Providers for client_credentials grant flow?

[Smig0l]

it seeems that https://github.com/thephpleague/oauth2-client supports client_credentials flow but with a Genericprovider.
is there any provider for Azure that supports it?
it seems that Azure SMTP has been updated to use client_credentials after configuring a Service-principal.

[decomplexity]

The only two providers I have used are Jesper Skytte Marcussen’s greew/oauth2-azure-provider and Jan Hajek’s TheNetworg/[oauth2-azure]. Since MSFT did not, as the time, support client_credentials grant for SMTP, I couldn’t experiment to see at what point authorization failed (if indeed it did), and I recall that IMAP and POP were supported by not SMTP. I had missed the recent (10th July) this year Exchange Team’s announcement of SMTP support, so thank you for letting me know. Google had not, at the time, made any statement about future implementation, and I assume this is still the case.

Looking at TheLeague’s code, it was obvious that client_credentials grants were supported, and I remember wondering whether the typical provider class (e.g. thenetworg/Provider/Azure.php) would handle client_credentials transparently since it extended theleague/Provider/AbstractProvider.php.

The decomplexity wrapper code was, as you know, extended to handle client_credentials grant, but the PHPMailer’s OAuth2.php was written to handle authorization_code grant only. The wrapper’s setup file SendOauth2D-settings.php allowed the grant type to be set by service provider (e.g. MSFT), and the relevant parameter 'grantTypeValue' was passed to PHPMailer’s OAuth2.php

My updated PHPMailer OAuth2.php looked something like:

<?php

/**
 * PHPMailer - PHP email creation and transport class.
 * PHP Version 5.5.
 *
 * @see       https://github.com/PHPMailer/PHPMailer/ The PHPMailer GitHub project
 *
 * @author    Marcus Bointon (Synchro/coolbru) <phpmailer@synchromedia.co.uk>
 * @author    Jim Jagielski (jimjag) <jimjag@gmail.com>
 * @author    Andy Prevost (codeworxtech) <codeworxtech@users.sourceforge.net>
 * @author    Brent R. Matzelle (original founder)
 * @copyright 2012 - 2020 Marcus Bointon
 * @copyright 2010 - 2012 Jim Jagielski
 * @copyright 2004 - 2009 Andy Prevost
 * @license   http://www.gnu.org/copyleft/lesser.html GNU Lesser General Public License
 * @note      This program is distributed in the hope that it will be useful - WITHOUT
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 * FITNESS FOR A PARTICULAR PURPOSE.
 */

namespace PHPMailer\PHPMailer;


use League\OAuth2\Client\Grant\ClientCredentials; 
use League\OAuth2\Client\Grant\RefreshToken;
use League\OAuth2\Client\Provider\AbstractProvider;
use League\OAuth2\Client\Token\AccessToken;

/**
 * OAuth - OAuth2 authentication wrapper class.
 * Uses the oauth2-client package from the League of Extraordinary Packages.
 *
 * @see     http://oauth2-client.thephpleague.com
 *
 * @author  Marcus Bointon (Synchro/coolbru) <phpmailer@synchromedia.co.uk>
 */
class OAuth
{
    /**
     * An instance of the League OAuth Client Provider.
     *
     * @var AbstractProvider
     */
    protected $provider;

    /**
     * The current OAuth access token.
     *
     * @var AccessToken
     */
    protected $oauthToken;

    /**
     * The user's email address, usually used as the login ID
     * and also the from address when sending email.
     *
     * @var string
     */
    protected $oauthUserEmail = '';

    /**
     * The client secret, generated in the app definition of the service you're connecting to.
     *
     * @var string
     */
    protected $oauthClientSecret = '';

    /**
     * The client ID, generated in the app definition of the service you're connecting to.
     *
     * @var string
     */
    protected $oauthClientId = '';

    /**
     * The refresh token, used to obtain new AccessTokens.
     *
     * @var string
     */
    protected $oauthRefreshToken = '';



    /**
     * authorization_code or client_credentials grant
     * passed from SendOauth2B that, in turn, has decoded
     * the parameters file created from SendOauthD.
     * @var string
     */

   public $grantTypeValue = "";

   /**
	* scope value from SendOauthC passed from SendOauthB 
	* @var string
    */
	protected $scope="";


