feat: added xoauth for smtp (#11239)

# Which Problems Are Solved

- Some mail providers (e.g.: MS Exchange) have deprecated plain auth

# How the Problems Are Solved

Adds XOauth2 auth option to SMPT
- SMTP config now can contain XOAuth2 auth config
- Proto files are updated to have a oneof for configuration selection.
Old fields for configuring plain auth are still available not to create
a breaking change. These can be removed in the future.
- Columns are added to the database to persist the config

# Additional Changes

none

# Additional Context

Replace this example with links to related issues, discussions, discord
threads, or other sources with more context.
Use the Closing #issue syntax for issues that are resolved with this PR.
- Closes #8042

---------

Co-authored-by: Copilot <[email protected]>
Co-authored-by: Tim Möhlmann <[email protected]>

internal/command/instance.go

@@ -520,6 +520,14 @@ func setupSMTPSettings(commands *Commands, validations *[]preparation.Validation
 	if smtpConfig == nil {
 		return
 	}
+	var username string
+	var pwd []byte
+	if smtpConfig.SMTP.PlainAuth != nil {
+		username = smtpConfig.SMTP.PlainAuth.User
+		if smtpConfig.SMTP.PlainAuth != nil {
+			pwd = []byte(smtpConfig.SMTP.PlainAuth.Password)
+		}
+	}
 	*validations = append(*validations,
 		commands.prepareAddAndActivateSMTPConfig(
 			instanceAgg,
@@ -528,8 +536,8 @@ func setupSMTPSettings(commands *Commands, validations *[]preparation.Validation
 			smtpConfig.FromName,
 			smtpConfig.ReplyToAddress,
 			smtpConfig.SMTP.Host,
-			smtpConfig.SMTP.User,
-			[]byte(smtpConfig.SMTP.Password),
+			username,
+			pwd,
 			smtpConfig.Tls,
 		),
 	)

internal/command/instance_smtp_config_model.go

@@ -2,6 +2,7 @@ package command
 
 import (
 	"context"
+	"slices"
 
 	"github.com/zitadel/zitadel/internal/crypto"
 	"github.com/zitadel/zitadel/internal/domain"
@@ -29,10 +30,11 @@ type SMTPConfig struct {
 	TLS            bool
 	Host           string
 	User           string
-	Password       *crypto.CryptoValue
 	SenderAddress  string
 	SenderName     string
 	ReplyToAddress string
+	PlainAuth      *instance.PlainAuth
+	XOAuth2Auth    *instance.XOAuth2Auth
 }
 
 func NewIAMSMTPConfigWriteModel(instanceID, id, domain string) *IAMSMTPConfigWriteModel {
@@ -85,7 +87,11 @@ func (wm *IAMSMTPConfigWriteModel) Reduce() error {
 				continue
 			}
 			if e.Password != nil {
-				wm.SMTPConfig.Password = e.Password
+				if wm.SMTPConfig.PlainAuth == nil {
+					wm.SMTPConfig.PlainAuth = &instance.PlainAuth{Password: e.Password}
+				} else {
+					wm.SMTPConfig.PlainAuth.Password = e.Password
+				}
 			}
 		case *instance.SMTPConfigHTTPAddedEvent:
 			if wm.ID != e.ID {
@@ -157,7 +163,19 @@ func (wm *IAMSMTPConfigWriteModel) Query() *eventstore.SearchQueryBuilder {
 		Builder()
 }
 
-func (wm *IAMSMTPConfigWriteModel) NewChangedEvent(ctx context.Context, aggregate *eventstore.Aggregate, id, description string, tls bool, fromAddress, fromName, replyToAddress, smtpHost, smtpUser string, smtpPassword *crypto.CryptoValue) (*instance.SMTPConfigChangedEvent, bool, error) {
+func (wm *IAMSMTPConfigWriteModel) NewChangedEvent(
+	ctx context.Context, aggregate *eventstore.Aggregate,
+	id,
+	description string,
+	tls bool,
+	fromAddress,
+	fromName,
+	replyToAddress,
+	smtpHost string,
+	smtpUser string,
+	plainAuth *instance.PlainAuth,
+	xoauth2Auth *instance.XOAuth2Auth,
+) (*instance.SMTPConfigChangedEvent, bool, error) {
 	changes := make([]instance.SMTPConfigChanges, 0)
 	var err error
 	if wm.SMTPConfig == nil {
@@ -188,9 +206,13 @@ func (wm *IAMSMTPConfigWriteModel) NewChangedEvent(ctx context.Context, aggregat
 	if wm.SMTPConfig.User != smtpUser {
 		changes = append(changes, instance.ChangeSMTPConfigSMTPUser(smtpUser))
 	}
-	if smtpPassword != nil {
-		changes = append(changes, instance.ChangeSMTPConfigSMTPPassword(smtpPassword))
+	if plainAuth != nil {
+		changes = append(changes, smtpPlainAuthChanges(wm.SMTPConfig.PlainAuth, *plainAuth)...)
 	}
+	if xoauth2Auth != nil {
+		changes = append(changes, smtpXOAuthChanges(wm.SMTPConfig.XOAuth2Auth, *xoauth2Auth)...)
+	}
+
 	if len(changes) == 0 {
 		return nil, false, nil
 	}
@@ -201,6 +223,77 @@ func (wm *IAMSMTPConfigWriteModel) NewChangedEvent(ctx context.Context, aggregat
 	return changeEvent, true, nil
 }
 
