10:27:07,932: SMTP (172.20.0.1:33114-{172.20.0.2:1993}-smtp.office365.com:587)     <-- b'250-8BITMIME\r\n'
2026-01-29 10:27:07,933: SMTP (172.20.0.1:33114-{172.20.0.2:1993}-smtp.office365.com:587)     <-- b'250-BINARYMIME\r\n'
2026-01-29 10:27:07,933: SMTP (172.20.0.1:33114-{172.20.0.2:1993}-smtp.office365.com:587)     <-- b'250-CHUNKING\r\n'
2026-01-29 10:27:07,933: SMTP (172.20.0.1:33114-{172.20.0.2:1993}-smtp.office365.com:587)     <-- b'250 SMTPUTF8\r\n'
2026-01-29 10:27:07,934: SMTP (172.20.0.1:33114-{172.20.0.2:1993}-smtp.office365.com:587) <-- b'250-FR2P281CA0117.outlook.office365.com Hello [********]\r\n250-SIZE 157286400\r\n250-PIPELINING\r\n250-DSN\r\n250-ENHANCEDSTATUSCODES\r\n250-AUTH PLAIN LOGIN\r\n250-8BITMIME\r\n250-BINARYMIME\r\n250-CHUNKING\r\n250 SMTPUTF8\r\n'
2026-01-29 10:27:07,935: SMTP (172.20.0.1:33114-{172.20.0.2:1993}-smtp.office365.com:587) --> b'MAIL FROM:<dev@*********> SIZE=21769 BODY=8BITMIME\r\n'
2026-01-29 10:27:07,935: SMTP (172.20.0.1:33114-{172.20.0.2:1993}-smtp.office365.com:587)     --> b'MAIL FROM:<dev@*********> SIZE=21769 BODY=8BITMIME\r\n'
2026-01-29 10:27:07,936: SMTP (172.20.0.1:33114-{172.20.0.2:1993}-smtp.office365.com:587) --> b'RCPT TO:<test@********> ORCPT=rfc822;test@********\r\n'
2026-01-29 10:27:07,936: SMTP (172.20.0.1:33114-{172.20.0.2:1993}-smtp.office365.com:587)     --> b'RCPT TO:<test@********> ORCPT=rfc822;test@********\r\n'
2026-01-29 10:27:07,936: SMTP (172.20.0.1:33114-{172.20.0.2:1993}-smtp.office365.com:587) --> b'DATA\r\n'
2026-01-29 10:27:07,937: SMTP (172.20.0.1:33114-{172.20.0.2:1993}-smtp.office365.com:587)     --> b'DATA\r\n'
2026-01-29 10:27:12,929: SMTP (172.20.0.1:33114-{172.20.0.2:1993}-smtp.office365.com:587)     <-- b'530 5.7.57 Client not authenticated to send mail. [FR2P281CA0117.DEUP281.PROD.OUTLOOK.COM 2026-01-29T10:27:12.689Z 08DE5EEE6171E68C]\r\n'
2026-01-29 10:27:12,929: SMTP (172.20.0.1:33114-{172.20.0.2:1993}-smtp.office365.com:587) <-- b'530 5.7.57 Client not authenticated to send mail. [FR2P281CA0117.DEUP281.PROD.OUTLOOK.COM 2026-01-29T10:27:12.689Z 08DE5EEE6171E68C]\r\n'
2026-01-29 10:27:12,930: SMTP (172.20.0.1:33114-{172.20.0.2:1993}-smtp.office365.com:587) <-- [ Server disconnected ]
2026-01-29 10:27:12,930: SMTP (172.20.0.1:33114-{172.20.0.2:1993}-smtp.office365.com:587) --> [ Client disconnected ]

Thanks in advance for your help!

[simonrob]

Whether you're using the proxy or not, you still need to actually authenticate with the server. The proxy just replaces existing authentication commands; it doesn't add them if they aren't there.