Using IMAPSync to import from GMail - email

Question

I am writing a Golang app to import emails from Gmail to a local email server using IMAPSync and Google's OAuth2.0. Lets call this the backend app.
There is also an accompanying ios app that uses AppAuth to enable to user login to their google account. With that i am able to get a refresh token, an access token, a JWT token with a payload that looks like
{
"iss": "accounts.google.com",
"at_hash": "HK6E_P6Dh8Y93mRNtsDB1Q",
"email_verified": "true",
"sub": "10769150350006150715113082367",
"azp": "1234987819200.apps.googleusercontent.com",
"email": "jsmith#example.com",
"aud": "1234987819200.apps.googleusercontent.com",
"iat": 1353601026,
"exp": 1353604926,
"nonce": "0394852-3190485-2490358",
"hd": "example.com"
}
The plan was to send this information to the backend and start the import in the backend with IMAPSync.
To login to the google account with IMAPSync i am running this command
/usr/bin/imapsync --host1 imap.gmail.com
--authmech1 xoauth2
--ssl1
--user1 user1#gmail.com
--password1 access_token
--host2 imap.gmail.com
--authmech1 xoauth2
--ssl1
--user2 user1#gmail.com
--password2 access_token
--justlogin --debug
Here are the last few lines of the output:
Host1: imap.gmail.com says it has CAPABILITY for AUTHENTICATE XOAUTH2
Use of uninitialized value $iss in concatenation (.) or string at /usr/bin/imapsync line 4463.
Use of uninitialized value $keyfile in concatenation (.) or string at /usr/bin/imapsync line 4463.
Use of uninitialized value $keyfile in concatenation (.) or string at /usr/bin/imapsync line 4466.
Service account:
Key file:
Key password: notasecret
pkcs12: Cannot open input file , No such file or directory
pkcs12: Use -help for summary.
Private key:
RSA.xs:288: OpenSSL error: no start line at /usr/share/perl5/JSON/WebToken/Crypt/RSA.pm line 19.
I am very unfamiliar with IMAP and email importing. Is this the right approach.
I followed this tutorial OAuth 2.0 for Mobile & Desktop Apps
Should i have followed this one (Using OAuth 2.0 for Web Server Applications) instead and have the backend do all the authentication and retrieve all the tokens?
But then how do i get the user to login as the ios app is the only User facing side of this application?
Thanks!

Answer 1

Read
https://imapsync.lamiral.info/FAQ.d/FAQ.XOAUTH2.txt
=======================================================================
Imapsync tips to use XOAUTH2 authentication (Gmail) and old XOAUTH
=======================================================================
=======================================================================
Q. Is XOAUTH2 authentication available with imapsync?
R. Yes, but XOAUTH2 has been really tested on Unix systems,
less profund on Windows but it should work.
Two file formats are available from Gmail: json and pk12.
json is easier to manage than pk12.
=======================================================================
Q. Imapsync XOAUTH2 fails with the following message, how to fix that?
{
"error": "unauthorized_client",
"error_description": "Unauthorized client or scope in request."
}
R. In order to work you also have to allow the service https://mail.google.com/
in the Google client API manager for OAUTH2.
"Select OAuth 2.0 scopes:"
=======================================================================
Q. How to use XOAUTH2 via a json file to globally authenticate gmail users?
R. Unless you use an imapsync binary like imapsync.exe or imapsync_bin_Darwin,
Perl modules needed for xoauth2 are:
Crypt::OpenSSL::RSA
JSON
JSON::WebToken
LWP
HTML::Entities
Encode::Byte
A easy way to install or upgrade Perl modules is to use cpanm command,
also called cpanminus. On Linux it is something like
sudo cpanm JSON::WebToken JSON Crypt::OpenSSL::RSA LWP HTML::Entities Encode::Byte
The json file patch code and explanation comes from Secretion at
https://github.com/imapsync/imapsync/pull/68
Here is a complete example for Gmail. It is a little stupid
since it is the same account as source and destination but
it's just to get the picture for xoauth2 authentication.
All xoauth2 config is given via the --password1 parameter.
It has the form:
--password1 secret.xoauth2.json
where secret.xoauth2.json is the json file given by Gmail.
imapsync \
--host1 imap.gmail.com --ssl1 --user1 gilles.lamiral#gmail.com \
--password1 secret.xoauth2.json --authmech1 XOAUTH2 \
--host2 imap.gmail.com --ssl2 --user2 gilles.lamiral#gmail.com \
--password2 secret.xoauth2.json --authmech2 XOAUTH2 \
--justlogin --debug
Use your own xoauth2 values.
The secret.xoauth2.json looks like:
{
"type": "service_account",
"project_id": "your-project-name",
"private_key_id": "1cfb..............................bd7fbe",
"private_key": "-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiGziM...ZV5ACKPHuOfp8A46I=\n-----END PRIVATE KEY-----\n",
"client_email": "jsonfile#your-project-name.iam.gserviceaccount.com",
"client_id": "105................689",
"auth_uri": "https://accounts.google.com/o/oauth2/auth",
"token_uri": "https://accounts.google.com/o/oauth2/token",
"auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
"client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/jsonfile%40your-project-name.iam.gserviceaccount.com"
}
You get this json file by a link like:
https://console.developers.google.com/apis/credentials?project=your-project-name
See also:
https://developers.google.com/gmail/imap/xoauth2-protocol
https://developers.google.com/identity/protocols/OAuth2
=======================================================================
...