Answers.Body: <p>This is an update from 2024.</p>
  <p>Google explain how to access accounts when two-step verification (2SV) is not possible. See <a href="https://support.google.com/accounts/answer/185833" rel="nofollow noreferrer">https://support.google.com/accounts/answer/185833</a></p>
  <p>You turn on 2SV for the account you're using, but create an app password. The app password is what CiviCRM uses, but human access requires 2SV. Convenient and secure.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-01-30T05:49:10.710Z
Answers.LastActivityDate: 2024-03-22T03:14:29.293Z
Answers.LastEditDate: 2024-03-22T03:14:29.293Z
Answers.UserDisplayName: Ken West
Answers.Body: <p>CiviCRM is not responsible for authentication of users (that's the CMS, ie. Drupal or WordPress). Using OAuth2 (or other protocol) for authenticating CiviCRM to another system would be the responsibility of the extension that wants to do that.</p>
  
  <p>Or do you see a reason to include Oauth2 in core CiviCRM?</p>
  
  <p>I'd be hesitant about using Oauth2 before fully understanding what you're getting into - here's a helpful blog w/ links from Colan Schwartz:</p>
  
  <p><a href="https://colan.consulting/blog/authenticating-drupal-users-oauth2" rel="nofollow noreferrer">https://colan.consulting/blog/authenticating-drupal-users-oauth2</a></p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-12-20T16:32:06.007Z
Answers.Text: True, but I think that what the poster is asking about is for civi administer - system settings - outbound mail if you choose smtp and are using gmail servers as your outbound mail server. In that case civi does authenticate to google.
Answers.UserDisplayName: Demerit
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-12-20T17:26:03.043Z
Answers.Text: Yes, you're probably right. I'd still say that it would require an extension and including it in CiviCRM Core would not be smart (for reasons of security/maintenance).
Answers.UserDisplayName: Alan Dixon
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-12-20T17:30:29.760Z
Answers.Text: Fair enough. I think also the auth might be currently handled by the 3rd party EZC/zetacomponents package which might not support it anyway.
Answers.UserDisplayName: Demerit
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-12-20T17:41:02.843Z
Answers.Text: Speaking on behalf of myself (we run a trade organization in the US) and a handful of others whom use CiviCRM and we talk back and forth, we all use Google Suite (former Google Business Apps). There are about 5M +/- paying businesses whom use it currently. Not sure how that breaks down to CiviCRM, but it certainly is not fly-by-night. 
  
  To that point, the outgoing mail would become an issue for us and we wouldn't change email providers in order to keep CiviCRM. Not being negative, just we are not coders and retraining email ops to keep Civi wouldn't happen here.
Answers.UserDisplayName: Paul Williams
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-12-20T18:30:47.263Z
Answers.Text: My reading of the quote is that the target dates are for INBOUND reading of emails through POP/IMAP clients etc and they have not set a specific date for requiring anything new regarding OUTBOUND emails, just that they are hinting someday they might. While POP/IMAP might be used by the email processor, so it would affect that, OUTBOUND is the bigger concern for most civi users but that isn't set to change yet. Anyway I've made a ticket at https://lab.civicrm.org/dev/mail/issues/59. Thanks @ken-west for reporting. EDIT: Forgot about bounce processing. This could matter for inbound too then.
Answers.UserDisplayName: Demerit
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-12-23T18:24:50.570Z
Answers.Text: Yes, most of my clients also use gsuite for their domain mail, but not for the outbound civimail bounce domain. Using google for your outbound civimail bounce processing is not a great solution - it's a bit of a stop-gap-low-volume hack.
Answers.UserDisplayName: Alan Dixon
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-12-24T03:36:32.923Z
Answers.Text: Thanks for responding Alan but I'm asking about sending emails via SMTP. I'm also intrigued when you say Google is a stop gap. We use Google's SMTP relay service and it scales easily to 10K emails outbound.
Answers.UserDisplayName: Ken West
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-12-20T15:49:35.773Z
Answers.LastActivityDate: 2019-12-20T15:49:35.773Z
Answers.UserDisplayName: Alan Dixon
Body: <p>Google have announced they are <a href="https://gsuiteupdates.googleblog.com/2019/12/less-secure-apps-oauth-google-username-password-incorrect.html" rel="nofollow noreferrer">turning off access to G Suite via username/password authentication</a>. </p>
  
