我们希望与客户的 Office 365 电子邮件帐户（不是我们的帐户）创建集成，以便我们可以加载来自特定发件人的电子邮件并将其显示在我们的网站中。一种解决方案基本上是询问客户的用户名和密码，然后使用 EWS 登录，但这非常不安全，并且 EWS 中即将弃用基本身份验证。
另一个解决方案是使用 oAuth2 和 OIDC，但是访问和刷新令牌将会过期，我们将不断要求用户与管理员帐户重新同步。
有没有一种方法可以为用户同步邮件，而不需要他们在令牌过期时重新同步而不使用基本身份验证？
我在想可能有一个图形 api 订阅，但是我没有看到如何在外部帐户上执行此操作，并且似乎它也需要刷新。另一个解决方案可能是 Office 365 插件，但我还没有找到任何有关如何执行此操作的教程。
We would like to create an integration with our customer's Office 365 email account (not our account) so we can load emails coming from a certain sender and display them in our site. One solutions is basically to ask the customer for their username and password and then just login using EWS but this is horribly insecure and basic auth is about to be deprecated in EWS.
The other solution is using oAuth2 and OIDC however the access and refresh token will expire and we will constantly have to ask the user to re-sync with an admin account.
Is there a way to sync mail for a user without requiring them to re-sync when their token expires without using basic authentication?
I was thinking there might be a graph api subscription however I didn't see how to do this on external accounts and seems that it also need to be refreshed. The other solution might be an Office 365 plugin but I haven't found any tutorial on how to do this.
发布评论
评论（1）
您可以在 oAuth https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-client-creds-grant-flow 所以而不是用户名和密码，您将拥有用于登录的客户端密码或证书。然后，您可以将访问范围缩小到一个邮箱 https:// learn.microsoft.com/en-us/graph/auth-limit-mailbox-access，因此您无权访问租户中的所有邮箱。
如果它是一个新应用程序，那么我建议您使用 Graph 而不是 EWS，因为它现在实际上是一个遗留 API，并且 Graph 适合您尝试执行的操作，并且具有需要较少权限的优点（例如，您可以只提供访问电子邮件，而 EWS 可以访问整个邮箱）以及未来的更多支持。
You could use the client credentials flow in oAuth https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-client-creds-grant-flow so instead of a username and password you would have a client secret or certificate to use for logon. You can then scope the access down to one mailbox https://learn.microsoft.com/en-us/graph/auth-limit-mailbox-access so you don't have access to all mailboxes in the tenant.
If its is a new application then I would suggest you use the Graph instead of EWS as its now really a legacy API and the Graph will be fine for what your trying to do and has the advantage of requiring less permissions (eg you can just give access to email while EWS get access to the whole mailbox) and more supportability in the future.