+func smtpPlainAuthChanges(wm *instance.PlainAuth, auth instance.PlainAuth) []instance.SMTPConfigChanges {
+	// if no auth is yet present, set both
+	if wm == nil {
+		return []instance.SMTPConfigChanges{
+			instance.ChangeSMTPConfigSMTPPassword(auth.Password),
+		}
+	}
+
+	// if auth is already present, add changes for the changed values
+	var changes []instance.SMTPConfigChanges
+
+	if auth.Password != nil {
+		changes = append(changes, instance.ChangeSMTPConfigSMTPPassword(auth.Password))
+	}
+
+	return changes
+}
+
+func smtpXOAuthChanges(wm *instance.XOAuth2Auth, auth instance.XOAuth2Auth) []instance.SMTPConfigChanges {
+	// if no auth is yet present, set all properties
+	if wm == nil {
+		return []instance.SMTPConfigChanges{
+			instance.ChangeSMTPConfigXOAuth2ClientCredentialsClientId(auth.ClientCredentials.ClientId),
+			instance.ChangeSMTPConfigXOAuth2ClientCredentialsClientSecret(auth.ClientCredentials.ClientSecret),
+			instance.ChangeSMTPConfigXOAuth2TokenEndpoint(auth.TokenEndpoint),
+			instance.ChangeSMTPConfigXOAuth2Scopes(auth.Scopes),
+		}
+	}
+
+	// if auth is already present, add changes for the changed values
+	var changes []instance.SMTPConfigChanges
+
+	if wm.TokenEndpoint != auth.TokenEndpoint {
+		changes = append(changes, instance.ChangeSMTPConfigXOAuth2TokenEndpoint(auth.TokenEndpoint))
+	}
+	if len(wm.Scopes) != len(auth.Scopes) {
+		changes = append(changes, instance.ChangeSMTPConfigXOAuth2Scopes(auth.Scopes))
+	} else {
+		for _, s := range auth.Scopes {
+			if !slices.Contains(wm.Scopes, s) {
+				changes = append(changes, instance.ChangeSMTPConfigXOAuth2Scopes(auth.Scopes))
+				break
+			}
+		}
+	}
+
+	if auth.ClientCredentials != nil {
+		changes = append(changes, smtpXOAuthClientCredentialChanges(auth.ClientCredentials, *auth.ClientCredentials)...)
+	}
+
+	return changes
+}
+
+func smtpXOAuthClientCredentialChanges(wm *instance.XOAuth2ClientCredentials, cc instance.XOAuth2ClientCredentials) []instance.SMTPConfigChanges {
+	if wm == nil {
+		return []instance.SMTPConfigChanges{
+			instance.ChangeSMTPConfigXOAuth2ClientCredentialsClientId(cc.ClientId),
+			instance.ChangeSMTPConfigXOAuth2ClientCredentialsClientSecret(cc.ClientSecret),
+		}
+	}
+
+	var changes []instance.SMTPConfigChanges
+	if wm.ClientId != cc.ClientId {
+		changes = append(changes, instance.ChangeSMTPConfigXOAuth2ClientCredentialsClientId(cc.ClientId))
+	}
+	if wm.ClientSecret != cc.ClientSecret {
+		changes = append(changes, instance.ChangeSMTPConfigXOAuth2ClientCredentialsClientSecret(cc.ClientSecret))
+	}
+	return changes
+}
+
 func (wm *IAMSMTPConfigWriteModel) NewHTTPChangedEvent(
 	ctx context.Context,
 	aggregate *eventstore.Aggregate,
@@ -242,11 +335,30 @@ func (wm *IAMSMTPConfigWriteModel) reduceSMTPConfigAddedEvent(e *instance.SMTPCo
 		TLS:            e.TLS,
 		Host:           e.Host,
 		User:           e.User,
-		Password:       e.Password,
 		SenderName:     e.SenderName,
 		SenderAddress:  e.SenderAddress,
 		ReplyToAddress: e.ReplyToAddress,
 	}
+
+	if e.PlainAuth != nil {
+		wm.SMTPConfig.PlainAuth = &instance.PlainAuth{
+			Password: e.PlainAuth.Password,
+		}
+	}
+	if e.XOAuth2Auth != nil {
+		wm.SMTPConfig.XOAuth2Auth = &instance.XOAuth2Auth{
+			TokenEndpoint: e.XOAuth2Auth.TokenEndpoint,
+			Scopes:        e.XOAuth2Auth.Scopes,
+		}
+
+		if e.XOAuth2Auth.ClientCredentials != nil {
+			wm.SMTPConfig.XOAuth2Auth.ClientCredentials = &instance.XOAuth2ClientCredentials{
+				ClientId:     e.XOAuth2Auth.ClientCredentials.ClientId,
+				ClientSecret: e.XOAuth2Auth.ClientCredentials.ClientSecret,
+			}
+		}
+	}
+
 	wm.State = domain.SMTPConfigStateInactive
 	// If ID has empty value we're dealing with the old and unique smtp settings
 	// These would be the default values for ID and State
@@ -290,9 +402,6 @@ func (wm *IAMSMTPConfigWriteModel) reduceSMTPConfigChangedEvent(e *instance.SMTP
 	if e.User != nil {
 		wm.SMTPConfig.User = *e.User
 	}
-	if e.Password != nil {
-		wm.SMTPConfig.Password = e.Password
-	}
 	if e.FromAddress != nil {
 		wm.SMTPConfig.SenderAddress = *e.FromAddress
 	}
@@ -303,6 +412,39 @@ func (wm *IAMSMTPConfigWriteModel) reduceSMTPConfigChangedEvent(e *instance.SMTP
 		wm.SMTPConfig.ReplyToAddress = *e.ReplyToAddress
 	}
 
+	if !e.PlainAuth.IsEmpty() {
+		if wm.SMTPConfig.PlainAuth == nil {
+			wm.SMTPConfig.PlainAuth = &instance.PlainAuth{}
+			wm.SMTPConfig.XOAuth2Auth = nil
+		}
+		if e.PlainAuth.Password != nil {
+			wm.SMTPConfig.PlainAuth.Password = e.PlainAuth.Password
+		} else if e.Password != nil {
+			wm.SMTPConfig.PlainAuth.Password = e.Password
+		}
+	}
+
+	if !e.XOAuth2Auth.IsEmpty() {
+		if wm.SMTPConfig.XOAuth2Auth == nil {
+			wm.SMTPConfig.XOAuth2Auth = &instance.XOAuth2Auth{}
+			wm.SMTPConfig.PlainAuth = nil
+		}
+		if e.XOAuth2Auth.TokenEndpoint != nil {
+			wm.SMTPConfig.XOAuth2Auth.TokenEndpoint = *e.XOAuth2Auth.TokenEndpoint
+		}
+		if e.XOAuth2Auth.Scopes != nil {
+			wm.SMTPConfig.XOAuth2Auth.Scopes = e.XOAuth2Auth.Scopes
+		}
+		if wm.SMTPConfig.XOAuth2Auth.ClientCredentials != nil && !e.XOAuth2Auth.ClientCredentials.IsEmpty() {
+			if e.XOAuth2Auth.ClientCredentials.ClientId != nil {
+				wm.SMTPConfig.XOAuth2Auth.ClientCredentials.ClientId = *e.XOAuth2Auth.ClientCredentials.ClientId
+			}
+			if e.XOAuth2Auth.ClientCredentials.ClientSecret != nil {
+				wm.SMTPConfig.XOAuth2Auth.ClientCredentials.ClientSecret = e.XOAuth2Auth.ClientCredentials.ClientSecret
+			}
+		}
+	}
+
 	// If ID has empty value we're dealing with the old and unique smtp settings
 	// These would be the default values for ID and State
 	if e.ID == "" {

