Accessing SMTP Server using XOAUTH2 on SAP BTP

Accessing SMTP Server using XOAUTH2 on SAP BTP

1. Cloud Connector Flow

1.1 Define Cloud Connector Mappings

  1. Open your Cloud Connector and configure an SMTP connection to your local mail server.

  2. Click on Cloud To On-Premise and then click the Add (+) icon to create a new mapping. (screenshot 1)

  3. Map this Cloud Connector entry to the actual email server host and port—using your desired virtual host and port and the displayed settings of the screenshot.(screenshot 2)

screenshot 1

 screenshot 2

      3. Create also a mapping for the Authorization server. 
      4. Please fill in your desired virtual host/port with the actual internal host/port of the authorization server.


    5. Also, include the resource path whenever you configure sub-resources of a host.(You can also set a generic '/' subpath)




Import certificates of your authorization server or email server in the cloud connector.


1.2 Define Cloud Connector Routes

Configure the destination service in BTP.  In the BTP Cockpit, create an OnPremise destination: 


Fill in the following properties:

  • ClientId: the client ID from your authorization provider.

  • ClientSecret: the client secret from your authorization provider.

  • Token Service URL: the virtual host (including protocol) mapped in the Cloud Connector to your provider’s token endpoint. (-http://internal-cloud-connector-url-example/oauth/token)

  • mail.smtp.port: the Cloud Connector’s virtual SMTP port.

  • mail.smtp.from: the sender address for outgoing emails.

  • mail.smtp.host: the Cloud Connector’s virtual host mapped to your internal email server.

  • authentication: OAuth2ClientCredentials

  • locationId: your cloud connector locationId

Manifest variables :

USE_CLOUD_CONNECTOR_FOR_SMTP_INTEGRATION=true CLOUD_CONNECTOR_DESTINATION_NAME_FOR_SMTP_INTEGRATION=<your destination name>
Now, email integration will use a cloud connector with XOAUTH2 to communicate with your local server.

2. Internet Flow (Azure Exchange)

If your email server is on the internet, you should only configure the appropriate destination in BTP 



Fill in the following properties:

  • ClientId: The client ID from your authorization provider. For Azure: <your Azure client ID>

  • ClientSecret: The client secret from your authorization provider. For Azure: <your Azure client secret>

  • Token Service URL: The auth token endpoint URL. For Azure: https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/token

  • mail.smtp.port: The provider authorization port, for Azure SMTP port (587).

  • mail.smtp.from: The sender address for outgoing emails. For Azure: <your sender email address>

  • mail.smtp.host: The provider authorization host, for Azure: smtp.office365.com

  • scope: The token scope—suggested for Azure: https://outlook.office365.com/.default

  • authentication: OAuth2ClientCredentials

Manifest variables :
USE_CLOUD_CONNECTOR_FOR_SMTP_INTEGRATION=false CLOUD_CONNECTOR_DESTINATION_NAME_FOR_SMTP_INTEGRATION=<your destination name> // in future releases will optimize the name for the internet