innovaphone wiki - User contributions [en]

Reference15r1:PBX/Config/General

2026-08-07T08:03:59Z

Tsbodry: /* Common */ System wide Group is missing. Please insert a description and how2

== Configuration ==

=== Common ===

;PBX Mode: The PBX operating mode
:* '''Off''' - The PBX is disabled. After enabling the PBX a browser refresh is needed to activate additional PBX webpages.
:* '''Master''' - The PBX on this device acts as Master. Within a multisite installation exactly one PBX must be configured as Master.
:* '''Slave''' - The PBX on this device acts as Slave. Within a multisite installation several PBXes can be configured as Slave.
:* '''Standby''' - The PBX on this device acts as Standby for the Master. As long as the master is available, this PBX is not active, but just monitors the Master. If the Master is not available this PBX is active.
:* '''Standby-Slave''' - The PBX on this device acts as Standby for a Slave. As long as the slave is available, this PBX is not active, but just monitors the slave. If the slave is not available this PBX is active.

;System Name: The system Name. On all PBX within a multisite installation the same System Name must be configured. For H.323 endpoints this name is the gatekeeper identifier, for SIP endpoints it is the server name.

;Use as Domain: Uses the ''System Name'' as domain name, together with the name field in the user object the PBX constructs the email address (used for sending emails out ox myPBX). This mechanism is also used for Federation, to federate with other domains.

;PBX Name: The name of the PBX on this device. With this name a PBX is associated to a node. The field 'Name' (not Long Name) of a PBX Node object relates to this name.

;DNS: DNS Name of the PBX. If configured this will be used for myPBX redirects if a client tries to register at a PBX on which the user is not configured.

;Unknown Registrations: If this checkmark is set, the PBX accepts 'unknown' registrations. This means registrations with no matching object configured. If from an endpoint registered in this way a number of an object is dialed, which has no registration active and no 'HW-ID' configured the name used for the registration is configured as 'HW-ID' of this object. This is an easy way to deploy large numbers of phones.

:'''With PBX Pwd only:''' If checked only registrations with a PBX authentication or a verified certificate in case of H.323/TLS are accepted. In this case either "PBX Pwd" or "TLS only" is set in a device generated.

;Reverse Proxy Addresses: Up to 8 IP-Addresses (Mixed IPv4 and IPv6 allowed, but no DNS names) can be entered in this field, separated by comma. Registrations from one of these addresses are assumed to be routed through a Reverse Proxy. To the address '/<certificate name>' can be added to also check the TLS certificate of the Reverse Proxy. If the reverse proxy certificate is to be verified, the certificate or the issuer of the reverse proxy certificate must be trusted in the PBX. (If you use a SAN certificate you have to enter the first SAN-Name)
:Checking only on the certificate is also possible, by omitting the IP-address, eg '/*.domain.de'. Registrations sent with this certificate are considered to be coming over the Reverse Proxy.
:If empty addresses are used, unauthenticated registrations from unknown or internal addresses are not allowed, but any registration must be authenticated, with a password or the certificate from the reverse proxy.
; Assume TLS: If the ''Assume TLS'' checkmark is set, it is assumed, that the reverse Proxy did a successful check of the TLS certificate against the registration name.

;Media relay endpoint/Firewall public IP: For media relay endpoints (e.g. third party SIP phones) the public address of the firewall of the PBX network can be configured. This address is signaled in the SDP to received RTP from the phone. The firewall should have configured a port forwarding to the PBX or the TURN, for the RTP range of the PBX or TURN.

;Media relay endpoint/TURN: If this checkmark is set, the PBX allocates TURN endpoints for calls to or from media relay endpoints, which registerd thru the reverse proxy (e.g. third party SIP phones)

;IP address for App Platform
: The ip address of an App Platform can be configured here, with a DNS name used for it. If myApps uses a host to access the PBX different from the configured DNS name of the PBX, the hostname in any App url, which matches the configured AP DNS, is replaced by the AP IP. This way it is possible to configure a PBX with DNS names and access it with myApps when the DNS is not yet set up. If the checkmark ''Operation without DNS'' is set as well any matching DNS name is replaced also when an App service requests the URL of another App service (Example: Users requesting the URL of Devices for provisioning) and in the URL sent to the App services itself (Example: Devices uses this URL to construct the URL set at devices for the Devices registration).

