Unable to setup GMail account - Error 401: disabled_client Topic is solved

[SlySven]

I have switched to Epyrus on a fresh installation of Devuan Linux (I had a hardware failure that meant that OS on the HDD got really messed up so it was easier to start from scratch on a replacement, larger HDD). Previously I was using an older 65-ish version of Thunderbird because I have an OpenGPG smartcard for the key for my primary EMail account on the prior copy of that OS and having got that all working I thought I should also add in my back-up GMail EMail account today. However when I tried to do that I found I was unable to authorise it, instead I got this 401 error:

Screenshot_20231115_011933.png

Clicking on the "Learn more" link did not do anything and the above screen shot is what I got after clicking on the "Request Details" which opened up the detail below it.

From what I have been able to research I think this behaviour is what Google does when an "application" that it has not "approved" has made more than 100 attempts to access Google's API. Is this the case and if so what needs to be done to get Epyrus "approved" and who has to do it?

[athenian200]

From what I have been able to research I think this behaviour is what Google does when an "application" that it has not "approved" has made more than 100 attempts to access Google's API. Is this the case and if so what needs to be done to get Epyrus "approved" and who has to do it?

Sorry that happened. Epyrus will never be officially "approved," I'm afraid. Only people and organizations with really deep pockets can be officially approved by Google for OAuth2.

The API key I have in there is basically a placeholder, for a workaround I've found...

Bear in mind that you will likely have to generate your own OAuth2 key for GMail eventually (or use an app password), so if you're using that be aware. Use the prefs:

oauth2.google.clientid
oauth2.google.clientsecret

And change the values to match your self-generated OAuth2 key. The instructions here may help if you're not clear on how to do that:

https://www.claws-mail.org/faq/index.php/Oauth2

So basically, you will have to generate your own OAuth2 key to use your GMail account with OAuth2, otherwise OAuth2 won't work reliably. Some users prefer to use an app password, but there are features of GMail that only work with OAuth2.

In other words, any OAuth2 support we have will be very hacky/experimental by nature, and there is basically no way around this. I still want to leave the option in so people can "play with" it, but you shouldn't be expecting Epyrus to "just work" the way other e-mail clients do. It's never going to be a "good" e-mail client because I don't have the money or time to put into it.

Honestly, I'm seriously feeling as time goes on that Epyrus is just not very useful and that it's a lot of work I am putting in to make something that's inferior to what's already out there... I'm not particularly proud of it.

[Moonchild]

Honestly, I'm seriously feeling as time goes on that Epyrus is just not very useful

If it wasn't useful I (and others) wouldn't be using it as our daily driver for all our e-mail needs. You don't give yourself enough credit!
The fact that Google has locked down its infrastructure to continue to push webmail inside GMail (for obvious advertising and data harvesting reasons) should NOT be taken as a reflection on how "useful" it is as a client. If Epyrus was a gmail-specific client, an argument could be made it should "work out of the box" with Google, but Epyrus is not, and it works perfectly otherwise with services that aren't trying to be draconian about their clients.

[distantpluto]

Honestly, I'm seriously feeling as time goes on that Epyrus is just not very useful and that it's a lot of work I am putting in to make something that's inferior to what's already out there... I'm not particularly proud of it.

What Moonchild said. Plus... instead of just being one of the many delighted but silent users I am obligated and eager to tell you that you should be very proud!

Silent why? Because it works perfectly (for me). Only last week I suddenly realised I didn't have any RSS feed for the Epyrus forum (in Epyrus!) and on visiting to get the link I then realised I'd missed a few updates! I was still using that original release You know why it had never even crossed my mind to check for updates? Because Epyrus works perfectly (for me). And I'm big on checking for updates (every day) with the OS and associated packages.

So to reiterate, Epyrus is one of those indispensable essentials that is just there and just works and is taken for granted because it's so good and never gives any problem whatsoever (in my case anyway). If I had no choice but to replace it I would have a huge headache! So thank you very much indeed

[athenian200]

Thanks for the words of encouragement, guys.

I was kind of bracing for people to criticize my decision to leave OAuth2 support in if I can't have it work "properly," and wasn't looking forward to defending that. But yeah, I guess what I'm really hoping to do is keep up with OAuth2 support by having everything set up so that it will work "in theory" if I ever get the proper certifications. Is it likely I'll ever be setup for that? No, but I sort of like to imagine that one day I will have a means to get it, I suppose.

[Navigator]

It's never going to be a "good" e-mail client because I don't have the money or time to put into it.

Honestly, I'm seriously feeling as time goes on that Epyrus is just not very useful and that it's a lot of work I am putting in to make something that's inferior to what's already out there... I'm not particularly proud of it.

In February I started a thread How can I support Epyrus? At that time you replied:

I would actually much rather anyone interested in donating to support this project donate to Pale Moon instead. The forum and the Gitea repo, and UXP itself are all covered by those funds, and there really isn't a lot of money going into Epyrus specifically at the moment.