    /**
     * OAuth constructor.
     *
     * @param array $options Associative array containing
     *  'provider`, `userName`, `clientSecret`, `clientId` and `refreshToken` elements
     */
    public function __construct($options)
    {
        $this->provider = $options['provider'];
        $this->oauthUserEmail = $options['userName'];
        $this->oauthClientSecret = $options['clientSecret'];
	$this->oauth2ClientCertificatePrivateKey = $options['clientCertificatePrivateKey']; 
        $this->oauth2ClientCertificateThumbprint = $options['clientCertificateThumbprint']; 
        $this->oauthClientId = $options['clientId'];
        $this->oauthRefreshToken = $options['refreshToken'];
		$this->grantTypeValue = $options['grantTypeValue'];
		$this->scope = $options['scope'];
		
    }

    /**
     * Get a new RefreshToken.
     *
     * @return RefreshToken
     */
    protected function getGrant()
    {
        return new RefreshToken();
    }

    /**
     * Get a new AccessToken.
     *
     * @return AccessToken
     */
	
    protected function getToken()
	{
	switch ($this->grantTypeValue) {

	case "authorization_code":
	// use refresh token to get access token
    
	$accesstoken = $this->provider->getAccessToken(
           $this->getGrant(),
           ['refresh_token' => $this->oauthRefreshToken]
           );
	return $accesstoken;
	
/**
	return $this->provider->getAccessToken(
           $this->getGrant(),
           ['refresh_token' => $this->oauthRefreshToken]
           );
**/		   
		   
	 break;
	    
	case "client_credentials":
    $ret = $this->provider->getAccessToken(
	       $this->grantTypeValue,  
		   ['scope' => $this->scope,
		   'client_id' => $this->oauthClientId,
		   'client_secret' => $this->oauthClientSecret,
		   ]);
	return $ret;
	break;
    
	default:
    echo("ERROR - grant type value neither authorization_code nor client_credentials");
	exit;

    } //ends switch
    }
   /**
    * ends getToken method
    */
	
			
    /**
     * Generate a base64-encoded OAuth token.
     *
     * @return string
     */
    public function getOauth64()
    {
        // Get a new token if it's not available or has expired
        if (null === $this->oauthToken || $this->oauthToken->hasExpired()) {
            $this->oauthToken = $this->getToken();
        }

        return base64_encode(
            'user=' .
            $this->oauthUserEmail .
            "\001auth=Bearer " .
            $this->oauthToken .
            "\001\001"
        );
    }
}

[Smig0l]

so i tried to use client_credentials flow using theleague's provider but it errors with:
Fatal error: Uncaught League\OAuth2\Client\Provider\Exception\IdentityProviderException: invalid_request AADSTS900144: The request body must contain the following parameter: 'refresh_token'.

but if u make a request to the token endpoint to get an AccessToken it does not return a refreshToken (like tha auth code grant) see: https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-client-creds-grant-flow#use-a-token.

I don't know PHP enough to be able to make a PR in the PHPMailer repo or theleagues repo...
Also it seems that only few people tried the cliend_credentials flow.

Btw i appreciate your help and i hope u have time to get back to this and maybe update these repos.

[decomplexity]

I have tested this myself today using the decomplexity wrapper, TheNetworg provider and the modified PHPMailer OAuth2.php I copied to you.
Nothing code-crashed, but PHPMailer comes up with a 'failed to authenticate'. Analysis of the JWT access token doesn't show any obvious errors (the AUD claim was correct - the usual MSFT authentication problem, and there aren't any Scopes - the other usual problem!). A quick look at TheNetworg provider code appears to show that access token provision seems handed off entirely from TheNetworg provider to TheLeague's Abstract provider.
I will have another look over the weekend since I am fairly familiar with the common reasons for a failure to authenticate.
I will also check the EXO Online Powershell settings I used to register the service principal for the user principal mailbox.

[decomplexity]

Having now registered a fresh app specifically for client_credentials flow and registered a new service principal, I am still getting 'failed to authenticate' although the TheNetworg provider and TheLeague code didn't throw errors. The access token content also looks correct although I intend trying to see the effect of forcing an AUD claim of outlook.office.com instead of outlook.office365.com.