internal/command/smtp.go

@@ -23,11 +23,25 @@ type AddSMTPConfig struct {
 	Description    string
 	Host           string
 	User           string
-	Password       string
 	Tls            bool
 	From           string
 	FromName       string
 	ReplyToAddress string
+	PlainAuth      *PlainAuth
+	XOAuth2Auth    *XOAuth2Auth
+}
+
+type PlainAuth struct {
+	Password string
+}
+type XOAuth2Auth struct {
+	TokenEndpoint         string
+	Scopes                []string
+	ClientCredentialsAuth *OAuth2ClientCredentials
+}
+type OAuth2ClientCredentials struct {
+	ClientId     string
+	ClientSecret string
 }
 
 func (c *Commands) AddSMTPConfig(ctx context.Context, config *AddSMTPConfig) (err error) {
@@ -55,14 +69,6 @@ func (c *Commands) AddSMTPConfig(ctx context.Context, config *AddSMTPConfig) (er
 		return zerrors.ThrowInvalidArgument(nil, "COMMAND-EvAtufIinh", "Errors.Invalid.Argument")
 	}
 
-	var smtpPassword *crypto.CryptoValue
-	if config.Password != "" {
-		smtpPassword, err = crypto.Encrypt([]byte(config.Password), c.smtpEncryption)
-		if err != nil {
-			return err
-		}
-	}
-
 	smtpConfigWriteModel, err := c.getSMTPConfig(ctx, config.ResourceOwner, config.ID, senderDomain)
 	if err != nil {
 		return err
@@ -73,6 +79,36 @@ func (c *Commands) AddSMTPConfig(ctx context.Context, config *AddSMTPConfig) (er
 		return err
 	}
 
+	var plainAuth *instance.PlainAuth
+	var xoauth2Auth *instance.XOAuth2Auth
+
+	if config.XOAuth2Auth != nil {
+		xoauth2Auth = &instance.XOAuth2Auth{
+			TokenEndpoint: config.XOAuth2Auth.TokenEndpoint,
+			Scopes:        config.XOAuth2Auth.Scopes,
+		}
+
+		if config.XOAuth2Auth.ClientCredentialsAuth != nil {
+			clientSecret, err := crypto.Encrypt([]byte(config.XOAuth2Auth.ClientCredentialsAuth.ClientSecret), c.smtpEncryption)
+			if err != nil {
+				return err
+			}
+			xoauth2Auth.ClientCredentials = &instance.XOAuth2ClientCredentials{
+				ClientId:     config.XOAuth2Auth.ClientCredentialsAuth.ClientId,
+				ClientSecret: clientSecret,
+			}
+		}
+	}
+	if config.PlainAuth != nil {
+		plainAuth = &instance.PlainAuth{}
+		if config.PlainAuth.Password != "" {
+			plainAuth.Password, err = crypto.Encrypt([]byte(config.PlainAuth.Password), c.smtpEncryption)
+			if err != nil {
+				return err
+			}
+		}
+	}
+
 	err = c.pushAppendAndReduce(ctx,
 		smtpConfigWriteModel,
 		instance.NewSMTPConfigAddedEvent(
@@ -86,12 +122,14 @@ func (c *Commands) AddSMTPConfig(ctx context.Context, config *AddSMTPConfig) (er
 			replyTo,
 			hostAndPort,
 			config.User,
-			smtpPassword,
+			plainAuth,
+			xoauth2Auth,
 		),
 	)
 	if err != nil {
 		return err
 	}
+
 	config.Details = writeModelToObjectDetails(&smtpConfigWriteModel.WriteModel)
 	return nil
 }
@@ -104,11 +142,12 @@ type ChangeSMTPConfig struct {
 	Description    string
 	Host           string
 	User           string
-	Password       string
 	Tls            bool
 	From           string
 	FromName       string
 	ReplyToAddress string
+	PlainAuth      *PlainAuth
+	XOAuth2Auth    *XOAuth2Auth
 }
 
 func (c *Commands) ChangeSMTPConfig(ctx context.Context, config *ChangeSMTPConfig) error {
@@ -132,15 +171,6 @@ func (c *Commands) ChangeSMTPConfig(ctx context.Context, config *ChangeSMTPConfi
 		return zerrors.ThrowInvalidArgument(nil, "COMMAND-kZNVkuL32L", "Errors.Invalid.Argument")
 	}
 
-	var smtpPassword *crypto.CryptoValue
-	var err error
-	if config.Password != "" {
-		smtpPassword, err = crypto.Encrypt([]byte(config.Password), c.smtpEncryption)
-		if err != nil {
-			return err
-		}
-	}
-
 	smtpConfigWriteModel, err := c.getSMTPConfig(ctx, config.ResourceOwner, config.ID, senderDomain)
 	if err != nil {
 		return err
@@ -155,6 +185,35 @@ func (c *Commands) ChangeSMTPConfig(ctx context.Context, config *ChangeSMTPConfi
 		return err
 	}
 