: Note that this mode is intended to be able to run the PBX using DNS names while the DNS is not yet in place. Once the DNS is up and running, neither the DNS name of the AP nor its IP address should be configured here.

;Music On Hold URL: A URL for the Music On Hold. This file is read by the PBX using HTTP and sent to a held endpoint via RTP. The format of this URL is

:'''<nowiki>http://<addr>/<file>.$coder?coder=g711a,g711u,g722,g723,g729,opus-nb,opus-wb&repeat=true</nowiki>'''. <addr> is the IP address of the http server, no dns name is allowed here. <file> is the filename. $coder will be replaced by the actual coder used.

:Parameters: ''coder=g729,g711a,g711u,g723,opus-nb,opus-wb'' is the list of available coders. Only these coders must be specified for which a corresponding file exists. ''repeat=true'' should be specified in order to loop the file endlessly. ''random=true'' can be used to start the music on hold on a random point (this will work only if the URL is not local though).

:By default the built-in Music-On-Hold is played (Pseudo URL: "MOH?coder=g729,g711a,g723&repeat=true"). You can also play a dial tone (Pseudo URL "TONE") or a ring-back tone (Pseudo URL "TONE?tone=ringback").

:The maximum length of the URL is limited to 500 characters (bytes).

:If you configure a wrong (or invalid) URL then you will have silence as MOH. To prevent this situation when the MoH for some specific context/user(see below) is missing and silence is played instead of any MoH, an additional parameter ''fallback=true'' is available. If the file provided in the URL is missing (HTTP Error 404 Not Found is delivered by the HTTP Server) and the parameter ''fallback'' is provided, the default MoH will be played instead of silence. To use a custom file as fallback MoH, instead of default MoH, any file name can be provided with the ''fallback'' parameter: e.g. ''fallback=other_filename''. The file other_filename.g7xx must be placed in the same folder as a file provided with URL. A special filename ''fallback=ringback'' can be used to generate a ringback tone (equivalent to ''TONE?tone=ringback'') instead to play an alternative file.

:Within the URL %<id> can be used to put in some context information of the call. The information refers to the party which has put the receiving party on hold. For information about the receiving party itself, the id has to be preceded by '.' (e.g. '''.l''').

:'''l''' Long Name
:'''h''' Name (H.323 id)
:'''n''' Number
:'''N''' Node
:'''P''' PBX
:'''d''' Diverting Name
:'''#d''' Diverting Number

: See [[Howto:Dynamic_MOH]] for more details on how to use dynamic music on hold.

;External Music On Hold: To offload the device from playing the Music on hold, the Music On Hold can be played by a separate device. This device can register with a name configured here. To retrieve the Music On Hold a call is sent to this device. For each held endpoint a call is sent.

;Response Timeout: Global timeout (in seconds) after which any action for no response is taken (e.g. Call Forward on No Response). A timeout configured at any object overrides this value.

;Dial Complete Timeout: Global timeout (in seconds) after which any action for incomplete dialed number is taken (e.g. incomplete destination at trunk object).

;No. of Regs w/o Pwd: Number of registration without password authentication which are allowed per user. If 0 is configured no registration without password is possible.
Pls. note that registrations from 127.0.0.1 w/o password will be accepted anyway

;Security block time(s): Time for which a registration to a user is blocked after attempt with wrong password. Default is 20s. With a value of 0 this features is turned off.

;Recall Timeout: A value configured here enables recall after transfer. If a call is transferred and not answered within this time, the call is sent back to the transferring endpoint.