[Smig0l]

so i followed the docs and created a new app:
name => SMTPoauth
permission=> SMTP.SendAsApp

serviceprincipal:
$AADServicePrincipalDetails = Get-AzureADServicePrincipal -SearchString SMTPoauth

New-ServicePrincipal -AppId $AADServicePrincipalDetails.AppId -ObjectId $AADServicePrincipalDetails.ObjectId -DisplayName "EXO Serviceprincipal for AzureAD App $($AADServicePrincipalDetails.Displayname)"

$EXOServicePrincipal = Get-ServicePrincipal -Identity "EXO Serviceprincipal for AzureAD App $($AADServicePrincipalDetails.Displayname)"

Add-MailboxPermission -Identity "userthatwillsendmail@domain.com" -User $EXOServicePrincipal.Identity -AccessRights FullAccess

getaccesstoken:
curl -X POST -H "Content-Type: application/x-www-form-urlencoded" -d 'client_id=$appregclientid&scope=https%3A%2F%2Foutlook.office365.com%2F.default&client_secret=$appregsecret&grant_type=client_credentials' 'https://login.microsoftonline.com/$tenantid/oauth2/v2.0/token' | jq -r .access_token

Mail Sent!

i think the issue was the serviceprincipal config that i created a lot of time ago.

Now the problem is that PHPMailer expect a refresh_token but with the client_credentials flow no refresh_token is issued

[decomplexity]

Excellent. Since without trouble I had obtained an access token that looked OK in all the usual respects, the likely culprits were either the wrong Service Principal or wrong Object ID. As I said earlier, the two usual reasons for 'failure to authenticate' are having the wrong AUD claim (an AUD of Graph is a guaranteed failure) and using the wrong scope operands or operands in the wrong order (!! - an undocumented restriction), but since scope for client_credentials flow is a single fixed URL and not a list of scopes, the fault probably lay elsewhere.
PHPMailer's standard OAuth.php expects a refresh token, hence the sample (untested...) code changes I gave earlier that present (as you did) client_id and client_secret with a grant type of client_credentials instead. The switching between authorization_code flow (with a refresh_token grant) and client_credentials flow (with client_id and client_secret and client_credentials grant) is done by adding a new OAuth.php constructor parameter grantTypeValue that, in the wrapper, is passed from SendOauth2D-settings.php but could easily be set in the global code that calls PHPMailer.

One issue with TheLeague's oauth2-client is that there is not, as far as I am aware, any mechanism to refresh a refresh token, either when one was expiring or when obtaining each new access token. The wrapper handles this but it also needs a one-line addition to TheLeague's AccessToken.php. Using client_credentials instead makes this change unnecessary!

[It is counter-intuitive that permissions for authorisation_code flow are set in Graph, but the scopes to be used must refer to outlook.office.com. If the first scope operand refers to Graph or is a valid Graph scope, (e.g. user.read), any remaining operands are also assumed to be Graph scopes unless they are prefixed with a URL. More details in my "Microsoft OAuth2 SMTP issues.md"]

[decomplexity]

Over the weekend I created yet another app.
As before, the EXOservice principal, ADservice princpal, objectID and AppID were all generated with no problem.

I then amended PHPMailer OAuth.php to use Curl - rather as you did - to get an access token directly instead of relying on TheNetworg provider and TheLeague code:

case "client_credentials":
//    $ret = $this->provider->getAccessToken(
//	       $this->grantTypeValue,  
//		   ['scope' => $this->scope,
//		   'client_id' => $this->oauthClientId,
//		   'client_secret' => $this->oauthClientSecret,
//		   ]);

    $curl_url = 'https://login.microsoftonline.com/<my tenant ID>/oauth2/v2.0/token';
    $curl_postfields  = 'client_id=' . $this->oauthClientId;
    $curl_postfields .= '&';
    $curl_postfields .= 'scope=' . $this->scope;
    $curl_postfields .= '&';
    $curl_postfields .= 'client_secret=' . $this->oauthClientSecret; 
    $curl_postfields .= '&';
    $curl_postfields .= 'grant_type=' . $this->grantTypeValue;  
    $curl_handle = curl_init();
    curl_setopt($curl_handle, CURLOPT_URL, $curl_url);
    curl_setopt($curl_handle, CURLOPT_POSTFIELDS, $curl_postfields);
    curl_setopt($curl_handle,CURLOPT_RETURNTRANSFER,true);
    $ret = curl_exec($curl_handle);
    curl_close($curl_handle); 
    $ret = rtrim(substr($ret,strpos($ret,'"access_token":"')+16),'"}');
    echo("Access token =" . $ret);

    return $ret;
    break;

