Failed to send test email when "Credential type" is "OAuth Authentication"

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

When configuring "Standard Email Plugin" and the "Credential type" is "OAuth Authentication", below errors may be encountered when clicking "TEST" button to send test email.

• Failed to get OAuth2 access token. Status code: 404 Reason: Not Found
  
  
  
  
• Email test error: 535 5.7.3 Authentication unsuccessful
  
  

Environment

VCF Operations

Aria Operations

Cause

Error Type 1st: Failed to get OAuth2 access token. Status code: 404 Reason: Not Found

This error indicates that Aria Operations (VCF Operations) failed to obtain OAuth2 access token from the link filled in "Authorization URL". 

The Status code: 404 means that the link in "Authorization URL" cannot be accessed.

 

Error Type 2nd: Email test error: 535 5.7.3 Authentication unsuccessful

This error indicates that Aria Operations (VCF Operations) failed to authenticate with mail server with the token obtained from Authorization Server.

 

Resolution

• All related configuration can be checked on Aria Operations UI: Operations --> Configurations --> Outbound Settings as below:
  
  
• Please contact OAuth provider and SMTP administrator to get related configurations
  
  
• Error Type 1st: Failed to get OAuth2 access token. Status code: 404 Reason: Not Found
  • When "404 Not Found" is returned, please verify if the link filled in "Authorization URL" can be accessed or not
  • Usually this URL should be checked with OAuth provider. 

    e.g. Microsoft identity platform and OAuth 2.0 authorization code flow

    In chapter "Request an access token with a client_secret", the "Authorization URL" should be filled as "https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token"
    
    

• Error Type 2nd: Email test error: 535 5.7.3 Authentication unsuccessful
  
  When "535 5.7.3" is returned from mail server, please check configurations below. (Some configurations should match the format in JWT payload returned from Authorization Server. An example extracted by wireshark is like):
  
  
  • 
  
  
  • Sender Email Address - It should be filled with an email address. 
  • To match the content in the picture above (Please contact Authorization Server vendor to obtain the exact JWT content):
    • Access Token Path - It should be filled with "access_token"
    • Validity Token Path - It could be remained empty
    • Prefix - It should be remained empty if the token_type is "Bearer"