;Chat no Attachments: If checked, no file attachments are allowed in chats for any user

;Retries on busy (14s): Number of retries (Each attempt runs for 14 seconds) of blind transfer to a busy endpoint, before a recall back to the initiator is executed. During an attempt, the PBX waits to see if the target is free, and then delivers the call. The default value are 4-retries if the field is empty. If there is a 0 configured no further (in addition to the initial) will be executed. (This function depends on the ''Recall Timeout'' so the ''Recall Timeout'' must not be empty)

;Max Call Duration (h): Number of hours until a call with media is disconnected automatically. Affects all calls with initialized media channels signalled via PBX.

;Group Default Visibility: Defines additional visibility for active group members. These are added to the visibility rights derived from the [[{{NAMESPACE}}:PBX/Objects/Visibility | Visibility settings]] in user or template definitions. Note that changes made here only take effect after a re-registration.
'''System wide Groups'''

???
;Presence with Alert: Enable presentation of presence on phone upon alert. Setting applies for all PBX users.

;Enable External Transfer: Unless this checkbox is set any attempt to transfer an external call back to an external destination will result in disconnection of the call.

;No CLIR on Internal calls: If checked numbers are displayed even if received with presentation restricted. When sending a call presentation restricted can still be set and should be honored by a public network.

;Media Relay:
:;Off: No Media Relay is done in the PBX
:;On: All media traffic is routed through the PBX. With the '''No Media Relay if Addresses are identical or private''' checkmark, this is not done if the two call endpoints registration addresses are either private or equal (i.e. external endpoints behind the same NAT router). To identify an address as private the "Private Networks" configuration from ''IP4/General/Settings'' is used.
:;Auto: Media traffic is routed through the PBX if calls are between private and public registration addresses but not for calls between private and private or public and public registration addresses. To identify an address as private the "Private Networks" configuration from ''IP4/General/Settings'' is used. In v11 this was the behaviour if ''RTP Proxy'' was ''on''.
: Please note that when media relay is in effect for a call, '''video is not working'''. With ICE (available from v12r1), media relay in the PBX should be obsolete except for special applications. Check ''On'' or ''Auto'' only if you need to have this, since it creates CPU load on the PBX.

;Generate CDRs: If this checkbox is set, the PBX generates CDRs for all calls. For details, refer to the [[{{NAMESPACE}}:Concept_Call_Detail_Record_CDR_PBX|CDR description article]].

;Reverse Lookup URL
: A String in the LDAP URL Format according [https://tools.ietf.org/html/rfc2255 RFC2255] which will be used by the PBX to make a lookup for all external numbers.
: Number resolutions will be forwarded to internal applications like generated CDRs, Phone App etc..
: Example: ''ldaps://ap.innovaphone.com/dc=entries?givenname,sn,company?sub?(metaSearchNumber=+%n)?bindname=innovaphone.com\contacts''
:* dn: ''dc=entries''
:* attributes: ''givenname,sn,company''
:* scope: ''sub''
:* filter: ''(metaSearchNumber=+%n)''
:** %n is a placeholder for the given cgpn
:* extension: ''bindname=innovaphone.com\contacts''
:** The username for the authentication.
:'''Variables'''
:* %n - cgpn
:* %u - h323 name of the current object
:'''Password''': Password to authenticate access for the used ldap source. Leave empty if not required.
: Examples for use of different ldap directories are listed in the [[{{NAMESPACE}}:Concept_Number_Resolution_and_LDAP#PBX_Configuration|Concept Article]]

;Logo URL
:The URL to a customized logo image that will be displayed on the phones. Leave empty to keep the standard logo. The image size should be 220x150px or less with 24Bit color deep or less and an RGB range. The file format should be PNG or JPEG.

;Route Root-Node External Calls to: Destination object (Long Name) of Root-Node external calls. This configuration option is available on the Master or Standby PBX only. Any call which cannot be terminated inside the PBX is sent to this destination as long as neither the source nor the destination of the call can be associated with a node with a PBX configured. This object must be assigned to this PBX.
:'''For calls from local PBX only''': If set on a master, calls from a slave are not sent to this destination but sent back to the slave where the call came from. On the slave the call is then sent to a destination configured with 'Route Root-Node External Calls to'.

