Dear Maintainer,

I have two Google mail (@gmail.com) accounts. Both are configured to use
XOAUTH2 authentication for receiving (Imap / SSL / 993) and sending (smtp /
STARTTLS / 587).

Both accounts can retrieve the email, but ONLY ONE works for sending.
The other account fails to send email with the message "Failed to authenticate
additional scopes", and if i start akonadi in the shell i see the messages:
---------------------------
[SASL-XOAUTH2] - Requesting authID!
[SASL-XOAUTH2] - Requesting token!
[SASL-XOAUTH2] - filling prompts!
[SASL-XOAUTH2] - Requesting authID!
[SASL-XOAUTH2] - Requesting token!
org.kde.kgapi: Bad request, Google replied ' "{\n  \"error\":
\"invalid_grant\",\n  \"error_description\": \"Bad Request\"\n}" '
org.kde.pim.mailtransport.smtpplugin: Error obtaining XOAUTH2 token: "Failed to
authenticate additional scopes"
org.kde.pim.ksmtp: SMTP Socket error: QAbstractSocket::RemoteHostClosedError
"The remote host closed the connection"
-----------------------------

As far as i can tell both accounts are set up identically. I even created the
failing one again (identity and sending account). Same error. I would be happy
to debug/investigate if helpful.

Hi,

I upgraded yesterday my machine from bookworm/stable to trixie/testing.

KMail was used to check if I can send emails - this seems no more to work.

Seeing the same issue like Ariel Garcia in #1033462 (sorry partly in German):

We have an error during reading password  "Entry not found"
We have an error during reading password  "Entry not found"
[SASL-XOAUTH2] - Requesting authID!
[SASL-XOAUTH2] - Requesting token!
[SASL-XOAUTH2] - filling prompts!
[SASL-XOAUTH2] - Requesting authID!
[SASL-XOAUTH2] - Requesting token!
org.kde.kgapi: Bad request, Google replied ' "{\n  \"error\":
\"invalid_grant\",\n  \"error_description\": \"Bad Request\"\n}" '
org.kde.pim.mailtransport.smtpplugin: Error obtaining XOAUTH2 token:
"Authentifizierung zusätzlicher Bereiche ist fehlgeschlagen"
org.kde.pim.ksmtp: SMTP Socket error:
QAbstractSocket::RemoteHostClosedError "Der entfernte Rechner hat die
Verbindung geschlossen"

English:

org.kde.pim.mailtransport.smtpplugin: Error obtaining XOAUTH2 token: "Failed to
authenticate additional scopes"
org.kde.pim.ksmtp: SMTP Socket error: QAbstractSocket::RemoteHostClosedError
"The remote host closed the connection"

When NO password (token) is set I see:
We have an error during reading password  "Entry not found"

Tryouts:

[ kmail - SMTP ]

User: sedat.dilek@gmail.com
Pass:MYTOKEN

Encryption-1: STARTTLS
Port-1: 587
Authentication-1: XOAUTH2

Alternatively:

Encryption-2: SSL/TLS
Port-2: 465
Authentication-2: XOAUTH2

NOTE: On Gmail side nothing was changed - I can send patches via git
send-email but not KMail.

I use postgresql backend and can connect to the database and its tables.

[ ~/.config/akonadi/akonadiserverrc ]

[Debug]
Tracer=null

[%General]
Driver=QPSQL

[QPSQL]
Host=
InitDbPath=
Name=akonadi-dileks
Options=
ServerPath=
StartServer=false
- EOF -

Deleting all files in ~/.config/akonadi/ but keeping akonadiserverrc
plus deleting directory ~/.local/share/akonadi after stopping akonadi
did not help.

In May 2023 was my last working sent-email - I kept all test-emails
and are stored in sent-mail:

[ ~/.local/share/local-mail/sent-mail/new/1683526703181.R196.iniza26703181.R196.iniza
]

From: dileks <sedat.dilek@gmail.com>
To: sedat.dilek@gmail.com
Subject: KMail - Test 08-May-2023
Date: Mon, 08 May 2023 08:18:22 +0200
Message-ID: <2687898.mvXUDI8C0e@iniza>
X-KMail-Identity: 1886993645
X-KMail-Transport: 1190029663
X-KMail-Fcc: 20
X-KMail-Identity-Name: dileks
X-KMail-Transport-Name: dileks@gmail
MIME-Version: 1.0
Content-Transfer-Encoding: 7Bit
Content-Type: text/plain; charset="us-ascii"

KMail - Test 08-May-2023
- EOF -

Not sure where to dig into the woods.

Any help is much appreciated.

Thanks.

Best regards,
-Sedat-

OAuth 2.0 Scopes for Google APIs:

https://developers.google.com/identity/protocols/oauth2/scopes

Hi,

Unfortunately, I had no big success with playing with Google's OAuth Scopes.

But I found another solution ...

Gmail-Account > Data & Privacy > Apps and services > Third party apps
and services > Akonadi Service For Google Services

... I was able to send emails again via KMail.

[ INFO ]
Akonadi Resources for Google Services has some access to your Google Account

To use some Akonadi Resources for Google Services features, you gave
Akonadi Resources for Google Services some access to your Google
Account.
This access might include sensitive info

[ See your profile info ]
See your primary Google Account email address
Associate you with your personal info on Google

[ Read, compose, send, and permanently delete all your email from
Gmail ] <--- so-called "Scopes"
This app wants permission to do anything you can do in your Gmail, including:
Read your emails
Compose new emails
Add new emails meant for a different email address into your inbox
Send emails for you
Delete your email
Create, change or delete your email labels
Get notified when certain kinds of emails appear in your Gmail inbox,
like a travel confirmation

Your email may contain sensitive info, like names of your contacts,
your private communications, or financial or medical information

[ CONCLUSION ]
Unsure, if this was a clever/smart decision?

BR,
-Sedat-