Microsoft Modern authentication

Microsoft's Modern authentication is an identity management approach that provides enhanced security for user authentication and authorization. Modern authentication refers to a set of methods for managing both authentication and authorization between a client and a server. It also incorporates security measures based on access policies you may already be familiar with. As Microsoft has already phased out basic authentication in many products, referring to it as an obsolete industry standard due to associated risks, you may need to use the modern authentication method instead to authenticate in OpenIAM.

This article includes the steps to integrate Microsoft modern authentication for Simple Mail Transfer Protocol (SMTP) with OpenIAM. By using modern authentication, you can securely connect to Microsoft Exchange Online using OAuth 2.0, enabling token-based authentication that enhances security.

Configuring the Microsoft part

For detailed instructions on the Microsoft configuration, please refer to the official documentation using the links provided.

1. Register an application using Quickstart: Register an app.
   Important note: You must register an Enterprise Application (EA) because only EA identifiers can be used for Service Principal registration in Exchange.

2. Add credentials following the Configure client secret instructions.

3. Add permissions as described in
   Add permissions for IMAP, POP, or SMTP.

Add-MailboxPermission -Identity "john.smith@contoso.com" -User <SERVICE_PRINCIPAL_ID> -AccessRights FullAccess, ReadPermission

Configuring SMTP in OpenIAM

The common steps for configuring SMTP in OpenIAM are provided in
this document. The instructions below describe the changes required for modern authentication.

1. Navigate to the mailbox configuration menu:
   Webconsole > Administration > Mailbox Configuration > Create Mailbox Configuration.

2. Go to the Mailbox configuration option and click Create mailbox configuration.
   If you want to send emails using the old authentication flow, fill in the details and do not select MODERN AUTHENTICATION yet, as shown below.

For sending emails via modern authentication, choose MODERN AUTHENTICATION and fill the following fields: Client ID, Tenant ID, Client Secret, Authority, and Scope, as shown below.

The field descriptions and possible values are listed in the table below.

Once all fields are completed and saved, you can send emails via SMTP using modern authentication, which relies on access tokens instead of usernames and passwords.

To test this, create a test email form and click the Send test mail button, as shown below.