Redmine

I have completely refactored and reworked the code. It now includes support for Google, includes documentation, and has extra tests.
For me it all works for both o365 and Google, but please don't hesitate to do some extra testing for different use cases.

1. Added an intuitive help mechanism
2. Translated Dutch comments to English

The attached patch adds native OAuth 2.0 support for incoming email fetching in Redmine without external gem dependencies or complex build steps.

• Web-based authorization flow in the Administration area to authorize email accounts with providers like Google and Microsoft.
• Background auto-refresh of access tokens using stored refresh tokens prior to IMAP fetching.
• Existing rake tasks (e.g. redmine:email:receive_imap) automatically use the authorized OAuth token when the username matches an authorized email account.
• Status, token validity, and enabled providers are visible directly under Administration → Settings → Incoming emails.

Instructions to Test

1. Register an OAuth 2.0 application in your provider’s console (Google Cloud Console or Microsoft Entra ID / Azure Portal):

• Redirect URI: http://<your-redmine-host>/admin/mail_handler/oauth/callback
• Required Scopes:
  • Google: https://mail.google.com/ (or IMAP scope), offline_access
  • Microsoft 365: https://outlook.office.com/IMAP.AccessAsUser.All, offline_access

2. Configure config/configuration.yml

Add the provider credentials to config/configuration.yml and restart Redmine:

default:
  email_oauth:
    providers:
      google:
        client_id: "YOUR_GOOGLE_CLIENT_ID" 
        client_secret: "YOUR_GOOGLE_CLIENT_SECRET" 
      microsoft:
        client_id: "YOUR_MICROSOFT_CLIENT_ID" 
        client_secret: "YOUR_MICROSOFT_CLIENT_SECRET" 
        tenant_id: "common" # or your Azure Tenant ID

1. Go to Administration → Settings → Incoming emails.
2. Verify that your configured providers appear under the Enabled OAuth providers section.
3. Click Manage OAuth 2.0 Accounts (or Add).
4. Enter the email address you want to fetch emails from and select the provider.
5. Click Authorize → complete the sign-in and consent flow on the provider’s page.
6. Upon return, verify that the email account appears in the list with a green checkmark.

4. Test Fetching Emails via Rake Task

Run the standard IMAP receive task using the authorized email as username (password is no longer needed):

bin/rake redmine:email:receive_imap \
  host='imap.gmail.com' \
  port=993 \
  ssl=1 \
  username='authorized_email@example.com' \
  project='my-project' \
  tracker='Bug' \
  RAILS_ENV=production

(For Microsoft 365, use host='outlook.office365.com')

• Auto-refresh: When the access token expires (typically after 1 hour), running the rake task should automatically refresh the access token and succeed.
• Deletion: In Administration -> Settings -> Incoming emails -> Manage OAuth 2.0 Accounts, clicking the delete button on a token mapping should delete the stored tokens.

The patch still needs some minor improvements in the admin UI, but it's good enough to test the functionality.

Removed some debug code from the initial patch.

Jan Catrysse wrote in #note-4:

1. Added an intuitive help mechanism
2. Translated Dutch comments to English

Thanks for working on this.

I've tried a different approach for the following reasons:

• Web-based Authorization: Authorize email accounts directly from the browser in the Administration area without running interactive CLI rake tasks on the server.
• Database-backed Tokens: Tokens are stored in the database instead of local filesystem files, ensuring full compatibility with Docker, Kubernetes, and multi-server setups.
• Multi-Provider & Multi-Account Support: Standardized support for both Microsoft 365 and Google Workspace in configuration.yml, with the ability to manage multiple email accounts.
• Backward-Compatible Rake Tasks: Keeps the existing redmine:email:receive_imap task. If an email has an authorized token, Redmine automatically uses OAuth 2.0 (XOAUTH2) and transparently handles token refreshes without requiring crontab changes.

I have tested this implementation with Gmail / Google Workspace, but I would really appreciate any help in testing it with Microsoft 365 or other environments to ensure everything works smoothly. Feedback is very welcome!

Attached some screenshots.