  <p>My initial concern was this could potentially impact anyone using G Suite for Outbound Mail. However the statement says "<em>No change is required for scanners or other devices using simple mail transfer protocol (SMTP) or LSAs (less secure apps) to send emails</em>."</p>
  
  <p>My question is whether CiviCRM are considering OAuth2 authentication (eg Google's XOAUTH2 scheme) when sending mail?</p>
  
Tags: <civimail><email>
Title: FYI - Sending mail via G Suite - Google announce username/password authentication will be turned off
ThreadText: # FYI - Sending mail via G Suite - Google announce username/password authentication will be turned off
  
  (Asked by: username_0 on 2019-12-20)
  
  Google have announced they are [turning off access to G Suite via username/password authentication](https://gsuiteupdates.googleblog.com/2019/12/less-secure-apps-oauth-google-username-password-incorrect.html).
  
  My initial concern was this could potentially impact anyone using G Suite for Outbound Mail. However the statement says "*No change is required for scanners or other devices using simple mail transfer protocol (SMTP) or LSAs (less secure apps) to send emails*."
  
  My question is whether CiviCRM are considering OAuth2 authentication (eg Google's XOAUTH2 scheme) when sending mail?
  
  **Tags:** civimail, email
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_0 on 2020-01-30. Score: 1
  
  This is an update from 2024.
  
  Google explain how to access accounts when two-step verification (2SV) is not possible. See <https://support.google.com/accounts/answer/185833>
  
  You turn on 2SV for the account you're using, but create an app password. The app password is what CiviCRM uses, but human access requires 2SV. Convenient and secure.
  
  
  ---
  
  ### Answer by username_1 on 2019-12-20. Score: 0
  
  CiviCRM is not responsible for authentication of users (that's the CMS, ie. Drupal or WordPress). Using OAuth2 (or other protocol) for authenticating CiviCRM to another system would be the responsibility of the extension that wants to do that.
  
  Or do you see a reason to include Oauth2 in core CiviCRM?
  
  I'd be hesitant about using Oauth2 before fully understanding what you're getting into - here's a helpful blog w/ links from Colan Schwartz:
  
  <https://colan.consulting/blog/authenticating-drupal-users-oauth2>
  
  > **Comments:**
  > **username_2**: True, but I think that what the poster is asking about is for civi administer - system settings - outbound mail if you choose smtp and are using gmail servers as your outbound mail server. In that case civi does authenticate to google.  
  > **username_1**: Yes, you're probably right. I'd still say that it would require an extension and including it in CiviCRM Core would not be smart (for reasons of security/maintenance).  
  > **username_2**: Fair enough. I think also the auth might be currently handled by the 3rd party EZC/zetacomponents package which might not support it anyway.  
  > **username_3**: Speaking on behalf of myself (we run a trade organization in the US) and a handful of others whom use CiviCRM and we talk back and forth, we all use Google Suite (former Google Business Apps). There are about 5M +/- paying businesses whom use it currently. Not sure how that breaks down to CiviCRM, but it certainly is not fly-by-night.   To that point, the outgoing mail would become an issue for us and we wouldn't change email providers in order to keep CiviCRM. Not being negative, just we are not coders and retraining email ops to keep Civi wouldn't happen here.  
  > **username_2**: My reading of the quote is that the target dates are for INBOUND reading of emails through POP/IMAP clients etc and they have not set a specific date for requiring anything new regarding OUTBOUND emails, just that they are hinting someday they might. While POP/IMAP might be used by the email processor, so it would affect that, OUTBOUND is the bigger concern for most civi users but that isn't set to change yet. Anyway I've made a ticket at https://lab.civicrm.org/dev/mail/issues/59. Thanks @ken-west for reporting. EDIT: Forgot about bounce processing. This could matter for inbound too then.  
  > **username_1**: Yes, most of my clients also use gsuite for their domain mail, but not for the outbound civimail bounce domain. Using google for your outbound civimail bounce processing is not a great solution - it's a bit of a stop-gap-low-volume hack.  
  > **username_0**: Thanks for responding Alan but I'm asking about sending emails via SMTP. I'm also intrigued when you say Google is a stop gap. We use Google's SMTP relay service and it scales easily to 10K emails outbound.  
  
  ---
  
  