+	var plainAuth *instance.PlainAuth
+	var xoauth2Auth *instance.XOAuth2Auth
+
+	if config.PlainAuth != nil {
+		plainAuth = &instance.PlainAuth{}
+		if config.PlainAuth.Password != "" {
+			plainAuth.Password, err = crypto.Encrypt([]byte(config.PlainAuth.Password), c.smtpEncryption)
+			if err != nil {
+				return err
+			}
+		}
+	}
+	if config.XOAuth2Auth != nil {
+		xoauth2Auth = &instance.XOAuth2Auth{
+			TokenEndpoint: config.XOAuth2Auth.TokenEndpoint,
+			Scopes:        config.XOAuth2Auth.Scopes,
+		}
+		if config.XOAuth2Auth.ClientCredentialsAuth != nil {
+			xoauth2Auth.ClientCredentials = &instance.XOAuth2ClientCredentials{
+				ClientId: config.XOAuth2Auth.ClientCredentialsAuth.ClientId,
+			}
+			if config.XOAuth2Auth.ClientCredentialsAuth.ClientSecret != "" {
+				xoauth2Auth.ClientCredentials.ClientSecret, err = crypto.Encrypt([]byte(config.XOAuth2Auth.ClientCredentialsAuth.ClientSecret), c.smtpEncryption)
+				if err != nil {
+					return err
+				}
+			}
+		}
+	}
 	changedEvent, hasChanged, err := smtpConfigWriteModel.NewChangedEvent(
 		ctx,
 		InstanceAggregateFromWriteModel(&smtpConfigWriteModel.WriteModel),
@@ -166,7 +225,8 @@ func (c *Commands) ChangeSMTPConfig(ctx context.Context, config *ChangeSMTPConfi
 		replyTo,
 		hostAndPort,
 		config.User,
-		smtpPassword,
+		plainAuth,
+		xoauth2Auth,
 	)
 	if err != nil {
 		return err
@@ -430,34 +490,50 @@ func (c *Commands) RemoveSMTPConfig(ctx context.Context, resourceOwner, id strin
 }
 
 func (c *Commands) TestSMTPConfig(ctx context.Context, instanceID, id, email string, config *smtp.Config) error {
-	password := config.SMTP.Password
 
 	if email == "" {
 		return zerrors.ThrowInvalidArgument(nil, "SMTP-p9uy", "Errors.SMTPConfig.TestEmailNotFound")
 	}
 
-	if id == "" && password == "" {
+	if id == "" && config.SMTP.PlainAuth != nil && config.SMTP.PlainAuth.Password == "" {
 		return zerrors.ThrowInvalidArgument(nil, "SMTP-p9kj", "Errors.SMTPConfig.TestPassword")
 	}
 
-	// If the password is not sent it'd mean that the password hasn't been changed for
-	// the stored configuration identified by its id so we can try to retrieve it
-	if id != "" && password == "" {
+	if id == "" && config.SMTP.XOAuth2Auth != nil &&
+		config.SMTP.XOAuth2Auth.ClientCredentialsAuth != nil &&
+		config.SMTP.XOAuth2Auth.ClientCredentialsAuth.ClientSecret == "" {
+		return zerrors.ThrowInvalidArgument(nil, "SMTP-9OP96s", "Errors.SMTPConfig.TestClientSecret")
+	}
+
+	if config.SMTP.PlainAuth != nil && config.SMTP.PlainAuth.Password == "" {
 		smtpConfigWriteModel, err := c.getSMTPConfig(ctx, instanceID, id, "")
 		if err != nil {
 			return err
 		}
-		if !smtpConfigWriteModel.State.Exists() || smtpConfigWriteModel.SMTPConfig == nil {
+		if !smtpConfigWriteModel.State.Exists() || smtpConfigWriteModel.SMTPConfig == nil || smtpConfigWriteModel.SMTPConfig.PlainAuth == nil {
 			return zerrors.ThrowNotFound(nil, "SMTP-p9cc", "Errors.SMTPConfig.NotFound")
 		}
 
-		password, err = crypto.DecryptString(smtpConfigWriteModel.SMTPConfig.Password, c.smtpEncryption)
+		config.SMTP.PlainAuth.Password, err = crypto.DecryptString(smtpConfigWriteModel.SMTPConfig.PlainAuth.Password, c.smtpEncryption)
 		if err != nil {
 			return err
 		}
 	}
 
-	config.SMTP.Password = password
+	if config.SMTP.XOAuth2Auth != nil && config.SMTP.XOAuth2Auth.ClientCredentialsAuth != nil && config.SMTP.XOAuth2Auth.ClientCredentialsAuth.ClientSecret == "" {
+		smtpConfigWriteModel, err := c.getSMTPConfig(ctx, instanceID, id, "")
+		if err != nil {
+			return err
+		}
+		if !smtpConfigWriteModel.State.Exists() || smtpConfigWriteModel.SMTPConfig == nil || smtpConfigWriteModel.SMTPConfig.XOAuth2Auth == nil {
+			return zerrors.ThrowNotFound(nil, "SMTP-p9c2", "Errors.SMTPConfig.NotFound")
+		}
+
+		config.SMTP.XOAuth2Auth.ClientCredentialsAuth.ClientSecret, err = crypto.DecryptString(smtpConfigWriteModel.SMTPConfig.XOAuth2Auth.ClientCredentials.ClientSecret, c.smtpEncryption)
+		if err != nil {
+			return err
+		}
+	}
 
 	// Try to send an email
 	err := smtp.TestConfiguration(config, email)
@@ -486,9 +562,36 @@ func (c *Commands) TestSMTPConfigById(ctx context.Context, instanceID, id, email
 		return zerrors.ThrowNotFound(nil, "SMTP-99klw", "Errors.SMTPConfig.NotFound")
 	}
 
-	password, err := crypto.DecryptString(smtpConfigWriteModel.SMTPConfig.Password, c.smtpEncryption)
-	if err != nil {
-		return err
+	var plainAuth *smtp.PlainAuthConfig
+	var xoauth2Auth *smtp.XOAuth2AuthConfig
+
+	if smtpConfigWriteModel.SMTPConfig.PlainAuth != nil {
+		password, err := crypto.DecryptString(smtpConfigWriteModel.SMTPConfig.PlainAuth.Password, c.smtpEncryption)
+		if err != nil {
+			return err
+		}
+		plainAuth = &smtp.PlainAuthConfig{
+			User:     smtpConfigWriteModel.SMTPConfig.User,
+			Password: password,
+		}
+	}
+
+	if smtpConfigWriteModel.SMTPConfig.XOAuth2Auth != nil {
+		xoauth2Auth = &smtp.XOAuth2AuthConfig{
+			User:          smtpConfigWriteModel.SMTPConfig.User,
+			TokenEndpoint: smtpConfigWriteModel.SMTPConfig.XOAuth2Auth.TokenEndpoint,
+			Scopes:        smtpConfigWriteModel.SMTPConfig.XOAuth2Auth.Scopes,
+		}
+		if smtpConfigWriteModel.SMTPConfig.XOAuth2Auth.ClientCredentials != nil {
+			clientSecret, err := crypto.DecryptString(smtpConfigWriteModel.SMTPConfig.XOAuth2Auth.ClientCredentials.ClientSecret, c.smtpEncryption)
+			if err != nil {
+				return err
+			}
+			xoauth2Auth.ClientCredentialsAuth = &smtp.OAuth2ClientCredentials{
+				ClientId:     smtpConfigWriteModel.SMTPConfig.XOAuth2Auth.ClientCredentials.ClientId,
+				ClientSecret: clientSecret,
+			}
+		}
 	}
 