The access token thus created still caused SMTP to fail authentication!
Inspecting the access token with jwt.ms reveals nothing odd - apart from the iss claim:

https://sts.windows.net/<my tenant ID>/

that does not end /v2.0 in spite of the URL being aimed at the v2.0 endpoint.
This may be correct if outlook.office365.com (like Graph) only accepts V1 tokens as the token endpoint has to issue a token that conforms to whatever the resource API accepts. Tokens, unlike authorization_code flow authorization codes, can only refer to one resource so this isn't a problem and of course V2 endpoints can issue V1 tokens and vice versa.

[Smig0l]

The access token thus created still caused SMTP to fail authentication!

make sure no MFA policy is set on the mailbox, security defaults off.
also you should use outlook.office365 as scope and the clientId that u see on the app registration panel.

this is my accesstoken decoded from jwt.ms:

Details

{ "typ": "JWT", "nonce": "gqyhToeoN5EXdNlG3qCDbGMXetgK0jSMF0F8rWlDXF0", "alg": "RS256", "x5t": "-KI3Q9nNR7bRofxmeZoXqbHZGew", "kid": "-KI3Q9nNR7bRofxmeZoXqbHZGew" }.{ "aud": "https://outlook.office365.com", "iss": "https://sts.windows.net/bac434ba-afc5-4650-9876-326d0147a894/", "iat": 1696163943, "nbf": 1696163943, "exp": 1696167843, "aio": "E2FgYEiqm3witoJH2UBrgpNzlu1yAA==", "app_displayname": "SMTPoauth", "appid": "a9264f05-30bb-4a2e-ba52-4a03107b0157", "appidacr": "1", "idp": "https://sts.windows.net/bac434ba-afc5-4650-9876-326d0147a894/", "oid": "33e7c3ac-028b-402c-8be8-6b2dd4e23c75", "rh": "0.AYIAujTEusWvUEaYdjJtAUeolAIAAAAAAPEPzgAAAAAAAACCAAA.", "roles": [ "SMTP.SendAsApp" ], "sid": "2487aab3-d16d-4e47-bcc5-71d702dee1e2", "sub": "33e7c3ac-028b-402c-8be8-6b2dd4e23c75", "tid": "bac434ba-afc5-4650-9876-326d0147a894", "uti": "GRiQTDkT0UCqsAaP_JEKAA", "ver": "1.0", "wids": [ "0997a1d0-0d1d-4acb-b408-d5ca73121e90" ] }

[decomplexity]

My finger trouble! I reran the Curl and it worked.
I then compared the token obtained from Curl and the token obtained from PHPMailer Oauth.php's getAccessToken (the commented block in my example earlier).
The crucial difference is in the tenant value of the iss and idp claims:

• the Curl version contained my tenant ID
• the getAccessToken version contained the tenantID f8cdef31-a31e-4b4a-93e4-5f571e91255a which is MSFT's tenant ID for its own Enterprise applications

And whereas the Curl token contained a role claim of [SMTP.SendAsApp], there is no role claim in the getAccessToken token, presumably because the SMTP.SendAsApp permission is set only in my tenant.

So I now need to check whether the tenantID is obtained by the TheNetWorg provider or the TheLeague's Abstract provider.

[Smig0l]

So how hard would it be to add the client_credential flow to thenetworg's provider and make PHPMailer to accept access_token only instead of a refresh_token?

[decomplexity]

I don't think PHPMailer itself would need changing outside of Oauth.php, but (from memory) TheNetworg provider default tenantID is 'common' (i.e. a multi-organisation 'tenant'). It may just need a simple override when called: I don't think $tenant is a parameter of Azure.php's constructor but will need to check.

[decomplexity]

$tenant is fortunately a public property (but not a constructor parameter) of TheNetworg provider Azure.php.
PHPMailer authentication with the client_credentials additions (i.e. the uncommented commented-out code in my example earlier, not the Curl version which we know works) now also works if $tenant is specified after instantiation of Azure.php:

$this->provider = new Azure(
                    ['clientId'     => $this->clientId,
                    'clientSecret'  => $this->clientSecret,
                    etc 
		    ] );
$this->provider->tenant = your app tenant ID;

[decomplexity]

I have upgraded the decomplexity/SendOauth2 wrapper on GitHub and Packagist to accept an optional tenant ID. This should not be needed for client_credentials grant if, by default, the provider specified a tenant ID instead of 'common' as Organisation in the URL parameters when calling the token endpoint.
It's worth noting that whereas using 'common' is acceptable for authorization_code grant (because a user is logging on), only tenant GUID and domain name are allowed for client_credentials grant.