;Route PBX-Node External Calls to: Destination object (Long Name) of PBX-Node external calls. Any call which cannot be terminated inside the PBX is sent to this destination as long as the source nor the destination of the call can be associated with the node of this PBX. If a call is sent from or to an object defined inside the node of this PBX or in a node hierarchically below the node of this PBX the call is associated to the node of this PBX. This object must be assigned to this PBX, that is, it has to register to this PBX.

;Route Internal Calls to: Destination object (Long Name) to which any call is sent for which a PBX internal destination was found, except for those calls that originated from that object. This can be used to apply special routing on PBX internal calls.

;Escape Dialtone from: The PBX object (Long Name) to which a call is made to get a dialtone if a dialtone is configured for the escape of a node. As above, this object must be assigned to this PBX.

;Prefix for Intl/Ntl/Subscriber/Area-Code/Country-Code: Prefixes to be used to map International, National and Subscriber numbers.
:* '''International Prefix''' (<code>000</code> in Germany).
:* '''National Prefix''' (<code>00</code> in Germany).
:* '''Subscriber''' (in Germany, <code>0</code> is a commonly used trunk line access code).
::The SubscriberID is used for hotkey-actions within myAPPs-launcher. By use of node-objects, adjust the Subscriber Prefix in the respective [[{{NAMESPACE}}:PBX/Objects/Node#Number_Mapping_.28International.2C_National.2C_Subscriber_Prefix.29|node object number mapping]].
::For myPBX-launcher hotkeys, refer to the [[{{NAMESPACE}}:Phone/User/Directories#Dialing_location|dialing location settings]].

:* '''Area-Code''' (in Germany for example, the town Mannheim has area code <code>621</code>).
:* '''Country-Code''' (for Germany, <code>49</code> would be used)

: These settings resemble the same settings found in the [[{{NAMESPACE}}:PBX/Objects/Node | Node]] and [[{{NAMESPACE}}:PBX/Objects/PBX | PBX]] object. However, they apply to the ''root'' node instead (and should be consistent through all PBXs in a multi-PBX system).
'''Max. length internal number'''

In the phone and softphone App: If the number, witch is dialed is 7 digits or longer, the subscriber prefix is added. (A reset of the pbx and the myApps is needet after changes.)
;Adjust LDAP results for e.164: Add a "+" prefix to an PBX-internal LDAP-contact-search result. This is used for 3rd-party- and DECT-phones which are not able to benefit from the Dialing Location settings in case of LDAP-search in an E.164-setup. See also [[{{NAMESPACE}}:Concept_Number_Adjustments_%28Dialing_Location%29#PBX_database_used_as_LDAP_database|concept description]].

;Tones: The tones scheme to be used for PBX generated dialtones. This applies to dialtones generated for node prefixes, ringback on transfer and some more.

=== Slave PBX ===

If the PBX is operated in Slave mode, then the Slave PBX section is displayed

;Registration: The VOIP protocol used for the registration to the master. Possible choices are H.323, H.323/TCP or H.323/TLS.

;Master: The IP address of the PBX master

;License Only: If set, the PBX obtains license from master, but acts as master in all other respects.

;Alternate Master: The IP address of an alternative PBX master (standby, if available)

;Password: The password to be used for registration at the Master as configured in the corresponding PBX Object (The length of the password is limited to 16 characters)

;Master GK-ID: The System Name/Gatekeeper ID of the PBX Master were will register (Optional, usually used for DynPBX).

;Replication: This parameter allows you to select the replication style for the slave PBX: either ''All'' or ''Local'' (only users that need to be known in this PBX). For the replication process the [[Reference9:PBX/Config/Security|PBX Password]] is used which have to be the same password on all PBXes in the system.

;dyn PBX ID: This parameter allows to set replication from a specific DynPBX configured on the Master Device.

