gmail/oauth fails with maxconnections > 1 in v8.0.3

[agoldst]

I upgraded offlineimap from v8.0.1 to v8.0.3 and was no longer able to sync with my gmail.com e-mail. It would fail with an authentication failure error (imap: Socket dead after XOAUTH2 failure, aborting remaining auth methods). I had maxconnections = 2 but when I change it to maxconnections = 1 (or run offlineimap with -d imap logging) it succeeds. I am able to separately get refresh and access tokens using an independent program (whhich is called via oauth2_refresh_token_eval for offlineimap).

Maybe it's kind of race condition somewhere when two threads try to do OAuth at the same time? I wonder if it has something to do with the change in #244 ? I don't know enough to trace exactly what's happening, but perhaps the answer will be obvious to the maintainers.

This is offlineimap 8.0.3, imaplib2 v3.06, Python v3.14.5, OpenSSL 3.6.2 7 Apr 2026; macOS 26.5, M1 MacBook Pro.

And thank you for this wonderful program.

[thekix]

Confirmed. I will check this issue ASAP.

[thekix]

Dear @agoldst could you test the testing branch now? I uploaded one patch for this issue.

[agoldst]

Thank you for the quick response. I am afraid I get the same error with the patched files. (I am too incompetent with python packaging to properly install the test version--I tried but got stymied with other errors) so I simply fetched the testing branch and copied the changed files into my existing offlineimap 8.0.3 installation. With maxconnections=2 the error message looks like

  File "/opt/homebrew/Cellar/offlineimap/8.0.3/libexec/lib/python3.14/site-packages/offlineimap/imapserver.py", line 623, in __authn_helper
    raise OfflineImapError("All authentication types "
                           "failed:\n\t%s" % msg, OfflineImapError.ERROR.REPO)
offlineimap.error.OfflineImapError: All authentication types failed:
	XOAUTH2: b'[AUTHENTICATIONFAILED] Invalid credentials (Failure)'


Last 15 debug messages logged for Folder Drafts [acc: gmail] prior to exception:
imap: Socket dead after XOAUTH2 failure, aborting remaining auth methods
imap: gmail-remote: level 'tls_compat', version 'tls1_2'
imap: Attempting XOAUTH2 authentication
imap: xoauth2handler: access_token "None expires 2026-06-12 16:17:41.880832"
imap: xoauth2handler: returning "user=<<SNIPPED EMAIL>>@gmail.comauth=Bearer None"

(I snipped out my actual gmail handle). It continues to work with maxconnections=1.

[thekix]

Hi @agoldst

I think I found the problem. Please, try this to test it:

git clone https://github.com/OfflineIMAP/offlineimap3.git
cd offlineimap3
git checkout testing
./offlineimap3.py

The first line will clone the repository. The second line moves inside the downloaded code. The third line change to the testing branch. The last file runs offlineimap.

I included more patches in the testing branch related to race conditions.

Thanks for your testing,
kix

[agoldst]

Hi, @thekix. Thanks so much for the new patch. I continue to get an error, but the stack trace looks a little different--so progress, maybe! The authentication failure now seems to happen when the second connection tries to confirm UIDVALIDITY for the first time: (my first two gmail folders alphabetically are called "Academic" and "Drafts," so "Drafts" is where problems start)