 	smtpConfig := &smtp.Config{
@@ -496,9 +599,9 @@ func (c *Commands) TestSMTPConfigById(ctx context.Context, instanceID, id, email
 		From:     smtpConfigWriteModel.SMTPConfig.SenderAddress,
 		FromName: smtpConfigWriteModel.SMTPConfig.SenderName,
 		SMTP: smtp.SMTP{
-			Host:     smtpConfigWriteModel.SMTPConfig.Host,
-			User:     smtpConfigWriteModel.SMTPConfig.User,
-			Password: password,
+			Host:        smtpConfigWriteModel.SMTPConfig.Host,
+			PlainAuth:   plainAuth,
+			XOAuth2Auth: xoauth2Auth,
 		},
 	}
 
@@ -582,7 +685,8 @@ func (c *Commands) prepareAddAndActivateSMTPConfig(a *instance.Aggregate, descri
 					replyTo,
 					hostAndPort,
 					user,
-					smtpPassword,
+					&instance.PlainAuth{Password: smtpPassword},
+					nil,
 				),
 				instance.NewSMTPConfigActivatedEvent(
 					ctx,

internal/command/smtp_test.go

@@ -78,7 +78,9 @@ func TestCommandSide_AddSMTPConfig(t *testing.T) {
 					From:          "[email protected]",
 					Host:          "host:587",
 					User:          "user",
-					Password:      "password",
+					PlainAuth: &PlainAuth{
+						Password: "password",
+					},
 				},
 			},
 			res: res{
@@ -136,12 +138,15 @@ func TestCommandSide_AddSMTPConfig(t *testing.T) {
 							"",
 							"host:587",
 							"user",
-							&crypto.CryptoValue{
-								CryptoType: crypto.TypeEncryption,
-								Algorithm:  "enc",
-								KeyID:      "id",
-								Crypted:    []byte("password"),
+							&instance.PlainAuth{
+								Password: &crypto.CryptoValue{
+									CryptoType: crypto.TypeEncryption,
+									Algorithm:  "enc",
+									KeyID:      "id",
+									Crypted:    []byte("password"),
+								},
 							},
+							nil,
 						),
 					),
 				),
@@ -157,7 +162,9 @@ func TestCommandSide_AddSMTPConfig(t *testing.T) {
 					FromName:      "name",
 					Host:          "host:587",
 					User:          "user",
-					Password:      "password",
+					PlainAuth: &PlainAuth{
+						Password: "password",
+					},
 				},
 			},
 			res: res{
@@ -197,12 +204,15 @@ func TestCommandSide_AddSMTPConfig(t *testing.T) {
 							"[email protected]",
 							"host:587",
 							"user",
-							&crypto.CryptoValue{
-								CryptoType: crypto.TypeEncryption,
-								Algorithm:  "enc",
-								KeyID:      "id",
-								Crypted:    []byte("password"),
+							&instance.PlainAuth{
+								Password: &crypto.CryptoValue{
+									CryptoType: crypto.TypeEncryption,
+									Algorithm:  "enc",
+									KeyID:      "id",
+									Crypted:    []byte("password"),
+								},
 							},
+							nil,
 						),
 					),
 				),
@@ -219,7 +229,9 @@ func TestCommandSide_AddSMTPConfig(t *testing.T) {
 					ReplyToAddress: "[email protected]",
 					Host:           "host:587",
 					User:           "user",
-					Password:       "password",
+					PlainAuth: &PlainAuth{
+						Password: "password",
+					},
 				},
 			},
 			res: res{
@@ -244,7 +256,9 @@ func TestCommandSide_AddSMTPConfig(t *testing.T) {
 					FromName:      "name",
 					Host:          "host",
 					User:          "user",
-					Password:      "password",
+					PlainAuth: &PlainAuth{
+						Password: "password",
+					},
 				},
 			},
 			res: res{
@@ -269,7 +283,9 @@ func TestCommandSide_AddSMTPConfig(t *testing.T) {
 					FromName:      "name",
 					Host:          "   ",
 					User:          "user",
-					Password:      "password",
+					PlainAuth: &PlainAuth{
+						Password: "password",
+					},
 				},
 			},
 			res: res{
@@ -309,12 +325,15 @@ func TestCommandSide_AddSMTPConfig(t *testing.T) {
 							"",
 							"[2001:db8::1]:2525",
 							"user",
-							&crypto.CryptoValue{
-								CryptoType: crypto.TypeEncryption,
-								Algorithm:  "enc",
-								KeyID:      "id",
-								Crypted:    []byte("password"),
+							&instance.PlainAuth{
+								Password: &crypto.CryptoValue{
+									CryptoType: crypto.TypeEncryption,
+									Algorithm:  "enc",
+									KeyID:      "id",
+									Crypted:    []byte("password"),
+								},
 							},
+							nil,
 						),
 					),
 				),
@@ -330,7 +349,200 @@ func TestCommandSide_AddSMTPConfig(t *testing.T) {
 					FromName:      "name",
 					Host:          "[2001:db8::1]:2525",
 					User:          "user",
-					Password:      "password",
+					PlainAuth: &PlainAuth{
+						Password: "password",
+					},
+				},
+			},
+			res: res{
+				want: &domain.ObjectDetails{
+					ResourceOwner: "INSTANCE",
+				},
+			},
+		},
+		{
+			name: "add smtp config with plain auth but no password, ok",
+			fields: fields{
+				eventstore: expectEventstore(
+					expectFilter(
+						eventFromEventPusher(
+							instance.NewDomainAddedEvent(context.Background(),
+								&instance.NewAggregate("INSTANCE").Aggregate,
+								"domain.ch",
+								false,
+							),
+						),
+						eventFromEventPusher(
+							instance.NewDomainPolicyAddedEvent(context.Background(),
+								&instance.NewAggregate("INSTANCE").Aggregate,
+								true, true, false,
+							),
+						),
+					),
+					expectPush(
+						instance.NewSMTPConfigAddedEvent(
+							context.Background(),
+							&instance.NewAggregate("INSTANCE").Aggregate,
+							"configid",
+							"test",
+							true,
+							"[email protected]",
+							"name",
+							"[email protected]",
+							"host:587",
+							"user",
+							&instance.PlainAuth{},
+							nil,
+						),
+					),
+				),
+				idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "configid"),