;Use local static User DB: A dynPBX has also this checkmark. The database of the main PBX is used, but be careful due to the increased memory usage. The dynPBX will create its own PBX datastructure which allocates memory.

;Route Master calls if no Master to: If the master is not available, master calls are sent to this destination. Destination has to be an object with active registration.

;Max Calls to Master/No Reroute: This parameter can be used to limit the calls to the master. If a call is sent to the master and there are already calls to/from the master equal to or exceeding this value, the call is rejected if '''No Reroute''' is set or is handled as if the master was not available otherwise.

;License Limits: Here we can set limit of licensing for this Slave PBX for Port, Mobility, Operator and Softwarephone.

For complete replication from master to slave, check also password in [[Reference9:PBX/Config/Security#PBX_password]]

=== Standby PBX ===

If the PBX is operated in Standby mode, then the Standby PBX section is displayed

;Master: The IP address of the PBX master

;Replicate from Master: Turns on full replication from the master PBX

;use TLS: Use LDAPS (TLS) instead of LDAP (TCP).

For complete replication from master to slave or standby, check also password in [[Reference9:PBX/Config/Security#PBX_password]]

Howto16r1:Configure OAuth2 E-Mail

2026-07-17T12:34:04Z

Tsbodry: /* Example Redirect URIs */ "Fax" case sensitive matters

The innovaphone PBX and apps can be configured to send E-Mails for various subjects and purposes. Major E-Mail providers intent to discontinue the username/password authentication schemes in favour of OAuth2. PBX and Apps version 16r1 does support OAuth2 authentication for SMTP. Here is a step by step guide how to set up OAuth2 support in Microsoft 365 through the Azure Portal and how to set it up on a Google Gmail account in the Google Cloud Console.

== General Information ==
Most of the large email providers offer the possibility to define an app that is allowed to gain access of a certain scope like SMTP. 
It assigns a Client ID / Client Secret. 
 
Authorization for sending from the mail account needs to be given one time either: 
* By providing resource owner username/password. Sending this to the token endpoint results in an access token and long term refresh token.
* By interactive authorization via a popup dialogue that is loaded from the authorization endpoint. After the credentials are verified, the dialogue redirects to the redirect URI with an authorization code that is traded to an access token and refresh token.
 
The access token is sent for authentication in SMTP. It needs regular refresh, which will be done automatically.

=== Modes ===

* '''Exchange''': Microsoft, with interactive authorization
* '''Microsoft 365''': Microsoft, without interactive authorization (Resource owner and password has to be filled)
* '''Gmail''': Google, with interactive authorization
* '''Google Service Account''': Google, without interactive authorization (Client e-mail, Private Key ID and Private Key of the service account must be provided)
* '''Client secret post''': Generic configuration where all parameters of the client secret post OAuth2 flow can be set.
* '''Private key jwt''': Generic configuration where all parameters of the private key jwt OAuth2 flow can be set.

=== Example Redirect URIs ===

* '''PBX''': <nowiki>https://example-pbx.domain.com/OAUTH2-CLIENT/auth.htm</nowiki>
* '''Reporting''': <nowiki>https://example-ap.domain.com/domain.com/reporting/auth.htm</nowiki>
* '''Fax''': <nowiki>https://example-ap.domain.com/domain.com/</nowiki>'''F'''ax/auth.htm
* '''Users''': <nowiki>https://example-ap.domain.com/domain.com/usersapp/auth.htm</nowiki>
* '''Connect''': <nowiki>https://example-ap.domain.com/domain.com/messages/auth.htm</nowiki>
* '''AP Manager''': <nowiki>https://example-ap.domain.com/manager/auth.htm</nowiki>

