php - How to implement Gmail OAuth API to send email (especially via SMTP)?

Question

I'm developing a web application that will send emails on behalf of a logged-in user.

I'm trying to use the new Gmail OAuth protocol announced described here to send these emails through the user's Gmail account (preferably using SMTP rather than IMAP, but I'm easy). However, the sample PHP code gives me a couple of problems.

1. All of the sample code is based on IMAP, not SMTP. Why "support" the SMTP protocol if you're not going to show people how to use it?
2. The sample code gives me a fatal error from an uncaught Zend exception -- it can't find the "INBOX" folder.

Fatal error: Uncaught exception 'Zend_Mail_Storage_Exception' with message 'cannot change folder, maybe it does not exist' in pathoxoauth-php-samplesendMailStorageImap.php:467 Stack trace: #0 pathoxoauth-php-samplesendMailStorageImap.php(248): Zend_Mail_Storage_Imap->selectFolder('INBOX') #1 pathoxoauth-php-sampleshree-legged.php(184): Zend_Mail_Storage_Imap->__construct(Object(Zend_Mail_Protocol_Imap)) #2 {main} Next exception 'Zend_Mail_Storage_Exception' with message 'cannot select INBOX, is this a valid transport?' in pathoxoauth-php-samplesendMailStorageImap.php:254 Stack trace: #0 pathoxoauth-php-sampleshree-legged.php(184): Zend_Mail_Storage_Imap->__construct(Object(Zend_Mail_Protocol_Imap)) #1 {main} in pathoxoauth-php-samplesendMailStorageImap.php on line 254

I've verified that I'm getting good OAuth tokens back, I just don't know how to make the actual email transaction happen. This protocol is still rather new, so there's not much unofficial community documentation about it out there, and the official docs are unhelpfully dry stuff about the SMTP RFC. So if anyone can help get this going, I'd greatly appreciate it.

Note: I've already been able to connect to Gmail's SMTP server via SSL and successfully send an email, provided that the user has given my application his/her Gmail username and password. I'd like to avoid this method, because it encourages phishing and security-minded users won't accept it. This question is not about that.

Answer 1

I'm using a Google Apps account and trying to create an application that allows my users to send mail through SMTP via the new Oauth authorization. I was able to get it to work using some of the information on this discussion. However, I think I should clarify a couple things that I stumbled over...

1) The Zend framework for SMTP apparently automatically looks in the Zend/Mail/Protocol/Smtp/Auth folder for a file name .php in this case "Xoauth.php" which does NOT normally exist in Zend unless you create it. I was able to do this successfully by copying the existing Login.php file to Xoauth.php and modifying it slightly with the suggestions made on this web page.

This was very helpful but it is only part of the Xoauth.php file (Edit a copy of login.php and you will see an equivalent area):

// Ensure AUTH has not already been initiated.
parent::auth();
$this->_send('AUTH XOAUTH ' . $this->_xoauth_request);
$this->_expect(235);
$this->_auth = true;

2) Note that you should definitely have Zend on the PHP include_path even if you reference it directly in PHP because it may try to reference itself with its Loader.php file without using an explicit path.

3) Besides removing the obvious IMAP functions and replacing them with the equivalent SMTP functions I did not need to change the code from the Google OAuth samples for PHP. I did have to include the Zend/Mail.php file in order to Send email and add the code necessary to actually send email for the test to work.