Thread 'Folder Drafts [acc: gmail]' terminated with exception:
Traceback (most recent call last):
  File "/opt/homebrew/Cellar/offlineimap/8.0.3/libexec/lib/python3.14/site-packages/offlineimap/threadutil.py", line 146, in run
    Thread.run(self)
    ~~~~~~~~~~^^^^^^
  File "/opt/homebrew/Cellar/python@3.14/3.14.5/Frameworks/Python.framework/Versions/3.14/lib/python3.14/threading.py", line 1024, in run
    self._target(*self._args, **self._kwargs)
    ~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/homebrew/Cellar/offlineimap/8.0.3/libexec/lib/python3.14/site-packages/offlineimap/accounts.py", line 687, in syncfolder
    check_uid_validity()
    ~~~~~~~~~~~~~~~~~~^^
  File "/opt/homebrew/Cellar/offlineimap/8.0.3/libexec/lib/python3.14/site-packages/offlineimap/accounts.py", line 533, in check_uid_validity
    remotefolder.save_uidvalidity()
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^
  File "/opt/homebrew/Cellar/offlineimap/8.0.3/libexec/lib/python3.14/site-packages/offlineimap/folder/Base.py", line 293, in save_uidvalidity
    newval = self.get_uidvalidity()
  File "/opt/homebrew/Cellar/offlineimap/8.0.3/libexec/lib/python3.14/site-packages/offlineimap/folder/IMAP.py", line 108, in get_uidvalidity
    imapobj = self.imapserver.acquireconnection()
  File "/opt/homebrew/Cellar/offlineimap/8.0.3/libexec/lib/python3.14/site-packages/offlineimap/imapserver.py", line 824, in acquireconnection
    self.__authn_helper(imapobj)
    ~~~~~~~~~~~~~~~~~~~^^^^^^^^^
  File "/opt/homebrew/Cellar/offlineimap/8.0.3/libexec/lib/python3.14/site-packages/offlineimap/imapserver.py", line 648, in __authn_helper
    raise err
offlineimap.error.OfflineImapError: All authentication types failed:
	XOAUTH2: b'[AUTHENTICATIONFAILED] Invalid credentials (Failure)'

(I still can't straightforwardly run offlineimap.py from the testing branch of the repository, because of a "sqlite isn't multi-thread safe" error. It seems homebrew patches that issue for me when I brew install offlineimap.)

Sorry for the trouble...race conditions are hard.

[agoldst]

Actually @thekix, looking back up at the error messages in my original issue, what is happening in IMAPServer.__xoauth2handler that is causing it to try None as an access token? I think it is this: in the case that self.oauth2_access_token_getter is None, there is no check for self.oauth2_access_token. If there is a stored access token, the local variable access_token_to_use should be set to it, but it never is. Instead the auth_string is returned with None as the access token value. In other words, I think you need an extra conditional in that method here:

-
-                if self.oauth2_access_token is None:
+                if self.oauth2_access_token:
+                    access_token_to_use = self.oauth2_access_token
+                else:
                      if self.oauth2_request_url is None:
                          raise OfflineImapError("No remote oauth2_request_url for "
                                                 "repository '%s' specified." %
                                                 self, OfflineImapError.ERROR.REPO)

that diff is with respect to the testing branch, but I made the equivalent change on master and it appears to succeed as well for my configuration. In my config it is indeed the case that I set oauth2_refresh_token_eval, not oauth2_access_token_eval.

So, I guess it was not exactly a race condition? Sorry for that bad suggestion. With only one connection allowed open, offlineimap never tried to use a stored access token, but with two it did. I'm not clear about how often a typical session tries to open connections. Also still unclear to me why it was succeeding when I enabled debugging.

Let me know what you think.

[thekix]

Hi @agoldst

I include this in the testing branch. You can test (using the previous clone) using:

cd offlineimap3
git checkout testing
git pull

Now is working?

Regards,
kix

[agoldst]

Thanks so much, @thekix. Yes, the testing branch at 201830d works for me with maxconnections = 2. Very pleased to have the fix for this issue.

[lucrocha]

Hi,
I'm seeing the same issue, the error says:

xoauth2handler: access_token "None expires 2026-06-22 16:37:38.873244"
xoauth2handler: returning "user=... auth=Bearer None"

As far as I could determine, the tokens were valid and not None, but probably masked when showing the error to the user.

From my own tests, it seems Google/GMail doesn't like it when an access token is reused between connections.
I "fixed" it on my side by not saving the returned access token, so it's not reused, but requested for every new connection.
i.e., replace line 315 in imapserver.py:

self.oauth2_access_token = resp['access_token']

With just:

access_token_to_use = resp['access_token']

[agoldst]

@lucrocha does the current testing branch not resolve your issue? I don't think there's a problem reusing a valid access token for gmail (but access tokens are very short-lived, maybe 15 mins--I could be wrong about all this, though; OAuth is confusing to me). My issue was that IMAPServer.__xoauth2handler didn't cover all cases with its nested conditionals (see thread above), and so access_token_to_use was just never assigned in my setup. Hence the error message with access_token "None...". With the changes made by @thekix up through 201830d this was fixed. I'd be interested to know if that doesn't address your issue...