Keycloak -> Realm Settings -> Email -> Test connection
I'm trying to do this. Page show error "Error! Failed to send email".
Tomcat logs shows error "Could not convert socket to TLS".
How can I solve this problem?
I have Keycloak running in a Kubernetes cluster. Authentication works but I need to set up e-mail to be able to send e-mails for verification and password reset.
I have SendGrid set up as an SMTP Relay. These settings (host, port and api key) work when I send mail using the SendGrid java client. However, when pressing Test connection in KeyCloak I get:
[Error] Failed to load resource: the server responded with a status of 500 ()
[Debug] Remove message (services.js, line 14)
[Debug] Added message (services.js, line 15)
[Error] Can't find variable: error
https://<domain>/auth/resources/ong8v/admin/keycloak/js/controllers/realm.js:76 – "Possibly unhandled rejection: {}"
[Debug] Remove message (services.js, line 14)
There isn't much to go on here. I have an e-mail address set up for the currently logged in user. I've also tried resetting the password in case the Test connection functionality was broken but that didn't work either.
The Realm Settings settings user for email are as such:
host: smtp.sendgrid.net
port: 587
from: test#<domain>
Enable StartTLS: true
Username: "apikey"
Password: <api key>
Any idea what can be wrong? Or how to find out? For instance, maybe I can get a more meaningful error message somehow.
Edit:
I got the server logs.
Failed to send email: com.sun.mail.util.MailConnectException: Couldn't connect to host, port: smtp.sendgrid.net, 587; timeout 10000;
nested exception is: java.net.SocketTimeoutException: connect timed out
Edit 2:
I've tried sending mail using Telnet using the exact same settings and that works. So apparently it's something with Keycloak or its underlying Java libraries that's causing issues sending e-mail.
Turns out that Keycloak works and that emails were blocked by the hosting provider.
I installed Jenkins (Jenkins ver. 2.46.2) and i have configured SMTP Server in Manage Jenkins -> Configure System -> Email Notification.
Test mail is works fine. But in Job email notification not working.
Error message as : Error sending to the following VALID addresses
I checked the Jenkins log file.
550 5.7.60 SMTP; Client does not have permissions to send as this sender [KL1PR03MB1749.apcprd03.prod.outlook.com]
DEBUG SMTP: got response code 550, with response: 550 5.7.60 SMTP; Client does not have permissions to send as this sender [KL1PR03MB1749.apcprd03.prod.outlook.com]
RSET
250 2.0.0 Resetting
com.sun.mail.smtp.SMTPSendFailedException: 550 5.7.60 SMTP; Client does not have permissions to send as this sender [KL1PR03MB1749.apcprd03.prod.outlook.com]
at com.sun.mail.smtp.SMTPTransport.issueSendCommand(SMTPTransport.java:2057)
at com.sun.mail.smtp.SMTPTransport.finishData(SMTPTransport.java:1862)
at com.sun.mail.smtp.SMTPTransport.sendMessage(SMTPTransport.java:1100)
at javax.mail.Transport.send0(Transport.java:195)
at javax.mail.Transport.send(Transport.java:124)
at hudson.plugins.emailext.ExtendedEmailPublisher.sendMail(ExtendedEmailPublisher.java:357)
at hudson.plugins.emailext.ExtendedEmailPublisher._perform(ExtendedEmailPublisher.java:322)
at hudson.plugins.emailext.ExtendedEmailPublisher.perform(ExtendedEmailPublisher.java:230)
at hudson.tasks.BuildStepMonitor$1.perform(BuildStepMonitor.java:20)
at hudson.model.AbstractBuild$AbstractBuildExecution.perform(AbstractBuild.java:779)
at hudson.model.AbstractBuild$AbstractBuildExecution.performAllBuildSteps(AbstractBuild.java:720)
at hudson.model.Build$BuildExecution.cleanUp(Build.java:196)
at hudson.model.Run.execute(Run.java:1775)
at hudson.model.FreeStyleBuild.run(FreeStyleBuild.java:43)
at hudson.model.ResourceController.execute(ResourceController.java:98)
at hudson.model.Executor.run(Executor.java:405)
QUIT
How to fix this issue?