+				alg:         crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+			},
+			args: args{
+				smtp: &AddSMTPConfig{
+					ResourceOwner:  "INSTANCE",
+					Description:    "test",
+					Tls:            true,
+					From:           "[email protected]",
+					FromName:       "name",
+					ReplyToAddress: "[email protected]",
+					Host:           "host:587",
+					User:           "user",
+					PlainAuth:      &PlainAuth{},
+				},
+			},
+			res: res{
+				want: &domain.ObjectDetails{
+					ResourceOwner: "INSTANCE",
+				},
+			},
+		},
+		{
+			name: "add smtp config without auth, ok",
+			fields: fields{
+				eventstore: expectEventstore(
+					expectFilter(
+						eventFromEventPusher(
+							instance.NewDomainAddedEvent(context.Background(),
+								&instance.NewAggregate("INSTANCE").Aggregate,
+								"domain.ch",
+								false,
+							),
+						),
+						eventFromEventPusher(
+							instance.NewDomainPolicyAddedEvent(context.Background(),
+								&instance.NewAggregate("INSTANCE").Aggregate,
+								true, true, false,
+							),
+						),
+					),
+					expectPush(
+						instance.NewSMTPConfigAddedEvent(
+							context.Background(),
+							&instance.NewAggregate("INSTANCE").Aggregate,
+							"configid",
+							"test",
+							true,
+							"[email protected]",
+							"name",
+							"[email protected]",
+							"host:587",
+							"",
+							nil,
+							nil,
+						),
+					),
+				),
+				idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "configid"),
+				alg:         crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+			},
+			args: args{
+				smtp: &AddSMTPConfig{
+					ResourceOwner:  "INSTANCE",
+					Description:    "test",
+					Tls:            true,
+					From:           "[email protected]",
+					FromName:       "name",
+					ReplyToAddress: "[email protected]",
+					Host:           "host:587",
+				},
+			},
+			res: res{
+				want: &domain.ObjectDetails{
+					ResourceOwner: "INSTANCE",
+				},
+			},
+		},
+		{
+			name: "add smtp config with xoauth2 auth, ok",
+			fields: fields{
+				eventstore: expectEventstore(
+					expectFilter(
+						eventFromEventPusher(
+							instance.NewDomainAddedEvent(context.Background(),
+								&instance.NewAggregate("INSTANCE").Aggregate,
+								"domain.ch",
+								false,
+							),
+						),
+						eventFromEventPusher(
+							instance.NewDomainPolicyAddedEvent(context.Background(),
+								&instance.NewAggregate("INSTANCE").Aggregate,
+								true, true, false,
+							),
+						),
+					),
+					expectPush(
+						instance.NewSMTPConfigAddedEvent(
+							context.Background(),
+							&instance.NewAggregate("INSTANCE").Aggregate,
+							"configid",
+							"test",
+							true,
+							"[email protected]",
+							"name",
+							"[email protected]",
+							"host:587",
+							"user",
+							nil,
+							&instance.XOAuth2Auth{
+								TokenEndpoint: "auth.example.com/token",
+								Scopes:        []string{"scope"},
+								ClientCredentials: &instance.XOAuth2ClientCredentials{
+									ClientId: "client-id",
+									ClientSecret: &crypto.CryptoValue{
+										CryptoType: crypto.TypeEncryption,
+										Algorithm:  "enc",
+										KeyID:      "id",
+										Crypted:    []byte("password"),
+									},
+								},
+							},
+						),
+					),
+				),
+				idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "configid"),
+				alg:         crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+			},
+			args: args{
+				smtp: &AddSMTPConfig{
+					ResourceOwner:  "INSTANCE",
+					Description:    "test",
+					Tls:            true,
+					From:           "[email protected]",
+					FromName:       "name",
+					ReplyToAddress: "[email protected]",
+					Host:           "host:587",
+					User:           "user",
+					XOAuth2Auth: &XOAuth2Auth{
+						TokenEndpoint: "auth.example.com/token",
+						Scopes:        []string{"scope"},
+						ClientCredentialsAuth: &OAuth2ClientCredentials{
+							ClientId:     "client-id",
+							ClientSecret: "password",
+						},
+					},
 				},
 			},
 			res: res{
@@ -365,6 +577,7 @@ func TestCommandSide_AddSMTPConfig(t *testing.T) {
 func TestCommandSide_ChangeSMTPConfig(t *testing.T) {
 	type fields struct {
 		eventstore func(t *testing.T) *eventstore.Eventstore
+		alg        crypto.EncryptionAlgorithm
 	}
 	type args struct {
 		smtp *ChangeSMTPConfig
@@ -443,6 +656,7 @@ func TestCommandSide_ChangeSMTPConfig(t *testing.T) {
 					FromName:      "name",
 					Host:          "host:587",
 					User:          "user",
+					PlainAuth:     &PlainAuth{},
 				},
 			},
 			res: res{
@@ -481,7 +695,10 @@ func TestCommandSide_ChangeSMTPConfig(t *testing.T) {
 								"",
 								"host:587",
 								"user",
-								&crypto.CryptoValue{},
+								&instance.PlainAuth{
+									Password: &crypto.CryptoValue{},
+								},
+								nil,
 							),
 						),
 					),
@@ -497,6 +714,7 @@ func TestCommandSide_ChangeSMTPConfig(t *testing.T) {
 					FromName:      "name",
 					Host:          "host:587",
 					User:          "user",
+					PlainAuth:     &PlainAuth{},
 				},
 			},
 			res: res{
@@ -533,7 +751,10 @@ func TestCommandSide_ChangeSMTPConfig(t *testing.T) {
 								"",
 								"host:587",
 								"user",
-								&crypto.CryptoValue{},
+								&instance.PlainAuth{
+									Password: &crypto.CryptoValue{},
+								},