I will put together an update to Oauth.php such that it isn't a breaking change, and offer it as a PR to @Synchro for PHPMailer

[schiorean]

Hi, I hope it's fine I update this issue because it's about client_credentials grant flow.
I was following this example file https://github.com/PHPMailer/PHPMailer/blob/master/examples/sendoauth2.phps and after a few modifications (e.g. port 587) I was able to send an email using authorization_code grant.

Since our application is a server application I tried using client_credentials grant but whatever I tried it's always giving me "AUTH command failed: 535 5.7.3 Authentication unsuccessful".

P.S. I added FullAccess rights to the mailbox via Exchange Online Powershell.

@decomplexity Any hints where I can have a look for a complete example how I can use client_credentials grant with PHPMailer and SendOauth2?

Thank you in advance!

[Smig0l]

Hi, I hope it's fine I update this issue because it's about client_credentials grant flow. I was following this example file https://github.com/PHPMailer/PHPMailer/blob/master/examples/sendoauth2.phps and after a few modifications (e.g. port 587) I was able to send an email using authorization_code grant.

Since our application is a server application I tried using client_credentials grant but whatever I tried it's always giving me "AUTH command failed: 535 5.7.3 Authentication unsuccessful".

P.S. I added FullAccess rights to the mailbox via Exchange Online Powershell.

@decomplexity Any hints where I can have a look for a complete example how I can use client_credentials grant with PHPMailer and SendOauth2?

Thank you in advance!

Hi! since i was in the same situation as u basically i solved it without using this library.
I tested it using phpmailer 6.8.1 in my wordpress functions.php

/*=====================================
 Inizio OAUTH PHPMAILER
 (Imposto l'invio di email in smtp usando OAUTH e 365)
 SEE DOCS: https://learn.microsoft.com/en-us/exchange/client-developer/legacy-protocols/how-to-authenticate-an-imap-pop-smtp-application-by-using-oauth#use-client-credentials-grant-flow-to-authenticate-smtp-imap-and-pop-connections
 REQUIREMENTS:
 - composer require phpmailer/phpmailer
 - a registered app created in 365 with SMTP.sendAsApp API_permission and a ServicePrincipal with fullAccess on the mailbox that needs to send from(see docs)
=====================================*/

require get_template_directory() . '/vendor/autoload.php'; //ensure that we load the vendor folder under the theme directory

use PHPMailer\PHPMailer\SMTP;
use PHPMailer\PHPMailer\OAuthTokenProvider;

class OAuth implements OAuthTokenProvider
{
	//Basically created a custom OAuth class that generate and accept an oauthAccessToken in the constructor (instead of a refreshToken).
	//Made it because as of Oct 23 there aren't any providers that implemented a client_credentials flow and the included OAuth class was not compatible.

	protected $scope = 'https://outlook.office365.com/.default';
	protected $grantTypeValue= 'client_credentials';

	/**
	 * The current OAuth access token.
	 *
	 * @var string
	 */
	protected $oauthAccessToken;

	/**
	 * The user's email address, usually used as the login ID
	 * and also the from address when sending email.
	 *
	 * @var string
	 */
	protected $oauthUserEmail = '';

	/**
	 * The client secret, generated in the app definition of the service you're connecting to.
	 *
	 * @var string
	 */
	protected $oauthClientSecret = '';

	/**
	 * The client ID, generated in the app definition of the service you're connecting to.
	 *
	 * @var string
	 */
	protected $oauthClientId = '';

	/**
	 * The tenant ID, visible in the app definition of the service you're connecting to.
	 *
	 * @var string
	 */
	protected $oauthTenantId = '';

	/**
	 * OAuth constructor.
	 *
	 * @param array $options Associative array containing
	 *                       `userName`, `tenantId`, `clientId`, `clientSecret` and optionally an `accessToken` elements
	 */
	public function __construct($options)
	{
		$this->oauthUserEmail = $options['userName'];
		$this->oauthTenantId = $options['tenantId'];
		$this->oauthClientId = $options['clientId'];
		$this->oauthClientSecret = $options['clientSecret'];
		$this->oauthAccessToken = $options['accessToken'];
	}

