Google Workspace IMAP

[jespernissen]

We're receving the below error message on all of our Google Workspace accounts.
Started on august 10th. I've tried deleting our app specific password and adding a new one without any change.

Error: imap_open(): Couldn't open stream {imap.gmail.com:993/imap/novalidate-cert/ssl}. Retrying PLAIN authentication after [AUTHENTICATIONFAILED] Invalid credentials (Failure); Retrying PLAIN authentication after [AUTHENTICATIONFAILED] Invalid credentials (Failure); Can not authenticate to IMAP server: [AUTHENTICATIONFAILED] Invalid credentials (Failure); File: /var/www/html/overrides/webklex/laravel-imap/src/IMAP/Client.php (230))

PHP version: 8.2.7
FreeScout version: 1.8.90

[freescout-helpdesk]

Have you tried to contact Google Workspace support?

Previously G Suite support claimed that App Passwords will work forever - this authentication method will not be deprecated in the future.

[jespernissen]

No, but i will give it a go :-)
It's still possible to create app passwords so i guess it isn't deprecated.

[freescout-helpdesk]

Yes. And the article https://support.google.com/mail/answer/185833 is still there.

[jespernissen]

I've been on a call with the Google Techs and we've tried both POP3 and IMAP and they confirmed all settings was correct.
They don't see any issues on their end and says the FreeScout software is the issue...
Any way to roll back the version just to make sure the issue isn't within the FreeScout software?

[jespernissen]

I've just tried connecting via IMAP via a PHP script on my test setup and i get the same issue, so the problem is Google :-)

[freescout-helpdesk]

Thanks for checking and lettings us know.

[jespernissen]

New development, after creating a new app specific password again, i can now connect via IMAP on my Mac, and via https://www.dotcom-tools.com/email-server-test

Is something with the IMAP service changed in the last few releases?

[freescout-helpdesk]

No.

[jespernissen]

I just tried connecting via Webklex/php-imap
Copied all the settings from FreeScout and it works, i get a list of all folders instantly.
So there is something wrong in the FreeScout implementation...

Anything i can do to troubleshoot further? I'm a PHP developer myself, and i've tried looking at how the entered password is stored in the Freescout database as that would be the obvious place to start, as the error message says the username/password is wrong.

Any help is greatly appreciated as we enjoy using FreeScout in our team :-)

<?php
	use Webklex\PHPIMAP\ClientManager;
	require_once "vendor/autoload.php";
	$cm = new ClientManager('imap.php');
	$client = $cm->account('default');
	$client->connect();
	$folders = $client->getFolders();
	print_r($folders);
?>

imap.php config excerpt

'accounts' => [
        'default' => [// account identifier
            'host'  => 'imap.gmail.com',
            'port'  => 993,
            'protocol'  => 'imap', //might also use imap, [pop3 or nntp (untested)]
            'encryption'    => 'ssl', // Supported: false, 'ssl', 'tls'
            'validate_cert' => true,
            'username' => 'email@test.test',
            'password' => 'AppSpecificPassword',
            'authentication' => null,
            'proxy' => [
                'socket' => null,
                'request_fulluri' => false,
                'username' => null,
                'password' => null,
            ],
            "timeout" => 30,
            "extensions" => []
        ],
],

[freescout-helpdesk]

First you need to determine which IMAP library your FreeScout is using: https://github.com/freescout-helpdesk/freescout/wiki/FAQ#what-libraries-does-freescout-use-to-connect-via-imap

If Webklex/laravel-imap is used there is a chance that there is some issue in your PHP's imap extension. Maybe you've updated your PHP version or something else happened to PHP's imap extension. In this case you can try to fix your PHP's imap extension or add APP_NEW_FETCHING_LIBRARY=true parameter to the .env file to switch to Webklex/php-imap which does not use PHP's imap extension.

[jespernissen]

I just added the APP_NEW_FETCHING_LIBRARY=true to the .env
Now i get another error

Error: connection setup failed; File: /var/www/html/vendor/webklex/php-imap/src/Client.php (391)

/var/www/html/vendor/webklex/php-imap/src/Client.php excerpt, so basically the same issue.

   protected function authenticate() {
        try {
            if ($this->authentication == "oauth") {
                if (!$this->connection->authenticate($this->username, $this->password)) {
                    throw new AuthFailedException();
                }
            } elseif (!$this->connection->login($this->username, $this->password)) {
                throw new AuthFailedException();
            }
        } catch (AuthFailedException $e) {
     Line 391 -->       throw new ConnectionFailedException("connection setup failed", 0, $e);
        }
    }

[jespernissen]

The issue is now solved. After hours of debugging... Google had banned the servers IPv6 address. I disabled the IPv6 address and it worked instantly... Thank you for your help and thank you Google Support for not checking this during the two support calls i had :))

[zigojacko]

Hey @jespernissen I've got this exact same issue that you have originally described here.

How did you find out that Google had banned your servers IPv6 address? We're not hosting our sites on the IPv6 address and we have some mailboxes working fine and others not (on the same domain).

I'm struggling to work out what the hell is going on because I can retrieve a list of IMAP folders from the account perfectly well (so it must be connected?) yet it just won't connect and throws the same error you reported originally when I 'Check Connection'. It's driving me up the wall.

[jespernissen]

Hi @zigojacko
I just discovered that i could connect to imap.gmail.com from any other host than the one server running FreeScout. Then i tried changing the IP of the server and it worked. If you have other mailboxes working on the same IP i think you can rule out the IP being banned.

[zigojacko]

Thanks for replying @jespernissen - yeah, we've got several mailboxes on the same domain connecting and operating perfectly. It's just a select few that are problematic - really frustrating. I spoke to Google Workspace support who confirm there are no issues with my configuration or account set up and the problem is with Freescout not accepting the app passwords for those mailboxes - and they're set up identically to the mailboxes that are working fine. 🤦‍♂️