DependencyTrack / DependencyTrack/dependency-track
Email integration should support OAuth2.0 authentication
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
Request:
Our organization relies on Dependency-Track for automated notifications via email. Currently, Dependency-Track only supports basic SMTP authentication (username and password). Due to Microsoft’s announcement to deprecate Basic Authentication for SMTP in September 2025, we are required to migrate to more secure/documented mail authentication methods—specifically OAuth 2.0 (modern authentication).
Questions:
Is there any native or planned support for OAuth 2.0 SMTP authentication in Dependency-Track?
If not, are there any recommended workarounds or community-vetted solutions for securely integrating Dependency-Track’s SMTP notifications with Microsoft 365 or other providers that enforce OAuth 2.0?
Are there plans on the roadmap to implement native OAuth 2.0 support for SMTP in future releases?
### Proposed Behavior
Dependency-Track should natively support SMTP authentication using OAuth 2.0 (modern authentication).
This would enable secure integration with Microsoft 365/Exchange Online and other providers who require OAuth 2.0 for SMTP, ensuring continued email notification delivery after the deprecation of basic authentication. Ideally, administrators should be able to configure OAuth 2.0 credentials (client ID, client secret, token endpoint, etc.) directly within the Dependency-Track SMTP notification settings.
### Checklist
- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested
Contributor guide
Assessment
This issue has not been assessed yet.