You need to set "System Admin email address" under Manage Jenkins -> Configure System. This is under the Jenkins Location header on that page!
Have a look at below thread.
How can I set the Sender's address in Jenkins?
I am facing this error in Webmail Lite.
I have Exim installed. Here is a snippet of the auth block:
PLAIN:
driver = plaintext
server_set_id = $auth2
server_prompts = :
.ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
server_advertise_condition = ${if eq{$tls_cipher}{}{}{*}}
.endif
server_condition = “${if crypteq{$auth3}{${extract{1}{:}{${lookup{$auth2}lsearch{/etc/$domain/passwd}{$value}{*:*}}}}}{1}{0}}”
I have the passwd stored in the following format:
username:{MD5}asddfasdlasdkandlanskfdaf
How do I get AUTH enabled and working ?
Thanks in advance.
One reason for this error message is sending HELO instead of EHLO, or sending EHLO in the wrong order.
But this message can occur even if EHLO is used, when the server is running Exim.
On my server, I found the solution. In WHM > Home > Service Configuration > Exim
Configuration Manager, the option "Require clients to connect with SSL
or issue the STARTTLS command before they are allowed to authenticate
with the server" was set to the default (On). I'm not sure if I did this
or not, and it is ordinarily a great idea for security, but forces the
mailserver to enable (advertise) only the STARTTLS command, not AUTH. So
when my script sends AUTH, the error message the server sends is correct.
Further information is at http://blog.networkpresence.co/?p=8923 .
Someday when I have time I will find out how to change my script to use
TLS, so I can turn that Exim option On for security.
In my case,this error not coming regularly.some time it works but some time it gives this error.(SMTP Error: Could not authenticate.)
I debug this then I found this
SMTP -> get_lines(): $data was ""
SMTP -> get_lines(): $str is "503 AUTH command used when not advertised "
SMTP -> get_lines(): $data is "503 AUTH command used when not advertised "
SMTP -> FROM SERVER:503 AUTH command used when not advertised
SMTP -> ERROR: RSET failed: 503 AUTH command used when not advertised
SMTP Error: Could not authenticate.
For educational purposes, I need to send an email through an SMTP server, using SMTP's fundamental and simple rules.
I was able to do that using smtp4dev. I telnet localhost 25 and and commands are:
I want to do the same thing, using Gmail SMTP server. However, it requires authentication and TLS. I can't figure out how to do that for Gmail. Here's a screenshot of telnet smtp.gmail.com 587:
I searched and found many links including Wikipedia's article about STARTTLS command. But I'm not able to use TLS and authenticate to Gmail's SMTP server using command line (or sending commands myself in programming languages). Can anyone help?
to send over gmail, you need to use an encrypted connection. this is not possible with telnet alone, but you can use tools like openssl
either connect using the starttls option in openssl to convert the plain connection to encrypted...
openssl s_client -starttls smtp -connect smtp.gmail.com:587 -crlf -ign_eof
or connect to a ssl sockect directly...
openssl s_client -connect smtp.gmail.com:465 -crlf -ign_eof
EHLO localhost
after that, authenticate to the server using the base64 encoded username/password
AUTH PLAIN AG15ZW1haWxAZ21haWwuY29tAG15cGFzc3dvcmQ=
to get this from the commandline:
echo -ne '\00user#gmail.com\00password' | base64
AHVzZXJAZ21haWwuY29tAHBhc3N3b3Jk
then continue with "mail from:" like in your example
example session:
openssl s_client -connect smtp.gmail.com:465 -crlf -ign_eof
[... lots of openssl output ...]
220 mx.google.com ESMTP m46sm11546481eeh.9
EHLO localhost
250-mx.google.com at your service, [1.2.3.4]
250-SIZE 35882577
250-8BITMIME
250-AUTH LOGIN PLAIN XOAUTH
250 ENHANCEDSTATUSCODES
AUTH PLAIN AG5pY2UudHJ5QGdtYWlsLmNvbQBub2l0c25vdG15cGFzc3dvcmQ=
235 2.7.0 Accepted
MAIL FROM: <gryphius-demo#gmail.com>
250 2.1.0 OK m46sm11546481eeh.9
rcpt to: <somepoorguy#example.com>
250 2.1.5 OK m46sm11546481eeh.9
DATA
354 Go ahead m46sm11546481eeh.9
Subject: it works
yay!