== Microsoft 365 ==
=== Azure Portal ===
Log in to Microsoft Azure Portal (https://portal.azure.com) and go to Microsoft Entra ID.
[[File:AzureMicrosoftEntraID.png|none|thumb|600x600px|/AzureMicrosoftEntraID.png|/AzureMicrosoftEntraID.png]]
Add a new app registration to create client credentials.
[[File:AzureAddAppRegistration.png|none|thumb|600x600px|/AzureAddAppRegistration.png|/AzureAddAppRegistration.png]]
Register the application and maybe already fill in the redirect URI for Web based application type to path OAUTH2-CLIENT/auth.htm at the PBX.
[[File:AzureRegisterAnApplication.png|none|thumb|600x600px|/AzureRegisterAnApplication.png|/AzureRegisterAnApplication.png]]
App registration is complete. Client ID and tenant needs to be configured at the PBX and every app that will be sending e-mails.
[[File:AzureApp.png|none|thumb|600x600px|/AzureApp.png|/AzureApp.png]]
Create a client secret. Note that expiry is limited to no longer than 2 years. The client secret must be renewed before expiry and the new secret configured and interactive authorisation carried out again to ensure continuous operation.
[[File:AzureAddClientSecret.png|none|thumb|600x600px|/AzureAddClientSecret.png|/AzureAddClientSecret.png]]
Copy the client secret. It also needs to be configured at the PBX and every app that will be sending e-mails.
[[File:AzureCopyClientSecret.png|none|thumb|600x600px|/AzureCopyClientSecret.png|/AzureCopyClientSecret.png]]
Add permissions located in APIs my organization uses.
[[File:AzureAddApiPermissionMyOrganization.png|none|thumb|600x600px|/AzureAddApiPermissionMyOrganization.png|/AzureAddApiPermissionMyOrganization.png]]
More precisely located in Office 365 Exchange Online.
[[File:AzureAddApiPermissionExchange.png|none|thumb|600x600px|/AzureAddApiPermissionExchange.png|/AzureAddApiPermissionExchange.png]]
And there in the application permissions.
[[File:AzureAddApiExchangeApplication.png|none|thumb|600x600px|/AzureAddApiExchangeApplication.png|/AzureAddApiExchangeApplication.png]]
Namely SMTP Mail.Send.
[[File:AzureAddApiSendMailAsUser.png|none|thumb|600x600px|/AzureAddApiSendMailAsUser.png|/AzureAddApiSendMailAsUser.png]]
Grant admin permission for Mail.Send.
[[File:AzureGrantApiPermissions.png|none|thumb|600x600px|/AzureGrantApiPermissions.png|/AzureGrantApiPermissions.png]]
API permissions are now granted.
[[File:AzureApiPermissionsGranted.png|none|thumb|600x600px|/AzureApiPermissionsGranted.png|/AzureApiPermissionsGranted.png]]
Tell all redirect URIs that the PBX and the apps will be using during interactive authorization.
[[File:AzureRedirectUris.png|none|thumb|600x600px|/AzureRedirectUris.png|/AzureRedirectUris.png]]
Allow public client flows of OAuth2. Resource Owner Password Credentials Flow has the advantage that it doesn't need interactive authorization.
[[File:AzureAllowPublicClientFlows.png|none|thumb|600x600px|/AzureAllowPublicClientFlows.png|/AzureAllowPublicClientFlows.png]]

=== Microsoft 365 admin center ===
Log in to the Microsoft 365 admin center (https://admin.cloud.microsoft).
[[File:MS365AdminCenter.png|none|thumb|600x600px|/MS365AdminCenter.png|/MS365AdminCenter.png]]
Make sure that Microsoft 365 licenses are assigned to your user.
[[File:MS365UserLicenses.png|none|thumb|600x600px|/MS365UserLicenses.png|/MS365UserLicenses.png]]
Set your user active.
[[File:MS365ActiveUsers.png|none|thumb|600x600px|/MS365ActiveUsers.png|/MS365ActiveUsers.png]]
Locate the Mail tab of your user.
[[File:MS365UserEMail.png|none|thumb|600x600px|/MS365UserEMail.png|/MS365UserEMail.png]]
Allow authenticated SMTP.
[[File:MS365AuthenticatedSMTP.png|none|thumb|600x600px|/MS365AuthenticatedSMTP.png|/MS365AuthenticatedSMTP.png]]