Has the situation changed? I know it won't solve the time problem but are you open to donations now?

Please don't abandon Epyrus!

[athenian200]

Has the situation changed? I know it won't solve the time problem but are you open to donations now?

Please don't abandon Epyrus!

Well, I'm not going to abandon it, don't worry too much about that... I guess I am just exhausted with Epyrus on a certain level. There's just so much that feels out of my control that happens with it.

I mean, I know we're getting off topic here, but everyone can clearly see my state of mind from that one line near the end even though I was trying not to dive into it too much, so I guess I might as well post what was on my mind.

1. Epyrus is always getting flagged by SmartScreen as malware, because of a lack of code signing.
2. Epyrus gets accused by SpamAssassin of impersonating Mozilla, because the UA is similar but not exactly the same (I will be able to solve that one, though).
3. Epyrus isn't able to be trusted as an OAuth2 client, because the process of setting that up basically requires you to have a company of some kind, at least an LLC, and probably a fair bit of money too.
4. By the way, I somehow wound up with an @epyrus.org e-mail address that requires OAuth2 and can't be used with Epyrus.

I could deal with any one of them individually, but it's a triple whammy of problems that are all screaming at me about trust, how big a deal that is in the e-mail client space, how so many things have to be done "just right," and how I can't reasonably expect to get that kind of trust as an individual developer. It's just... a bit exhausting sometimes, you know? I'm probably making it bigger in my mind than it deserves to be, mostly because I myself am so dependent on having OAuth2 work and am implicitly asking my users to put up with something even I don't have the patience for on busy days.

It's like, the whole idea of being an application's developer, especially the main developer, is that you're supposed to be the one with the power to fix things. But with Epyrus, I feel powerless instead. I feel like all I can do is empathize with user complaints, because I myself am not happy with what I've made and don't have the power to fix it and turn it into the sort of e-mail client I would like it to be, because the things that bother me most about it are just... not in my control, but in the control of other people running services that I have no say in the operation of that are not very friendly to what I am trying to accomplish.

I have been putting some work into Epyrus, but I am being slowed down by some things I really wanted to get done before the next release. I really can't think of many ways donations would help at this time anyway, I would need to get further along with the application's development before I could get to that point.

[Lucio Chiappetti]

I've never been an Epyrus user (I am an oldtimer which uses alpine as mail client, and fetchmail/procmail to process and sort incoming e-mail) but, since the issue of what Gmail calls surreptitiously "non secure clients" is a common issue (being sometimes discussed in the alpine and fetchmail mailing lists ... apparently doomsday will come sometimes in September) I wonder whether a joint action between the developers of those very useful clients could find some common solution or workaround. I share your concerns.

At the moment my main e-mail address is still my work one (and since a few years my organization moved to Gsuite, i.e. the enterprise version of Gmail, but using fetchmail I've been able not to change at all my mode of using e-mail), I have a secondary one on a civic network, but its future level of support is not sure, and anyhow it has just POP not IMAP, so I keep it use at the minimum). Awaiting doomsday, I need to find a(n unexpensive) solution. I've never used a VPS (though I suppose I still remember how to set up sendmail, which I did on my institute machines before Gsuite, I never did it on my home computer because it is not always on, and has a dynamic IP behing CGNAT) and have no idea of the costs. Or perhaps I could find some free IMAP provider, and instruct Gsuite to forward all my mail there, and fetch it wioth fetchmail from there. Maybe I'll get even a better spam filtering!

BTW, I wonder whether the OP has declared to Gmail to use "non secure apps". I did that long ago, and this should be safe until doomsday.

[moonbat]

I just use Gmail's app password feature, you need 2FA on your account for that feature to be enabled.

[athenian200]

I've never been an Epyrus user (I am an oldtimer which uses alpine as mail client, and fetchmail/procmail to process and sort incoming e-mail) but, since the issue of what Gmail calls surreptitiously "non secure clients" is a common issue (being sometimes discussed in the alpine and fetchmail mailing lists ... apparently doomsday will come sometimes in September) I wonder whether a joint action between the developers of those very useful clients could find some common solution or workaround. I share your concerns.

Thanks, it honestly does make me feel less alone to hear stuff like that, even if it doesn't give an immediate solution. It's funny you mention fetchmail, because I was doing more research and found this. Apparently they are using the same types of solutions as what I am doing with Epyrus in fetchmail 7, and are just as uncomfortable/uncertain/frustrated at the situation as I am.

https://gitlab.com/fetchmail/fetchmail/ ... DME.OAUTH2

[Moonchild]

As another data point, I've had to set up an app password for GMail even when using Mozilla's Thunderbird when they started pushing this whole "all mail clients are bad, use webmail". I'm still using that to this day without issue in Epyrus. It's not difficult to do for anyone.