.
250 2.0.0 OK 1339757532 m46sm11546481eeh.9
quit
221 2.0.0 closing connection m46sm11546481eeh.9
read:errno=0
Unfortunately as I am forced to use a windows server I have been unable to get openssl working in the way the above answer suggests.
However I was able to get a similar program called stunnel (which can be downloaded from here) to work. I got the idea from www.tech-and-dev.com but I had to change the instructions slightly. Here is what I did:
Install telnet client on the windows box.
Download stunnel. (I downloaded and installed a file called stunnel-4.56-installer.exe).
Once installed you then needed to locate the stunnel.conf config file, which in my case I installed to C:\Program Files (x86)\stunnel
Then, you need to open this file in a text viewer such as notepad. Look for [gmail-smtp] and remove the semicolon on the client line below (in the stunnel.conf file, every line that starts with a semicolon is a comment). You should end up with something like:
[gmail-smtp]
client = yes
accept = 127.0.0.1:25
connect = smtp.gmail.com:465
Once you have done this save the stunnel.conf file and reload the config (to do this use the stunnel GUI program, and click on configuration=>Reload).
Now you should be ready to send email in the windows telnet client!
Go to Start=>run=>cmd.
Once cmd is open type in the following and press Enter:
telnet localhost 25
You should then see something similar to the following:
220 mx.google.com ESMTP f14sm1400408wbe.2
You will then need to reply by typing the following and pressing enter:
helo google
This should give you the following response:
250 mx.google.com at your service
If you get this you then need to type the following and press enter:
ehlo google
This should then give you the following response:
250-mx.google.com at your service, [212.28.228.49]
250-SIZE 35651584
250-8BITMIME
250-AUTH LOGIN PLAIN XOAUTH
250 ENHANCEDSTATUSCODES
Now you should be ready to authenticate with your Gmail details. To do this type the following and press enter:
AUTH LOGIN
This should then give you the following response:
334 VXNlcm5hbWU6
This means that we are ready to authenticate by using our gmail address and password.
However since this is an encrypted session, we're going to have to send the email and password encoded in base64. To encode your email and password, you can use a converter program or an online website to encode it (for example base64 or search on google for ’base64 online encoding’). I reccomend you do not touch the cmd/telnet session again until you have done this.
For example test#gmail.com would become dGVzdEBnbWFpbC5jb20= and password would become cGFzc3dvcmQ=
Once you have done this copy and paste your converted base64 username into the cmd/telnet session and press enter. This should give you following response:
334 UGFzc3dvcmQ6
Now copy and paste your converted base64 password into the cmd/telnet session and press enter. This should give you following response if both login credentials are correct:
235 2.7.0 Accepted
You should now enter the sender email (should be the same as the username) in the following format and press enter:
MAIL FROM:<test#gmail.com>
This should give you the following response:
250 2.1.0 OK x23sm1104292weq.10
You can now enter the recipient email address in a similar format and press enter:
RCPT TO:<recipient#gmail.com>
This should give you the following response:
250 2.1.5 OK x23sm1104292weq.10
Now you will need to type the following and press enter:
DATA
Which should give you the following response:
354 Go ahead x23sm1104292weq.10
Now we can start to compose the message! To do this enter your message in the following format (Tip: do this in notepad and copy the entire message into the cmd/telnet session):
From: Test <test#gmail.com>
To: Me <recipient#gmail.com>
Subject: Testing email from telnet
This is the body
Adding more lines to the body message.
When you have finished the email enter a dot:
.
This should give you the following response:
250 2.0.0 OK 1288307376 x23sm1104292weq.10
And now you need to end your session by typing the following and pressing enter:
QUIT
This should give you the following response:
221 2.0.0 closing connection x23sm1104292weq.10
Connection to host lost.