	/**
	 * Get a new AccessToken.
	 *
	 * @return string
	 */
	protected function getAccessToken()
	{
		
		$curl_url = 'https://login.microsoftonline.com/'.$this->oauthTenantId.'/oauth2/v2.0/token';
		$curl_postfields  = 'client_id=' . $this->oauthClientId;
		$curl_postfields .= '&';
		$curl_postfields .= 'scope=' . $this->scope;
		$curl_postfields .= '&';
		$curl_postfields .= 'client_secret=' . $this->oauthClientSecret; 
		$curl_postfields .= '&';
		$curl_postfields .= 'grant_type=' . $this->grantTypeValue;  
		$curl_handle = curl_init();
		curl_setopt($curl_handle, CURLOPT_URL, $curl_url);
		curl_setopt($curl_handle, CURLOPT_POSTFIELDS, $curl_postfields);
		curl_setopt($curl_handle,CURLOPT_RETURNTRANSFER,true);
		$result = curl_exec($curl_handle);
		curl_close($curl_handle);
		$accessToken = rtrim(substr($result, strpos($result, '"access_token":"') + 16), '"}');
		return $this->oauthAccessToken = $accessToken;
	}

	/**
	 * Generate a base64-encoded OAuth token.
	 *
	 * @return string
	 */
	public function getOauth64()
	{
		if (null === $this->oauthAccessToken) {
			$this->oauthAccessToken = $this->getAccessToken();
		}
		return base64_encode(
			'user=' .
			$this->oauthUserEmail .
			"\001auth=Bearer " .
			$this->oauthAccessToken .
			"\001\001"
		);
	}
}

function send_mail($to, $subject, $body) {

	date_default_timezone_set('Etc/UTC'); //SMTP needs accurate times, and the PHP time zone MUST be set
	$mail = new PHPMailer(true); //create a new instance of the PHPMailer class and set it to throw exceptions if there are any errors
	$mail->isSMTP();
	$mail->SMTPDebug = SMTP::DEBUG_OFF; //Enable SMTP debugging
	$mail->SMTPSecure = PHPMailer::ENCRYPTION_STARTTLS; //Set the encryption mechanism to use (SMTPS -> implicit TLS on port 465 or STARTTLS -> explicit TLS on port 587)
	$mail->SMTPAuth = true; //Whether to use SMTP authentication
	$mail->Host = 'smtp.office365.com'; //Set the hostname of the mail server
	$mail->Port = 587; //Set the SMTP port number (587 or 465 or 25)
	$mail->AuthType = 'XOAUTH2'; //Set AuthType to use XOAUTH2
	$mail->XMailer = ' '; //remove X-Mailer: PHPMailer header

	$mail->Subject = $subject;
    $mail->Body = $body;
	$mail->IsHTML(true);
	$mail->addAddress($to);

	$tenantId = 'YOURTENANTID';
	$clientId = 'YOURAPPID';
	$clientSecret = 'YOURSECRET';
	$from = 'noreply-supportoclienti@example.it';
	$mail->setFrom($from, 'NoReply example');

	$debug = false;
	if($debug){
		error_reporting(E_ALL);
		ini_set('display_errors', 1);
		$mail->SMTPDebug = SMTP::DEBUG_SERVER;
		$tenantId = 'YOURTENANTID';
	  $clientId = 'YOURAPPID';
	  $clientSecret = 'YOURSECRET';
	  $from = 'noreply-supportoclienti@example.it';
	  $mail->setFrom($from, 'NoReply example');
    }

	$mail->setOAuth(
		new OAuth(
			[
				'userName' => $from,
				'tenantId' => $tenantId,
				'clientId' => $clientId,
				'clientSecret' => $clientSecret,
			]
		)
	);

	if (!$mail->send()) { //send the message, check for errors
		echo 'Mailer Error: ' . $mail->ErrorInfo;
	} else {
		//echo 'message sent!';
	}
	
}

/*=====================================
 Fine OAUTH PHPMAILER
 
=====================================*/

so u just use send_mail() everywhere u need.

Hope it helps!

P.S. IIRC the clientid refers to the objectid of the created serviceprincipal.