mbsync: "Warning: SASL wants more steps despite successful IMAP authentication. Ignoring..."

[keithbowes]

I'm glad to have found crudeoauth so that I can use the standard OAUTHBEARER rather than Google's proprietary XOAUTH2, but I'm getting this warning. I don't know anything about the SASL and OAUTHBEARER mechanisms, but could it be that you're indicating successful authentication too early? If this is an mbsync bug, feel free to close. (Everything works fine, so it's no big deal, but it might be something that can be fixed to work even better.)

[spaceone]

Can you give more details on your integration, how you are using it, where does the warning come from, etc?

[spaceone]

some user of XOAUTH2 had the same issue.
moriyoshi/cyrus-sasl-xoauth2#9 (comment)

The origin of the warning message is:
https://git.code.sf.net/p/isync/isync

static int
process_sasl_step( imap_store_t *ctx, int rc, const char *in, uint in_len,
                   sasl_interact_t *interact, const char **out, uint *out_len )
{   
    imap_server_conf_t *srvc = ctx->conf->server;
    
    while (rc == SASL_INTERACT) {
        if (process_sasl_interact( interact, srvc ) < 0)
            return -1;
        rc = sasl_client_step( ctx->sasl, in, in_len, &interact, out, out_len );
    }
    if (rc == SASL_CONTINUE) {
        ctx->sasl_cont = 1;
    } else if (rc == SASL_OK) {
        ctx->sasl_cont = 0;
    } else {
        error( "Error performing SASL authentication step: %s\n", sasl_errdetail( ctx->sasl ) );
        return -1;
    }
    return 0;
}


static void 
done_sasl_auth( imap_store_t *ctx, imap_cmd_t *cmd ATTR_UNUSED, int response )
{
    if (response == RESP_OK && ctx->sasl_cont) {
        sasl_interact_t *interact = NULL;
        const char *out;
        uint out_len;
        int rc = sasl_client_step( ctx->sasl, NULL, 0, &interact, &out, &out_len );
        if (process_sasl_step( ctx, rc, NULL, 0, interact, &out, &out_len ) < 0) 
            warn( "Warning: SASL reported failure despite successful IMAP authentication. Ignoring...\n" );
        else if (out_len > 0) 
            warn( "Warning: SASL wants more steps despite successful IMAP authentication. Ignoring...\n" );
    }

    imap_open_store_authenticate2_p2( ctx, NULL, response );
}

So this looks like that mbsync doesn't do all required steps. It would, if the SASL module would return SASL_INTERACT but the OAUTHBEARER specs doesn't mention to use this in the authentication flow.

Please remove the AUTHENTICATE OAUTHBEARER … line in your last post. It contains youre email address and your token, which if still valid, should be revoked. Otherwise users can get access to your mails/user information/etc.