And your email should now be in the recipient’s mailbox!
As no one has mentioned - I would suggest to use great tool for such purpose - swaks
# yum info swaks
Installed Packages
Name : swaks
Arch : noarch
Version : 20130209.0
Release : 3.el6
Size : 287 k
Repo : installed
From repo : epel
Summary : Command-line SMTP transaction tester
URL : http://www.jetmore.org/john/code/swaks
License : GPLv2+
Description : Swiss Army Knife SMTP: A command line SMTP tester. Swaks can test
: various aspects of your SMTP server, including TLS and AUTH.
It has a lot of options and can do almost everything you want.
GMAIL: STARTTLS, SSLv3 (and yes, in 2016 gmail still support sslv3)
$ echo "Hello world" | swaks -4 --server smtp.gmail.com:587 --from user#gmail.com --to user#example.net -tls --tls-protocol sslv3 --auth PLAIN --auth-user user#gmail.com --auth-password 7654321 --h-Subject "Test message" --body -
=== Trying smtp.gmail.com:587...
=== Connected to smtp.gmail.com.
<- 220 smtp.gmail.com ESMTP h8sm76342lbd.48 - gsmtp
-> EHLO www.example.net
<- 250-smtp.gmail.com at your service, [193.243.156.26]
<- 250-SIZE 35882577
<- 250-8BITMIME
<- 250-STARTTLS
<- 250-ENHANCEDSTATUSCODES
<- 250-PIPELINING
<- 250-CHUNKING
<- 250 SMTPUTF8
-> STARTTLS
<- 220 2.0.0 Ready to start TLS
=== TLS started with cipher SSLv3:RC4-SHA:128
=== TLS no local certificate set
=== TLS peer DN="/C=US/ST=California/L=Mountain View/O=Google Inc/CN=smtp.gmail.com"
~> EHLO www.example.net
<~ 250-smtp.gmail.com at your service, [193.243.156.26]
<~ 250-SIZE 35882577
<~ 250-8BITMIME
<~ 250-AUTH LOGIN PLAIN XOAUTH2 PLAIN-CLIENTTOKEN OAUTHBEARER XOAUTH
<~ 250-ENHANCEDSTATUSCODES
<~ 250-PIPELINING
<~ 250-CHUNKING
<~ 250 SMTPUTF8
~> AUTH PLAIN AGFhQxsZXguaGhMGdATGV4X2hoYtYWlsLmNvbQBS9TU1MjQ=
<~ 235 2.7.0 Accepted
~> MAIL FROM:<user#gmail.com>
<~ 250 2.1.0 OK h8sm76342lbd.48 - gsmtp
~> RCPT TO:<user#example.net>
<~ 250 2.1.5 OK h8sm76342lbd.48 - gsmtp
~> DATA
<~ 354 Go ahead h8sm76342lbd.48 - gsmtp
~> Date: Wed, 17 Feb 2016 09:49:03 +0000
~> To: user#example.net
~> From: user#gmail.com
~> Subject: Test message
~> X-Mailer: swaks v20130209.0 jetmore.org/john/code/swaks/
~>
~> Hello world
~>
~>
~> .
<~ 250 2.0.0 OK 1455702544 h8sm76342lbd.48 - gsmtp
~> QUIT
<~ 221 2.0.0 closing connection h8sm76342lbd.48 - gsmtp
=== Connection closed with remote host.
YAHOO: TLS aka SMTPS, tlsv1.2
$ echo "Hello world" | swaks -4 --server smtp.mail.yahoo.com:465 --from user#yahoo.com --to user#gmail.com --tlsc --tls-protocol tlsv1_2 --auth PLAIN --auth-user user#yahoo.com --auth-password 7654321 --h-Subject "Test message" --body -
=== Trying smtp.mail.yahoo.com:465...
=== Connected to smtp.mail.yahoo.com.