1. Epyrus is always getting flagged by SmartScreen as malware, because of a lack of code signing.
2. Epyrus gets accused by SpamAssassin of impersonating Mozilla, because the UA is similar but not exactly the same (I will be able to solve that one, though).
3. Epyrus isn't able to be trusted as an OAuth2 client, because the process of setting that up basically requires you to have a company of some kind, at least an LLC, and probably a fair bit of money too.

it's a triple whammy of problems that are all screaming at me about trust

1. If you want, I can codesign for you, basically vouching for Epyrus. At least for the time being.
2. That should be solved with your recent commit to use X-mailer instead of user-agent
3. I think OAuth is overrated for non-web context. Google is just being an ass. And as pointed out app passwords work as an alternative. Or just don't use gmail

The whole "let's throw up multiple roadblocks" is entirely by design.
Microsoft throws one up because they want to use the Windows Store and their own applications pushed.
Google throws one up because they want you to use everything through the web/chrome because of well-known data and finance reasons.

The SpamAssassin thing is simply an extra spanner resulting from basically someone being overzealous due to the plethora of fake clients (bots) that keep creating many millions of messages per day to load up the internet with.

I definitely understand that all taken together it can become a bit much. but you can just focus on one thing at a time and just put the rest on the backburner.

[athenian200]

I definitely understand that all taken together it can become a bit much. but you can just focus on one thing at a time and just put the rest on the backburner.

Yeah, I guess the reason it all blends together in my head is because it all feels like different ways of saying the same thing... if they were unrelated problems, it would be easier. But in this case, it all feels like they are speaking with one voice and saying Epyrus has no business being on the Internet.

But if I'm being realistic, the SpamAssassin one is basically already solved, the code signing one can be solved with your help (or my Dad's help), and the OAuth2 one is ironically more of a problem for me personally than it is for most of my users, because I use e-mail services that are even less forgiving than standard Gmail when it comes to enforcing OAuth2, and don't have as much flexibility about using services that don't require it. Though even with OAuth2, it's just a matter of me communicating the current state of Epyrus better, streamlining the process of a user getting their own credentials as much as possible, and dealing with a lot of provider-specific hoops the way fetchmail is doing.

[Moonchild]

streamlining the process of a user getting their own credentials as much as possible

Maybe you want to add a hyperlink and explanation to the dialog where accounts are set up if people use OAuth2, linking to a webpage that contains a howto? That should cover most cases immediately by educating users how to get what they need for it. Maybe also make a GUI to enter the id/key.

[Kris_88]

I haven't looked into OAuth2, but I'm confused by the "redirect_uri: http://localhost". This may be causing the problem.

[Kris_88]

https://stackoverflow.com/questions/700 ... 00-invalid

"Apps that are in production may not have localhost redirect uris.
Either switch it back to test or use another project that is in test. The following redirect uri is invalid for a project that is in production
http://localhost:4000"

[Kris_88]

Apparently I was wrong, localhost is not the problem.
In my opinion, this is not described very consistently...
https://developers.google.com/identity/ ... native-app
https://developers.google.com/gmail/ima ... 2-protocol

Although, they still recommend 127.0.0.1

[JoeyG]

Honestly, I'm seriously feeling as time goes on that Epyrus is just not very useful

If it wasn't useful I (and others) wouldn't be using it as our daily driver for all our e-mail needs. You don't give yourself enough credit!

Greetings from Berlin.

I humbly share Moonchild's sentiment 100%. I've been happily using Epyrus day in, day out since the first release.

I must confess I would probably be considered a "light" email user. I use a pop3 mailbox and only handle - on a busy day - 40 to 50 messages. What I'm concerned with most is reliability, which means my attachments get sent OK, and, e.g. changes in text color are delivered and shown correctly.

To be honest, I have no idea email clients "work", and I couldn't program one if my life depended on it.

Having said this, I have clear reasons why I favor Epyrus over Thunderbird, even though I used the latter for well over a decade. This, however, is not the place to delve into them.

Dear athenian200, I feel you've created a top-quality mail client and am happy to repeat what others have written here: You have good reason to give yourself credit for what you've achieved.

[gabrgv]

Concerning the OAuth2 gmail problem, I’m too unable to get it to work, but my problem looks different. Whenever I try to setup a gmail account, I get this error:

400. That’s an error.
The server cannot process the request because it is malformed. It should not be retried. That’s all we know.

I thought it could be related to the clientid/clientsecret, so I changed those to the Thunderbird’s ones. But I still get the same error. Gmail isn’t vital to me, though.

(This app password thing won’t fix it for me, as I don’t own a smartphone.)

[gabrgv]

Whenever I try to setup a gmail account, I get this error

Fixed. I had cookies disabled in Epyrus’ preferences, and the webpage that opens to login with gmail required it . (Using Thunderbird’s clientid/clientsecret.)

[athenian200]

Fixed. I had cookies disabled in Epyrus’ preferences, and the webpage that opens to login with gmail required it . (Using Thunderbird’s clientid/clientsecret.)

Right, but I can't ship Epyrus with Thunderbird's clientid/clientsecret for legal reasons.