+								nil,
 							),
 						),
 					),
@@ -549,6 +770,7 @@ func TestCommandSide_ChangeSMTPConfig(t *testing.T) {
 					FromName:      "name",
 					Host:          "host:587",
 					User:          "user",
+					PlainAuth:     &PlainAuth{},
 				},
 			},
 			res: res{
@@ -587,7 +809,10 @@ func TestCommandSide_ChangeSMTPConfig(t *testing.T) {
 								"",
 								"host:587",
 								"user",
-								&crypto.CryptoValue{},
+								&instance.PlainAuth{
+									Password: &crypto.CryptoValue{},
+								},
+								nil,
 							),
 						),
 					),
@@ -602,6 +827,8 @@ func TestCommandSide_ChangeSMTPConfig(t *testing.T) {
 							"[email protected]",
 							"host2:587",
 							"user2",
+							&instance.PlainAuth{},
+							nil,
 						),
 					),
 				),
@@ -617,6 +844,7 @@ func TestCommandSide_ChangeSMTPConfig(t *testing.T) {
 					ReplyToAddress: "[email protected]",
 					Host:           "host2:587",
 					User:           "user2",
+					PlainAuth:      &PlainAuth{},
 				},
 			},
 			res: res{
@@ -640,7 +868,9 @@ func TestCommandSide_ChangeSMTPConfig(t *testing.T) {
 					FromName:      "name",
 					Host:          "host",
 					User:          "user",
-					Password:      "password",
+					PlainAuth: &PlainAuth{
+						Password: "password",
+					},
 				},
 			},
 			res: res{
@@ -664,7 +894,9 @@ func TestCommandSide_ChangeSMTPConfig(t *testing.T) {
 					FromName:      "name",
 					Host:          "   ",
 					User:          "user",
-					Password:      "password",
+					PlainAuth: &PlainAuth{
+						Password: "password",
+					},
 				},
 			},
 			res: res{
@@ -703,7 +935,10 @@ func TestCommandSide_ChangeSMTPConfig(t *testing.T) {
 								"",
 								"host:587",
 								"user",
-								&crypto.CryptoValue{},
+								&instance.PlainAuth{
+									Password: &crypto.CryptoValue{},
+								},
+								nil,
 							),
 						),
 					),
@@ -718,6 +953,8 @@ func TestCommandSide_ChangeSMTPConfig(t *testing.T) {
 							"[email protected]",
 							"[2001:db8::1]:2525",
 							"user2",
+							&instance.PlainAuth{},
+							nil,
 						),
 					),
 				),
@@ -733,6 +970,193 @@ func TestCommandSide_ChangeSMTPConfig(t *testing.T) {
 					ReplyToAddress: "[email protected]",
 					Host:           "[2001:db8::1]:2525",
 					User:           "user2",
+					PlainAuth:      &PlainAuth{},
+				},
+			},
+			res: res{
+				want: &domain.ObjectDetails{
+					ResourceOwner: "INSTANCE",
+				},
+			},
+		},
+		{
+			name: "change auth from plain to xoauth2, ok",
+			fields: fields{
+				eventstore: expectEventstore(
+					expectFilter(
+						eventFromEventPusher(
+							instance.NewDomainAddedEvent(context.Background(),
+								&instance.NewAggregate("INSTANCE").Aggregate,
+								"domain.ch",
+								false,
+							),
+						),
+						eventFromEventPusher(
+							instance.NewDomainPolicyAddedEvent(context.Background(),
+								&instance.NewAggregate("INSTANCE").Aggregate,
+								true, true, true,
+							),
+						),
+						eventFromEventPusher(
+							instance.NewSMTPConfigAddedEvent(
+								context.Background(),
+								&instance.NewAggregate("INSTANCE").Aggregate,
+								"ID",
+								"",
+								true,
+								"[email protected]",
+								"name",
+								"",
+								"host:587",
+								"user",
+								&instance.PlainAuth{},
+								nil,
+							),
+						),
+					),
+					expectPush(
+						newSMTPConfigChangedEvent(
+							context.Background(),
+							"ID",
+							"test",
+							false,
+							"[email protected]",
+							"name2",
+							"[email protected]",
+							"host2:587",
+							"user2",
+							nil,
+							&instance.XOAuth2Auth{
+								TokenEndpoint: "auth.example.com/token",
+								Scopes:        []string{"scope"},
+								ClientCredentials: &instance.XOAuth2ClientCredentials{
+									ClientId: "client-id",
+									ClientSecret: &crypto.CryptoValue{
+										CryptoType: crypto.TypeEncryption,
+										Algorithm:  "enc",
+										KeyID:      "id",
+										Crypted:    []byte("password"),
+									},
+								},
+							},
+						),
+					),
+				),
+				alg: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+			},
+			args: args{
+				smtp: &ChangeSMTPConfig{
+					ResourceOwner:  "INSTANCE",
+					ID:             "ID",
+					Description:    "test",
+					Tls:            false,
+					From:           "[email protected]",
+					FromName:       "name2",
+					ReplyToAddress: "[email protected]",
+					Host:           "host2:587",
+					User:           "user2",
+					XOAuth2Auth: &XOAuth2Auth{
+						TokenEndpoint: "auth.example.com/token",
+						Scopes:        []string{"scope"},
+						ClientCredentialsAuth: &OAuth2ClientCredentials{
+							ClientId:     "client-id",
+							ClientSecret: "password",
+						},
+					},
+				},
+			},
+			res: res{
+				want: &domain.ObjectDetails{
+					ResourceOwner: "INSTANCE",
+				},
+			},
+		},
+		{
+			name: "change auth from xoauth2 to plain, ok",
+			fields: fields{
+				eventstore: expectEventstore(
+					expectFilter(
+						eventFromEventPusher(
+							instance.NewDomainAddedEvent(context.Background(),
+								&instance.NewAggregate("INSTANCE").Aggregate,
+								"domain.ch",
+								false,
+							),
+						),
+						eventFromEventPusher(
+							instance.NewDomainPolicyAddedEvent(context.Background(),
+								&instance.NewAggregate("INSTANCE").Aggregate,
+								true, true, true,
