Hi Robert,

Robert Pluim <rpluim@gmail.com> writes:

>>>>>> On Thu, 15 May 2025 00:17:02 -0700, Xiyue Deng <manphiz@gmail.com> said:
>
>     Xiyue> Thanks for the insights! I managed to reproduce the issue, and during
>     Xiyue> debugging I got the list from the reply as Anush mentioned.  Turned out
>     Xiyue> that the return code was 334 server challenge[1], so it was waiting for
>     Xiyue> the correct user and password.  Sometimes this was directly considered
>     Xiyue> authentication unsuccessful for Gmail[2].  `smtpmail-ok-p' considers a
>     Xiyue> return code less than 400 as successful, and only has challenge handling
>     Xiyue> implemented in cram-md5.  As we should be providing the correct
>     Xiyue> credentials directly in xoauth2, 334 is effectively a failure.
>
>     Xiyue> Maybe in `smtpmail-try-auth-method' for xoauth2, if we see return code
>     Xiyue> 334, we should change the return value to "535 5.7.8 Authentication
>     Xiyue> credentials invalid".  Would like to see whether the Emacs maintainers
>     Xiyue> this is a good idea.
>
> Itʼs either that, or change `smtpmail-ok-p' to accept a second
> optional parameter for which codes to accept for success, which seems
> like overkill here.
>

In this case it's more like which codes not to accept (334), but I agree
`smtpmail-ok-p' is probably the wrong place to handle that.

I'll work on a patch for `smtpmail-try-auth-method' later.

> Iʼm confused as to why Gmail is returning 334 here, if as you say the
> credentials should be correct. Would answering the challenge help?
>

Oh I wasn't clear.  Actually in this case the credentials provided
through xoauth2 is incorrect - the password set should be the access
token but instead it was the app password.  Gmail handles this by
returning 334 and waiting for the correct access token instead of
directly failing with 535.  I'm not sure why Gmail does this.  Probably
it's more tolerant if a user is using xoauth2.

>     Xiyue> Meanwhile, a workaround for auth-source-xoauth2-plugin is to put xoauth2
>     Xiyue> as the last entry in `smtpmail-auth-supported'.  Anush, can you try
>     Xiyue> enable auth-source-xoauth2-plugin and eval `(setq smtp-auth-supported
>     Xiyue> '(cram-md5 plain login xoauth2))' and see if this helps?
>
> If this fixes the issue, you could put this workaround in your xoauth2
> package.
>

This works in my local test, and I think Anush also confirmed it worked.
I'll update my plugin soon.

> Robert
> -- 

-- 
Regards,
Xiyue Deng