Re: oauth2 support for Emacs email clients

[David Engster]

>   Others have mentioned "officially" registering Emacs as IMAP/SMTP
>   clients for Office365 (and possibly Gmail), similar to what seems
>   to be the case for Thunderbird.  I am wondering how davmail is
>   doing this.

Microsoft has actually recognized that it does not make sense for
desktop applications to embed secrets into their code, so they
distinguish between "public" and "confidential" client applications:

https://docs.microsoft.com/en-us/azure/active-directory/develop/msal-client-applications

Public client applications do not have a client secret but only an ID
which can simply be embedded into the application, which is how DavMail
does it. Public client applications are only allowed to access web APIs
on behalf of the user, but this is usually enough.

-David