FOUR-33829 | Google OAuth Email Configuration Intermittently Failing

[mcraeteisha]

Issue

Ticket: FOUR-33829

Google and Office 365 OAuth email configuration in Admin → Settings could fail when sending a test message or when the application sends mail. The SMTP error showed LOGIN and PLAIN attempted before XOAUTH2, with LOGIN returning 535 BadCredentials and XOAUTH2 returning an empty response.

After the Swift Mailer to Symfony Mailer migration, OAuth SMTP no longer forced XOAUTH2. Symfony’s default order tries LOGIN and PLAIN first while the transport password is an OAuth access token, not the mailbox password. That mismatch fails against Google (and the same pattern applies to Office 365 SMTP OAuth). Behavior could look intermittent when the server still tolerated a fallback to XOAUTH2.

Solution

processmaker

• In OauthMailManager, when mail.auth_method is google or office365, restrict the SMTP transport to the Symfony XOAuth2Authenticator before setting the From address as username and the access token as password
• Restore the intent of the pre-migration setAuthMode('XOAUTH2') behavior using Symfony’s setAuthenticators() API
• Add unit tests that OAuth methods use only XOAUTH2 and that standard auth still keeps Symfony’s default authenticators (LOGIN, PLAIN, XOAUTH2, etc.)

How To Test

Automated Tests

• phpunit tests/unit/ProcessMaker/Managers/OauthMailManagerTest.php

Manual Tests

1. In Admin → Settings, create or edit an email server with driver SMTP and authentication Google (Gmail).
2. Complete Google OAuth per product documentation and authorize the account.
3. Set From to the same mailbox that was authorized.
4. Send a test email. Confirm it succeeds and no error lists failed LOGIN/PLAIN before XOAUTH2.
5. Repeat with authentication Office 365 if you use that configuration.
6. Confirm a server using standard username and password SMTP still sends a test email.
7. Trigger a process or notification that sends mail through the OAuth server and confirm the request does not error on send.

ci:deploy

Code Review Checklist

• I have pulled this code locally and tested it on my instance, along with any associated packages.
• This code adheres to ProcessMaker Coding Guidelines.
• This code includes a unit test or an E2E test that tests its functionality, or is covered by an existing test.
• This solution fixes the bug reported in the original ticket.
• This solution does not alter the expected output of a component in a way that would break existing Processes.
• This solution does not implement any breaking changes that would invalidate documentation or cause existing Processes to fail.
• This solution has been tested with enterprise packages that rely on its functionality and does not introduce bugs in those packages.
• This code does not duplicate functionality that already exists in the framework or in ProcessMaker.
• This ticket conforms to the PRD associated with this part of ProcessMaker.

[cursor]

PR Summary

Medium Risk
Touches outbound mail authentication for Google/Office 365 OAuth only; standard SMTP is unchanged but misconfiguration could still block OAuth sends.

Overview
Fixes intermittent OAuth SMTP failures (FOUR-33829) by restricting Google and Office 365 SMTP to XOAUTH2 instead of letting Symfony try LOGIN/PLAIN first with an access token as the password.

In OauthMailManager::createSmtpTransport, the separate google / office365 branches are merged into one path that calls setAuthenticators([new XOAuth2Authenticator()]) before applying the from address and refreshed access token—matching pre–Symfony Mailer behavior and avoiding failed LOGIN/PLAIN attempts that can break the session.

Adds OauthMailManagerTest to assert OAuth auth methods use only XOAUTH2 and that standard SMTP still keeps Symfony’s default authenticators.

^{Reviewed by Cursor Bugbot for commit 2b8061a. Bugbot is set up for automated code reviews on this repo. Configure here.}

[decisions-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

[eiresendez]

• The external PHPMailer evidence shows that the same OAuth account works when authentication is explicitly restricted to XOAUTH2.
  • The patch addresses that exact difference.
  • The restriction applies only to Google and Office 365 OAuth. Standard SMTP behavior is unchanged.
• The implementation is small, correctly scoped, and aligned with the ticket 👍

[vladyrichter]

QA server K8S was successfully deployed https://tenant-1.ci-4a5ce34c6b.engk8s.processmaker.net