=== PBX Example configuration ===
With this Microsoft setup the OAuth2 configuration for the resource owner password credentials flow can be filled in as follows.
[[File:OAuth2ResourceOwnerPasswordCredentials.png|none|thumb|600x600px|/OAuth2ResourceOwnerPasswordCredentials.png|/OAuth2ResourceOwnerPasswordCredentials.png]]
For interactive authorization this is the OAuth2 configuration. Authorize e-mail access one time and send a test mail to verify everything went well.
[[File:OAuth2InteractiveAuthorization.png|none|thumb|600x600px|/OAuth2InteractiveAuthorization.png|/OAuth2InteractiveAuthorization.png]]

== Gmail ==
=== Preparations ===
Login to the Google Cloud Console (https://console.cloud.google.com), select a project, New project.
[[File:GoogleSelectProject.png|none|thumb|600x600px|/GoogleSelectProject.png|/GoogleSelectProject.png]]
Create the project.
[[File:GoogleCreateProject.png|none|thumb|600x600px|/GoogleCreateProject.png|/GoogleCreateProject.png]]
Client credentials will be created in this project.
[[File:GoogleProjectCreated.png|none|thumb|600x600px|/GoogleProjectCreated.png|/GoogleProjectCreated.png]]
From the library specify the APIs needed to access.
[[File:GoogleApisServicesFromLibrary.png|none|thumb|600x600px|/GoogleApisServicesFromLibrary.png|/GoogleApisServicesFromLibrary.png]]
These are in the Gmail API.
[[File:GoogleApisServicesApiLibrary.png|none|thumb|600x600px|/GoogleApisServicesApiLibrary.png|/GoogleApisServicesApiLibrary.png]]
Choose the Gmail API and enable it.
[[File:GoogleGmailApis.png|none|thumb|600x600px|/GoogleGmailApis.png|/GoogleGmailApis.png]]
Credentials need to be created.
[[File:GoogleGmailApiAdded.png|none|thumb|600x600px|/GoogleGmailApiAdded.png|/GoogleGmailApiAdded.png]]
Invoke the help me choose wizard.
[[File:GoogleCreateCredentialsHelpMeChoose.png|none|thumb|600x600px|/GoogleCreateCredentialsHelpMeChoose.png|/GoogleCreateCredentialsHelpMeChoose.png]]
User data access is needed.
[[File:GoogleCredentialsUserData.png|none|thumb|600x600px|/GoogleCredentialsUserData.png|/GoogleCredentialsUserData.png]]
Configure the consent screen of the interactive authorization.
[[File:GoogleOAuthConsentScreen.png|none|thumb|600x600px|/GoogleOAuthConsentScreen.png|/GoogleOAuthConsentScreen.png]]
Specify the permissions that need to be authorized by the user.
[[File:GoogleOAuthScopes.png|none|thumb|600x600px|/GoogleOAuthScopes.png|/GoogleOAuthScopes.png]]
Its mail.google.com in general.
[[File:GoogleScopeMailGoogleCom.png|none|thumb|600x600px|/GoogleScopeMailGoogleCom.png|/GoogleScopeMailGoogleCom.png]]
And its to send email on the users behalf.
[[File:GoogleScopeAuthGmailSend.png|none|thumb|600x600px|/GoogleScopeAuthGmailSend.png|/GoogleScopeAuthGmailSend.png]]
These are the scopes needed.
[[File:GoogleScopes.png|none|thumb|600x600px|/GoogleScopes.png|/GoogleScopes.png]]
Ask client credentials for Web type application.
[[File:GoogleOAuthClientID.png|none|thumb|600x600px|/GoogleOAuthClientID.png|/GoogleOAuthClientID.png]]
Tell all redirect URIs that the PBX and the apps will be using during interactive authorization.
[[File:GoogleRedirectURIs.png|none|thumb|600x600px|/GoogleRedirectURIs.png|/GoogleRedirectURIs.png]]
Download the credentials. This json file contains all information for OAuth2 configuration.
[[File:GoogleClientCredentialsDownload.png|none|thumb|600x600px|/GoogleClientCredentialsDownload.png|/GoogleClientCredentialsDownload.png]]
Customize the OAuth consent screen
[[File:GoogleOAuthConsentScreenSettings.png|none|thumb|600x600px|/GoogleOAuthConsentScreenSettings.png|/GoogleOAuthConsentScreenSettings.png]]
Start the customization wizard.
[[File:GoogleConsentScreenWizard.png|none|thumb|600x600px|/GoogleConsentScreenWizard.png|/GoogleConsentScreenWizard.png]]
Choose which users may authorize.
[[File:GoogleAudienceExternal.png|none|thumb|600x600px|/GoogleAudienceExternal.png|/GoogleAudienceExternal.png]]
Google workspace users may choose internal audience. Users not in Google workspace proceed with external.
[[File:GoogleContactInformation.png|none|thumb|600x600px|/GoogleContactInformation.png|/GoogleContactInformation.png]]
Add a test user.
[[File:GoogleTestUserAdded.png|none|thumb|600x600px|/GoogleTestUserAdded.png|/GoogleTestUserAdded.png]]

