Skip to main content

OAuth Clients for Email Integration

Some systems require Deepser to perform authorization before it can use their email services. Deepser allows you to configure multiple OAuth clients to authorize it through the OAuth2 protocol on different providers.

Configuration​

To configure an OAuth client, navigate to System > Tools > OAuth > Client in the Deepser Backend.

The grid displays all OAuth clients defined in Deepser. Click the + Add Client button to create a new one.

You can also create or edit an OAuth Client directly from a mailbox configuration form. Under the OAuth Client field, click the + icon to create a new client, or click the pencil icon to modify the selected one.

OAuth Client Fields​

FieldDescription
Redirect UriDeepser URL from which requests are sent to the provider. Must be authorized in the provider's admin panel. Appears after the client is saved.
NameDescriptive name displayed in the system.
ProviderGoogle, Azure, or Generic. For Google or Azure, only Client ID, Client Secret, and Status need to be filled.
Client IDPublic identifier provided by the provider when a new application is authorized.
Client SecretSecret part of the authentication credentials, provided by the provider.
TypeType of data you want to access/recover.
ScopeScopes the application requires access to. Not needed for Google or Azure.
Url AuthorizeBase URL for OAuth 2 authentication. Not needed for Google or Azure.
Url Access TokenBase URL for requesting the authentication token. Not needed for Google or Azure.
ProxyIP address and port of any proxy in use. Not required for Google or Azure.
VerifyEnable or disable SSL check if a proxy is configured. Not needed for Google or Azure.
StatusIf "Disabled", the client is not active.
Scope Separator CharCharacter used to separate different scopes. Not needed for Google or Azure.
Endpoint User DataEndpoint for retrieving user data after authentication. Not needed for Google or Azure, or for Mailbox type.
Related LDAPsAny LDAP integrations whose users must be linked. Not needed for Mailbox type.
Username AttributeAttribute describing the user's username. Not needed for Google or Azure, or for Mailbox type.
User FieldsMaps user attributes to those retrieved from the endpoint. Not needed for Google or Azure, or for Mailbox type.
User Create ExpressionPHP code for user creation (e.g., SSO integration). Not needed for Mailbox type.
Login Button CaptionButton label for SSO access. Not needed for Mailbox type.
Login Button IconIcon on the SSO authentication button. Not needed for Mailbox type.
Access TokenContains the serialized access token. Not editable in the form.
Original Access TokenContains the serialized access token. Not editable in the form.

After saving, click the Validate button to authorize the client with the provider.

Authenticate with the provider through the form that appears. Once logged in, the client is authorized.

Azure OAuth Client (Legacy Protocol)​

This section explains how to set up a new OAuth client using the legacy IMAP/POP3/SMTP protocol to integrate Office 365 with Deepser. For the recommended Graph API approach, see Configure Office 365 Mailbox Integration.

Prerequisites​

Retrieve your Tenant ID from the Microsoft Entra ID Overview page:

Create the OAuth Client in Deepser​

  1. In the Deepser Backend, go to System > Tools > OAuth > Client and click Add Client.

  2. Set:

    • Name
    • Provider: Azure
    • Type: Mailbox (IMAP, POP3, SMTP)
    • Tenant ID

  3. Click Apply or Save.

  4. Once saved, the redirect URI is generated. Copy it for the next step.

Create the App on Azure​

  1. Go to the Azure portal and sign in with your Office 365 account.

  2. Click on App Registrations, then New Registration.

  3. Name the application. Under Supported Account Types, select Single Tenant (first item).

  4. Under Redirect URI, select Web and paste the URI generated by the Deepser OAuth client.

  5. Click Register.

Configure the Azure App​

  1. Click Authentication in the left menu.

  2. Go to Certificates and Secrets, click Client Secrets tab, and generate a new secret via New Client Secret.

  3. Enter a description and expiration, then click Add. Copy the secret Value and paste it into the Client Secret field of the Deepser OAuth Client.

warning

The Client Secret value is only viewable at the time of generation. After navigating away, it cannot be recovered.

  1. In Deepser, paste the Application ID (from the Azure Overview page) into the Client ID field. Save.

  2. In Azure, go to API Permissions and click Add a permission. Select Microsoft Graph, then Delegated Permissions.

  3. Select the following permissions:

    • Offline_access
    • IMAP.AccessAsUser.All (optional if using POP)
    • Pop.AccessAsUser.All (optional if using IMAP)
    • SMTP.Send

  4. Click Add Permissions, then click Grant Admin Consent for Deepser and confirm.

Validate the OAuth Client​

  1. In Deepser, click Validate. Ensure you are signed in with the correct username. Alternatively, click Copy URL and paste it into an Incognito browser window to sign in with a specific account.

warning

The validating user must have an active Office 365 license and access to the mailboxes. Ensure IMAP, POP, and Authenticated SMTP are enabled in the Office 365 admin area user settings. For shared mailboxes, verify that IMAP and POP services are enabled.

  1. If validation succeeds, a green confirmation message appears.

  2. Go to System > Tools > Email > Mailbox and select the incoming mailbox. In the OAuth Client field, select the validated client and save.

  3. Click Check to verify the mailbox connection. A green "Connection Successful" message confirms correct operation.

Google OAuth Configuration​

This section walks you through creating an OAuth client in Deepser for mailbox integration with Google, configuring a Google Cloud project, and validating the connection.

Create a Deepser OAuth Client for Google​

  1. In the Deepser Backend, navigate to System > Tools > OAuth > Client > Add Client.

  2. Enter a name, set the type to Mailbox, set the provider to Google, and save.

  3. Copy the generated redirect URL.

Configure Google Cloud Project​

If your Google project is already set up, skip to Configure OAuth Client ID Credentials.

  1. Go to the Google Cloud Platform and log in.

  2. Click on the project menu at the top and create a New Project.

  3. Select the new project, then go to APIs & Services > OAuth Consent Screen.

  4. Click Start. Enter a name, the access email in User Support Email and Developer Contact Information, then click Save & Continue.

  5. In Public, select External and proceed.

  6. Enter your email in Contact Details, accept the policies, and click Create.

  7. Under Data Access, press Add or Remove Scopes. In the Add Manually section, paste https://mail.google.com/, click Add to Table, then Update, then Save and Continue.

Configure OAuth Client ID Credentials​

  1. In the Credentials section, click Create Credentials and select OAuth Client ID.

  2. Select Web Application as the type, give it a name, and under Authorized Redirect URIs, paste the URI from the Deepser OAuth client. Click Create.

  3. Copy the generated Client ID and Client Secret and enter them into the Deepser OAuth Client.

  4. Save and click Validate.

  5. Log in and click Continue. Select the read/write permissions for Google Mail and click Continue.

  6. If all steps were completed correctly, the OAuth Client will be validated and active.