Support resource field for non-standard ROPCG; normalise expires_in (#351)

* Add an `oauth2_resource` field to support a non-standard variant of the ROPCG flow (currently only known to be used in 21Vianet's version of O365)
* Always cast `expires_in` to integer to work around cases where it is returned as a string

Author: Eric-ZhehanZ

emailproxy.config

@@ -153,8 +153,10 @@ documentation = Accounts are specified using your email address as the section h
 	2.0 flows (both currently only known to be available for Office 365). To use either of these flows, add an account
 	entry as normal, but do not add a `permission_url` value (it does not apply, and its absence signals to the proxy to
 	use the appropriate token retrieval mechanism). For CCG, set `oauth2_scope = https://outlook.office365.com/.default`
-	and `oauth2_flow = client_credentials`. For ROPCG, set `oauth2_flow = password` (and use a standard scope value). An
-	example is given for both methods towards the end of the sample account entries below.
+	and `oauth2_flow = client_credentials`. For ROPCG, set `oauth2_flow = password` (and use a standard scope value).
+	If you are using Microsoft services delivered by a regional provider (such as 21Vianet) that uses a non-standard
+	ROPCG variant, remove the `oauth2_scope` value and instead use `oauth2_resource`. Examples are given for each of
+	these cases towards the end of the sample account entries below.
 
 		- WARNING: Please note that by default the CCG flow has essentially no local access control when creating new
 		accounts (no user consent is involved, so the proxy cannot validate login attempts unless an account entry
@@ -271,14 +273,22 @@ oauth2_flow = client_credentials
 client_id = *** your client id here ***
 client_secret = *** your client secret here (remove this entire line if a secret is not required) ***
 
-[ropcg.flow.configured.address@your-tenant.com]
+[ropcg.flow.scope.configured.address@your-tenant.com]
 documentation = *** note: this is an advanced O365 account example; in most cases you want the version above instead ***
 token_url = https://login.microsoftonline.com/*** your tenant id here ***/oauth2/v2.0/token
 oauth2_scope = https://outlook.office365.com/IMAP.AccessAsUser.All https://outlook.office365.com/POP.AccessAsUser.All https://outlook.office365.com/SMTP.Send offline_access
 oauth2_flow = password
 client_id = *** your client id here ***
 client_secret = *** your client secret here (remove this entire line if a secret is not required) ***
 
+[ropcg.flow.resource.configured.address@your-tenant.com]
+documentation = *** note: this is an advanced O365 account example specific to providers that use a non-standard version of the ROPCG flow (such as 21Vianet); in most cases you want the version above instead ***
+token_url = https://login.partner.microsoftonline.cn/*** your tenant id here ***/oauth2/token
+oauth2_resource = https://partner.outlook.cn
+oauth2_flow = password
+client_id = *** your client id here ***
+client_secret = *** your client secret here (remove this entire line if a secret is not required) ***
+
 [service.account.accessible.address@your-domain.com]
 documentation = *** note: this is an advanced Google account example; in most cases you want the version above instead ***
 token_url = https://oauth2.googleapis.com/token

emailproxy.py

@@ -739,6 +739,7 @@ def get_oauth2_credentials(username, password, reload_remote_accounts=True):
         permission_url = AppConfig.get_option_with_catch_all_fallback(config, username, 'permission_url')
         token_url = AppConfig.get_option_with_catch_all_fallback(config, username, 'token_url')
         oauth2_scope = AppConfig.get_option_with_catch_all_fallback(config, username, 'oauth2_scope')
+        oauth2_resource = AppConfig.get_option_with_catch_all_fallback(config, username, 'oauth2_resource')
         oauth2_flow = AppConfig.get_option_with_catch_all_fallback(config, username, 'oauth2_flow')
         redirect_uri = AppConfig.get_option_with_catch_all_fallback(config, username, 'redirect_uri')
         redirect_listen_address = AppConfig.get_option_with_catch_all_fallback(config, username,
@@ -751,8 +752,9 @@ def get_oauth2_credentials(username, password, reload_remote_accounts=True):
         jwt_key_path = AppConfig.get_option_with_catch_all_fallback(config, username, 'jwt_key_path')
 
