Fedora Account System
Red Hat Associate
Red Hat Customer
Description of problem: My University uses Office 365 for hosted E-mail services. I've been able to select "Microsoft Exchange" in GOA (which uses the evolution-ews plugin) in the past and had full access to e-mail, calendars, and contacts via goa and evolution-ews. They recently enabled Duo Security MFA/2FA "Two Factor Authentication", which utilizes Microsoft's "Modern Authentication" structure, similar to what you get with Google or Facebook in GOA. After they did this, my GOA configured "Microsoft Exchange" account no longer works as it has no way to "prompt for the Duo MFA screen". I think we need a separate "Office 365" account type that can utilize "Modern Authentication" similar to what the "Microsoft" account type does, but will properly configure the evolution-ews settings. It would appear that this would need to take advantage of Microsoft Azure Identity Libraries powered by Azure Active Directory (ADAL). I talked to my Office 365 administrator and he explained that this is the library being used to do the MFA/2FA "Two Factor Authentication" with Duo Security and our ADFS for Office 365. This library is licensed under the Apache 2.0 license. See https://stackoverflow.com/tags/adal/info for more information. Version-Release number of selected component (if applicable): evolution-3.26.3-1.fc27.x86_64 evolution-ews-3.26.3-1.fc27.x86_64 How reproducible: Once the MFA "Modern Authentication" is enabled on my Office365 account, the GOA setup evolution-ews "Exchange Account" stops working. Steps to Reproduce: 1. Go to GOA or Evolution and setup an "Exchange Account". 2. After you put in the bits for the server, username and password, you are never able to authenticate. Actual results: The GOA/Evolution-ews plugin do not know how to make a "call out" to web-based login so you never get a prompt to do the MFA/2FA and thus never get logged in. Expected results: When you are at the point to enter credentials, it calls out via web to Office365/Duo Security prompts, similar to what happens with "Google" or "Microsoft" account types. Additional info:
Thanks for a bug report. This is already filled upstream, at [1]. Long story short, one of the main issues is that there is no way to test this for me, because I do not have such Office365 account. I turned the two step verification in [2], but it still didn't offer me an OAuth authentication method. If you can, please, run evolution from a terminal like this: $ EWS_DEBUG=2 evolution then check the newly shown output for anything like: < WWW-Authenticate: Basic Realm="" This is the only WWW-Authenticate header I receive from the outlook.office365.com server, while I expect the paid version will offer more WWW-Authenticate headers, including OAuth or OAuth2 instead of Basic. You can also follow [3], to be able to set an application specific password, which seems to be just for your case, instead of turning off the two-factor authentication at [2] (where I had been able to do it at least). [1] https://bugzilla.gnome.org/show_bug.cgi?id=775690 [2] https://account.live.com/proofs/Manage/additional?mkt=en-us [3] https://support.microsoft.com/en-us/help/12409
Hello Milan, I've verified with our Windows team the following: 1. The Office365 instance is not performing the authentication, our local ADFS service is. Our local ADFS service does not use Microsoft MFA, but Duo Security MFA plugin and Duo Security does not do application passwords. The Office365 instance is using ADAL (Modern Authentication) to "pass authentication off to" our local ADFS instance. On supported clients, this is a small "web browser window" where we get the Username/Password prompt, then the Duo Security Frame (which we do a "push" to an app on our Phone to approve). This is more like what you would see with Google Account and MFA enabled. 2. I'll work on getting exact headers for you next week when our team is scheduled to go into full production. 3. I might be able to provide you with test accounts so you can test this. I would like to open this back up as a feature request, but will gladly work this with you how you see fit.
(In reply to Phil Hale from comment #2) > 1. The Office365 instance is not performing the authentication, our local > ADFS service is. Aah, I see, that's the OAuth2 with moved authentication to 3rd party, this time to your company, possibly to support single-sign-on feature for multiple (not only web) services. And yes, it works the same as Google with OAuth2. > Our local ADFS service does not use Microsoft MFA, but Duo Security MFA > plugin and Duo Security does not do application passwords. I see, that makes sense. I'm sorry I mixed the two different things together. > 2. I'll work on getting exact headers for you next week when our team is > scheduled to go into full production. That's okay. Once I know 1) I understand it's different than the two-factor auth MS site offers on its own. your headers would be misleading to me and possibly reveal some private information which you might not want to share in public. I mean, there' is no need for the headers now. > 3. I might be able to provide you with test accounts so you can test this. I realized that it's probably not needed, at least not at the moment. I will surely appreciate any early testers (see below). > I would like to open this back up as a feature request, but will gladly work > this with you how you see fit. There is the upstream bug I referenced above. As this is not Fedora specific, it's better to deal with it there, rather than here. I also wrote my today findings there and I plan to work on this in not so distant future (more info there). The Fedora will receive the change as soon as it's done in an upstream release. As I wrote there, due to the foreseen amount of work required I cannot promise any exact date/version when it'll be done. If you wish, I can change the bug status to Closed/Upstream, but that would not change anything on my side, it'll be just a different flag here.
Thanks for the work on this Milan. I'm good with switching to "Closed/Upstream" on this ticket as this is really related to Evolution-EWS and possibly Gnome Online Accounts vs. just a Fedora (my distribution of choice!). I've added myself to the upstream bug and I'm available to offer testing accounts against my particular configuration if needed. Phil
Play euchre online free,thanks for the share and designed this game,i really love this game https://myeuchre.com this is classic mode original game,now hurry up and first click this link.