GSuite email: setup without less secure apps

šŸ’¬ General Discussion
1

Hi, weā€™re using SuiteCRM with GSuite as our email provider, as Iā€™m sure lots of others are as well. We do this by connecting via IMAP with password based authentication, allowing ā€œless secure appsā€ and permitting IMAP access in the GSuite settings.

Today Google announced that they are phasing out less secure apps access to Gsuite. Password based access will no longer be supported and instead any apps using Gmail will need to log in through OAuth. We wonā€™t be able to add any new email users to Suite by June 15, 2020.

Since our email through Suite will eventually stop working unless we do something, we might not want to wait until next June. It would probably be better to connect using more secure methods anyways.

Anyone have a current recommended setup with SuiteCRM using Oauth to access Gmail rather than IMAP/ app password? Should we be looking at third party connectors? Or just wait a bit for an update to Suite? We are on 7.11.10.
Thanks,

-Dylan.

2 Likes
2

Hey Dylan!

Thanks for pointing this out, I wasnā€™t aware of it.

Could you please open a new Issue on GitHub explaining this change in GSuite, so we can try to schedule in some time to prepare for it? Thanks!

3

I have posted this issue to github: https://github.com/salesagility/SuiteCRM/issues/8491

2 Likes
4

Any updates on a fix for this?

1 Like
5

Is there any progress on this? Currently, I am unable to connect to email

6

I am paying a developer to create an ā€˜appā€™ to send out via Gmail, once itā€™s approved and working, hopefully within a week or two, Iā€™ll try to remember to share the info here and donate the relevant code to the Community. :innocent:

4 Likes
7

:heart:

It seems that Google cancelled the deprecation of these ā€œless secure appsā€.

However, we should still make SuiteCRM compatibly with the new, more secure scheme.

As far as I can tell it should be just a matter of storing an extra bit of data (OAuth token) and being able to present it to Google when connecting. Thereā€™s probably some work to be done around the flow of the email settings - taking users to the Google sign-in page and getting the token back from that automatically.

2 Likes
8

Iā€™ve had success with gmail and using App Passwords instead of less secure apps. I havenā€™t tried for Gsuite. You can find more info here.

https://support.google.com/accounts/answer/185833?hl=en

2 Likes
9

Just some general pointers about how we did it

  • In Google API interface created a service account
  • In Workspace (formerly G suite) enabled domain wide authority for the above
  • Modified the core functionality that sends out emails so it sends emails using API calls (currently WIP)

Instead of Service Accounts you can also go the more traditional OAUTH 2 way which involves having each user grant access to the app through a consent screen, but with service account itā€™s easier because you donā€™t need to request permissions and token refresh is more reliable

Once we finish with the core modification Iā€™d love to share the code also.

4 Likes
10

Thanks for sharing Robert - curious to know how this API/domain auth approach is working for you?

11

Just following and wondering if a solution is at hand. I am not able to get past authentication errors (gmail via workspace/G suite) states email/password combination is not valid (when of course it is). I am using Vultr hosting as the staging server

12

i would try enabling ā€œless secure appsā€ may for that user? sometimes it helps

13

Hi,
please look at this: Simple Steps to Configure Inbound Email Settings in SuiteCRM

Watch Video: How to Bypass 2 step verification for Third-Party Apps using App Password - YouTube