         # because the proxy supports a wide range of OAuth 2.0 flows, in addition to the token_url we only mandate the
-        # core parameters that are required by all methods: oauth2_scope and client_id
-        if not (token_url and oauth2_scope and client_id):
+        # core parameters that are required by all methods: client_id and oauth2_scope (or, for non-standard ROPCG,
+        # currently only known to be used by 21Vianet, oauth2_resource instead of oauth2_scope - see GitHub #351)
+        if not (token_url and client_id and ((oauth2_flow == 'password' and oauth2_resource) or oauth2_scope)):
             Log.error('Proxy config file entry incomplete for account', username, '- aborting login')
             return (False, '%s: Incomplete config file entry found for account %s - please make sure all required '
                            'fields are added (at least token_url, oauth2_scope and client_id)' % (APP_NAME, username))
@@ -863,7 +865,7 @@ def get_oauth2_credentials(username, password, reload_remote_accounts=True):
 
                         access_token = response['access_token']
                         config.set(username, 'access_token', cryptographer.encrypt(access_token))
-                        config.set(username, 'access_token_expiry', str(current_time + response['expires_in']))
+                        config.set(username, 'access_token_expiry', str(current_time + int(response['expires_in'])))
                         if 'refresh_token' in response:
                             config.set(username, 'refresh_token', cryptographer.encrypt(response['refresh_token']))
                         AppConfig.save()
@@ -907,8 +909,8 @@ def get_oauth2_credentials(username, password, reload_remote_accounts=True):
                 # note: get_oauth2_authorisation_tokens may be a blocking call (DAG flow retries until user code entry)
                 response = OAuth2Helper.get_oauth2_authorisation_tokens(token_url, redirect_uri, client_id,
                                                                         client_secret, jwt_client_assertion,
-                                                                        auth_result, oauth2_scope, oauth2_flow,
-                                                                        username, password)
+                                                                        auth_result, oauth2_scope, oauth2_resource,
+                                                                        oauth2_flow, username, password)
 
                 if AppConfig.get_global('encrypt_client_secret_on_first_use', fallback=False):
                     if client_secret:
@@ -924,7 +926,7 @@ def get_oauth2_credentials(username, password, reload_remote_accounts=True):
                 config.set(username, 'token_salt', cryptographer.salt)
                 config.set(username, 'token_iterations', str(cryptographer.iterations))
                 config.set(username, 'access_token', cryptographer.encrypt(access_token))
-                config.set(username, 'access_token_expiry', str(current_time + response['expires_in']))
+                config.set(username, 'access_token_expiry', str(current_time + int(response['expires_in'])))
 
                 if 'refresh_token' in response:
                     config.set(username, 'refresh_token', cryptographer.encrypt(response['refresh_token']))
@@ -1169,11 +1171,14 @@ def get_oauth2_authorisation_code(permission_url, redirect_uri, redirect_listen_
     @staticmethod
     # pylint: disable-next=too-many-positional-arguments
     def get_oauth2_authorisation_tokens(token_url, redirect_uri, client_id, client_secret, jwt_client_assertion,
-                                        authorisation_result, oauth2_scope, oauth2_flow, username, password):
+                                        authorisation_result, oauth2_scope, oauth2_resource, oauth2_flow, username,
+                                        password):
         """Requests OAuth 2.0 access and refresh tokens from token_url using the given client_id, client_secret,
         authorisation_code and redirect_uri, returning a dict with 'access_token', 'expires_in', and 'refresh_token'
         on success, or throwing an exception on failure (e.g., HTTP 400)"""
-        if oauth2_flow == 'service_account':  # service accounts are slightly different, and are handled separately
+
+        # service accounts are slightly different, and are handled separately
+        if oauth2_flow == 'service_account':
             return OAuth2Helper.get_service_account_authorisation_token(client_id, client_secret, oauth2_scope,
                                                                         username)
 
@@ -1199,11 +1204,18 @@ def get_oauth2_authorisation_tokens(token_url, redirect_uri, client_id, client_s
             if oauth2_flow == 'device':
                 params['grant_type'] = 'urn:ietf:params:oauth:grant-type:device_code'
                 params['device_code'] = authorisation_result['device_code']
-                expires_in = authorisation_result['expires_in']
+                expires_in = int(authorisation_result['expires_in'])
                 authorisation_result['interval'] = authorisation_result.get('interval', 5)  # see RFC 8628, Section 3.2
             elif oauth2_flow == 'password':
                 params['username'] = username
                 params['password'] = password
+                # there is at least one non-standard implementation of ROPCG that uses a resource parameter instead of a
+                # scope (e.g., 21Vianet's version of O365; see GitHub #351) - note that it is not known whether this is
+                # always instead of the scope value or potentially in addition to it, so we only remove if not specified
+                if oauth2_resource:
+                    params['resource'] = oauth2_resource
+                    if not oauth2_scope:
+                        del params['scope']
             if not redirect_uri:
                 del params['redirect_uri']  # redirect_uri is not typically required in non-code flows; remove if empty