Configuring OAuth 2.0 Email Proxy for EcoStruxure Building Operation SMTP Notifications

[CraigEl]

Issue

EcoStruxure Building Operation (EBO) only supports Basic Authentication for SMTP, but email providers such as Microsoft 365 and Google have deprecated Basic Authentication. As a result, EBO cannot send email notifications when OAuth 2.0 is required by the mail provider.

Product Line

EcoStruxure Building Operation

Environment

• Building Operation Enterprise Server
• Building Operation Enterprise Central
• Building Operation Automation Server

• Email providers:

  • Microsoft 365

  • Google Workspace

• Third‑party tool: Email OAuth 2.0 Proxy (from GitHub)

Cause

EBO cannot generate OAuth 2.0 tokens and therefore cannot authenticate with modern mail servers that require OAuth‑based SMTP authentication. A bridging mechanism is required to translate EBO’s Basic Authentication into OAuth 2.0

Resolution

Use a locally installed proxy (Email OAuth 2.0 Proxy) to accept Basic Authentication from EBO and perform OAuth 2.0 authentication with the mail provider.

⚠️ Important Note:

The solution detailed in this article is not officially tested or supported by Schneider Electric R&D.

---

Configuration steps

Refer to OAuth 2.0 Email Proxy integration with EBO for full details.

1. Install the Email OAuth 2.0 Proxy

1. Download the proxy from its GitHub page.
2. Install/extract the application on either:
   • the same Windows machine as the EBO server.

     

   • a Windows computer in the same network.

     

---

2. Generate OAuth 2.0 Client Credentials

Google Gmail

• Create a Google Cloud project.
• Generate Client ID and Client Secret. 

Microsoft 365

• Register an app in Microsoft Azure.
• Generate Client ID and Client Secret (one‑time visibility).
• Enable SMTP Authentication for the mailbox.

---

3. Configure the Proxy

The proxy uses a single configuration file stored in the same folder as emailproxy.exe.

Key sections include:

• [emailproxy] – token handling, encryption
• [SMTP-XXXX] – local listener and SMTP relay mapping
• [user@provider.com] – OAuth credentials for each account

Sample configuration

[emailproxy] 
delete_account_token_on_password_error = True 
encrypt_client_secret_on_first_use = False
[SMTP-2588]
server_address = smtp-mail.outlook.com
server_port = 587
server_starttls = True
local_address = 127.0.0.1
local_port = 2588
[SMTP-2587]
server_address = smtp.gmail.com
server_port = 587
server_starttls = True
local_address = 127.0.0.1
local_port = 2587
 
[**@outlook.com]
permission_url = https://login.microsoftonline.com/common/oauth2/v2.0/authorize
token_url = https://login.microsoftonline.com/common/oauth2/v2.0/token
oauth2_scope = https://outlook.office.com/IMAP.AccessAsUser.All https://outlook.office.com/POP.AccessAsUser.All https://outlook.office.com/SMTP.Send offline_access
redirect_uri = http://localhost:85
client_id = **
client_secret = **
[**@gmail.com]
permission_url = https://accounts.google.com/o/oauth2/auth
token_url = https://oauth2.googleapis.com/token
oauth2_scope = https://mail.google.com/
redirect_uri = http://localhost:85
client_id = **
client_secret = **

---

4. Prepare the System

1. Ensure no previous proxy processes are running:

   taskkill /f /im emailproxy.exe
   

2. Start the proxy by running emailproxy.exe. 

---

5. Configure EBO SMTP Settings

In EBO WorkStation → Server Properties → Email tab:

Setting	Value
Primary Host	IP of proxy (ex: 127.0.0.1)
Port	The local_port defined in proxy config (e.g. 2588)
Encryption	None (proxy handles TLS)
Sender/Username	Email address sending notifications
Password	Any value (used only for token encryption)

---

6. Authorize OAuth Account in System Tray

The first time EBO triggers an email, the proxy requires authorization:

1. Right‑click the proxy icon in Windows System Tray.
2. Navigate to Authorise account → select your email.

   

3. Complete the web‑based OAuth login.
4. Successful authorization shows a confirmation window. 

   

---

7. Configure Proxy to Start Automatically

Option A: Start at login

• Right‑click proxy icon → Start at login

Option B: Start at system startup (no user login)

• Use Windows Task Scheduler:
  • General tab → run as System

    

  • Trigger → At startup

    

  • Action → Start emailproxy.exe

    

  • Ensure "Allow task to be run on demand"

    

---

8. Validate Email Sending

Check logs for results:

Success

• Proxy log contains: 235 2.7.0 Authentication successful
• EBO event: "Email sent successfully"

Failure

• Proxy error such as 535 5.7.139 Authentication unsuccessful
• EBO alarm generated

---

Additional Troubleshooting

Proxy Debug Mode

• Enable via right‑click → Debug mode

Telnet Testing

Use Telnet to test direct SMTP communication.

Network & Firewall Requirements

1. Allow outbound EBO → Proxy on local port
2. Allow outbound Proxy → Mail provider
   • smtp.office365.com:587
   • smtp.gmail.com:587