=== PBX Example configuration ===
The OAuth2 parameters can be filled in with the information from the json file downloaded above. Authorize e-mail access one time and send a test mail to verify everything went well.
[[File:OAuth2InteractiveGmail.png|none|thumb|600x600px|/OAuth2InteractiveGmail.png|/OAuth2InteractiveGmail.png]]

== Generic ==

For other e-mail providers the client secret post OAuth2 flow may be configured in a generic way. Details need to be supplied by the e-mail provider.

For the Microsoft 365 setup above it would be as follows with Token endpoint ''<nowiki>https://login.microsoftonline.com/af326a34-169c-469e-946b-1ef57925306b/oauth2/v2.0/token</nowiki>'' Authorization URL ''<nowiki>https://login.microsoftonline.com/af326a34-169c-469e-946b-1ef57925306b/oauth2/v2.0/authorize?scope=https://outlook.office.com/SMTP.Send</nowiki> offline_access'' The configuration appends ''&response_type=code&prompt=consent&login_hint=...&redirect_uri=...&client_id=...'' automatically.[[File:OAuth2ClientSecretPost.png|none|thumb|600x600px|/OAuth2ClientSecretPost.png|/OAuth2ClientSecretPost.png]]
For the Gmail example above the generic confguration would be like this with Token endpoint ''<nowiki>https://oauth2.googleapis.com/token</nowiki>'' Authorization URL ''<nowiki>https://accounts.google.com/o/oauth2/auth?access_type=offline&scope=https://mail.google.com/</nowiki>'' The configuration appends ''&response_type=code&prompt=consent&login_hint=...&redirect_uri=...&client_id=...'' automatically.
[[File:OAith2ClientSecretPostGmail.png|none|thumb|600x600px|/OAith2ClientSecretPostGmail.png|/OAith2ClientSecretPostGmail.png]]
The private key jwt OAuth2 flow can be configured generically as well.[[File:OAuth2PrivateKeyJWT.png|none|thumb|600x600px|/OAuth2PrivateKeyJWT.png|/OAuth2PrivateKeyJWT.png]]

== Related Articles ==
* [[Reference16r1:PBX/Config/Authentication]]
* [[Reference16r1:Apps/PbxManager/Email]]
* [[Reference16r1:Concept App Connect#E-Mail configuration]]
* [[Reference16r1:Concept App Service Fax&action=edit&redlink=1#Mail Configuration (SMTP Server)|Reference16r1:Concept App Service Fax#Mail Configuration (SMTP_Server)]]
* [[Reference16r1:Concept App Service Reports&action=edit&redlink=1#Configuration|Reference16r1:Concept App Service Reports#Configuration]]
* [[Reference16r1:Concept App Service Users#Users Admin App (innovaphone-usersadmin)]]
* [[Reference16r1:Concept App Platform#SMTP]]