Actually, we needed to migrate a lot of email boxes from the Google Workspace for a domain, so we choose another method to do this. We use XOAUTH2
It’s not clear in the google documentation, but we need first generate a json file with secrets
This file is describe in imapsync documentation https://imapsync.lamiral.info/FAQ.d/FAQ.XOAUTH2.txt (Q. How to use XOAUTH2 via a json file to globally authenticate gmail users?)
In mailcow syncjob, just put the absolute path to the secret.json in the password field (/tmp/secret.json). Sure, first we have an error : No such file
We must put the file inside the dovecot container (which make the imapsync)
docker exec -ti mailcowdockerized-dovecot-mailcow-1 bash
echo '{
“type”: “service_account”,
“project_id”: “project-name”,
“private_key_id”: “YYYYYYYYYYYYYYYYYYYYYYYYYYYYY”,
“private_key”: “—–BEGIN PRIVATE KEY—–\nXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX=\n—–END PRIVATE KEY—–\n”,
“client_email”: “test@project-name.iam.gserviceaccount.com”,
“client_id”: “99999999999999999999”,
“auth_uri”: “https://accounts.google.com/o/oauth2/auth”,
“token_uri”: “https://oauth2.googleapis.com/token”,
“auth_provider_x509_cert_url”: “https://www.googleapis.com/oauth2/v1/certs”,
“client_x509_cert_url”: “https://www.googleapis.com/robot/v1/metadata/x509/test%project-name.iam.gserviceaccount.com”,
“universe_domain”: “googleapis.com”
}' > /tmp/secret.json
(Be carefull, if you restart your dovecot container, this file will be erase 😉)
Now, we everytime has an error from google :
401
{
“error”: “unauthorized_client”,
“error_description”: “Client is unauthorized to retrieve access tokens using this method, or client not authorized for any of the scopes requested.”
}
It’s definitivly an error of settings in gmail service account
After following this tutorial, we finally succeeded in configuring the google service correctly : ollionorg/google-oauth2-token?tab=readme-ov-file#create-a-service-account
Hope this will help 🙂)