=== TLS started with cipher TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128
=== TLS no local certificate set
=== TLS peer DN="/C=US/ST=California/L=Sunnyvale/O=Yahoo Inc./OU=Information Technology/CN=smtp.mail.yahoo.com"
<~ 220 smtp.mail.yahoo.com ESMTP ready
~> EHLO www.example.net
<~ 250-smtp.mail.yahoo.com
<~ 250-PIPELINING
<~ 250-SIZE 41697280
<~ 250-8 BITMIME
<~ 250 AUTH PLAIN LOGIN XOAUTH2 XYMCOOKIE
~> AUTH PLAIN AGFhQxsZXguaGhMGdATGV4X2hoYtYWlsLmNvbQBS9TU1MjQ=
<~ 235 2.0.0 OK
~> MAIL FROM:<user#yahoo.com>
<~ 250 OK , completed
~> RCPT TO:<user#gmail.com>
<~ 250 OK , completed
~> DATA
<~ 354 Start Mail. End with CRLF.CRLF
~> Date: Wed, 17 Feb 2016 10:08:28 +0000
~> To: user#gmail.com
~> From: user#yahoo.com
~> Subject: Test message
~> X-Mailer: swaks v20130209.0 jetmore.org/john/code/swaks/
~>
~> Hello world
~>
~>
~> .
<~ 250 OK , completed
~> QUIT
<~ 221 Service Closing transmission
=== Connection closed with remote host.
I have been using swaks to send email notifications from nagios via gmail for last 5 years without any problem.
Based on the existing answers, here's a step-by-step guide to sending automated e-mails over SMTP, using a GMail account, from the command line, without disclosing the password.
Requirements
First, install the following software packages:
Expect
OpenSSL
Core Utils (base64)
These instructions assume a Linux operating system, but should be reasonably easy to port to Windows (via Cygwin or native equivalents), or other operating system.
Authentication
Save the following shell script as authentication.sh:
#!/bin/bash
# Asks for a username and password, then spits out the encoded value for
# use with authentication against SMTP servers.
echo -n "Email (shown): "
read email
echo -n "Password (hidden): "
read -s password
echo
TEXT="\0$email\0$password"
echo -ne $TEXT | base64
Make it executable and run it as follows:
chmod +x authentication.sh
./authentication.sh
When prompted, provide your e-mail address and password. This will look something like:
Email (shown): bob#gmail.com
Password (hidden):
AGJvYkBnbWFpbC5jb20AYm9iaXN0aGViZXN0cGVyc29uZXZlcg==
Copy the last line (AGJ...==), as this will be used for authentication.
Notification
Save the following expect script as notify.sh (note the first line refers to the expect program):
#!/usr/bin/expect
set address "[lindex $argv 0]"
set subject "[lindex $argv 1]"
set ts_date "[lindex $argv 2]"
set ts_time "[lindex $argv 3]"
set timeout 10
spawn openssl s_client -connect smtp.gmail.com:465 -crlf -ign_eof
expect "220" {
send "EHLO localhost\n"
expect "250" {
send "AUTH PLAIN YOUR_AUTHENTICATION_CODE\n"
expect "235" {
send "MAIL FROM: <YOUR_EMAIL_ADDRESS>\n"
expect "250" {
send "RCPT TO: <$address>\n"
expect "250" {
send "DATA\n"
expect "354" {
send "Subject: $subject\n\n"
send "Email sent on $ts_date at $ts_time.\n"
send "\n.\n"
expect "250" {
send "quit\n"
}
}
}
}
}
}
}
Make the following changes:
Paste over YOUR_AUTHENTICATION_CODE with the authentication code generated by the authentication script.
Change YOUR_EMAIL_ADDRESS with the e-mail address used to generate the authentication code.
Save the file.
For example (note the angle brackets are retained for the e-mail address):
send "AUTH PLAIN AGJvYkBnbWFpbC5jb20AYm9iaXN0aGViZXN0cGVyc29uZXZlcg==\n"
send "MAIL FROM: <bob#gmail.com>\n"
Lastly, make the notify script executable as follows:
chmod +x notify.sh
Send E-mail
Send an e-mail from the command line as follows:
./notify.sh recipient#domain.com "Command Line" "March 14" "15:52"