+							),
+						),
+						eventFromEventPusher(
+							instance.NewSMTPConfigAddedEvent(
+								context.Background(),
+								&instance.NewAggregate("INSTANCE").Aggregate,
+								"ID",
+								"",
+								true,
+								"[email protected]",
+								"name",
+								"",
+								"host:587",
+								"user2",
+								nil,
+								&instance.XOAuth2Auth{
+									TokenEndpoint: "auth.example.com/token",
+									Scopes:        []string{"scope"},
+									ClientCredentials: &instance.XOAuth2ClientCredentials{
+										ClientId: "client-id",
+										ClientSecret: &crypto.CryptoValue{
+											CryptoType: crypto.TypeEncryption,
+											Algorithm:  "enc",
+											KeyID:      "id",
+											Crypted:    []byte("client-secret"),
+										},
+									},
+								},
+							),
+						),
+					),
+					expectPush(
+						newSMTPConfigChangedEvent(
+							context.Background(),
+							"ID",
+							"test",
+							false,
+							"[email protected]",
+							"name2",
+							"[email protected]",
+							"host2:587",
+							"user",
+							&instance.PlainAuth{
+								Password: &crypto.CryptoValue{
+									CryptoType: crypto.TypeEncryption,
+									Algorithm:  "enc",
+									KeyID:      "id",
+									Crypted:    []byte("password"),
+								},
+							},
+							nil,
+						),
+					),
+				),
+				alg: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+			},
+			args: args{
+				smtp: &ChangeSMTPConfig{
+					ResourceOwner:  "INSTANCE",
+					ID:             "ID",
+					Description:    "test",
+					Tls:            false,
+					From:           "[email protected]",
+					FromName:       "name2",
+					ReplyToAddress: "[email protected]",
+					Host:           "host2:587",
+					User:           "user",
+					PlainAuth: &PlainAuth{
+						Password: "password",
+					},
 				},
 			},
 			res: res{
@@ -745,7 +1169,8 @@ func TestCommandSide_ChangeSMTPConfig(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			r := &Commands{
-				eventstore: tt.fields.eventstore(t),
+				eventstore:     tt.fields.eventstore(t),
+				smtpEncryption: tt.fields.alg,
 			}
 			err := r.ChangeSMTPConfig(context.Background(), tt.args.smtp)
 			if tt.res.err == nil {
@@ -842,7 +1267,10 @@ func TestCommandSide_ChangeSMTPConfigPassword(t *testing.T) {
 								"",
 								"host:587",
 								"user",
-								&crypto.CryptoValue{},
+								&instance.PlainAuth{
+									Password: &crypto.CryptoValue{},
+								},
+								nil,
 							),
 						),
 						eventFromEventPusher(
@@ -1261,7 +1689,10 @@ func TestCommandSide_ActivateSMTPConfig(t *testing.T) {
 								"",
 								"host:587",
 								"user",
-								&crypto.CryptoValue{},
+								&instance.PlainAuth{
+									Password: &crypto.CryptoValue{},
+								},
+								nil,
 							),
 						),
 					),
@@ -1302,7 +1733,10 @@ func TestCommandSide_ActivateSMTPConfig(t *testing.T) {
 								"",
 								"host:587",
 								"user",
-								&crypto.CryptoValue{},
+								&instance.PlainAuth{
+									Password: &crypto.CryptoValue{},
+								},
+								nil,
 							),
 						),
 						eventFromEventPusher(
@@ -1466,7 +1900,10 @@ func TestCommandSide_DeactivateSMTPConfig(t *testing.T) {
 								"",
 								"host:587",
 								"user",
-								&crypto.CryptoValue{},
+								&instance.PlainAuth{
+									Password: &crypto.CryptoValue{},
+								},
+								nil,
 							),
 						),
 						eventFromEventPusher(
@@ -1513,7 +1950,10 @@ func TestCommandSide_DeactivateSMTPConfig(t *testing.T) {
 								"",
 								"host:587",
 								"user",
-								&crypto.CryptoValue{},
+								&instance.PlainAuth{
+									Password: &crypto.CryptoValue{},
+								},
+								nil,
 							),
 						),
 						eventFromEventPusher(
@@ -1692,7 +2132,10 @@ func TestCommandSide_RemoveSMTPConfig(t *testing.T) {
 								"",
 								"host:587",
 								"user",
-								&crypto.CryptoValue{},
+								&instance.PlainAuth{
+									Password: &crypto.CryptoValue{},
+								},
+								nil,
 							),
 						),
 					),
@@ -1837,9 +2280,11 @@ func TestCommandSide_TestSMTPConfig(t *testing.T) {
 					From:     "test@example,com",
 					FromName: "Test",
 					SMTP: smtp.SMTP{
-						User:     "user",
-						Password: "",
-						Host:     "example.com:2525",
+						PlainAuth: &smtp.PlainAuthConfig{
+							User:     "user",
+							Password: "",
+						},
+						Host: "example.com:2525",
 					},
 				},
 			},
@@ -1863,9 +2308,11 @@ func TestCommandSide_TestSMTPConfig(t *testing.T) {
 					From:     "test@example,com",
 					FromName: "Test",
 					SMTP: smtp.SMTP{
-						User:     "user",
-						Password: "",
-						Host:     "example.com:2525",
+						PlainAuth: &smtp.PlainAuthConfig{
+							User:     "user",
+							Password: "",
+						},
+						Host: "example.com:2525",
 					},
 				},
 			},
@@ -1874,7 +2321,7 @@ func TestCommandSide_TestSMTPConfig(t *testing.T) {
 			},
 		},
 		{
-			name: "valid new smtp config, wrong auth, ok",
+			name: "valid new smtp config, wrong plain auth, ok",
 			fields: fields{
 				eventstore: expectEventstore(),
 				alg:        crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
@@ -1887,9 +2334,11 @@ func TestCommandSide_TestSMTPConfig(t *testing.T) {
 					From:     "[email protected]",
 					FromName: "Test",
 					SMTP: smtp.SMTP{
-						User:     "user",
-						Password: "password",
-						Host:     "mail.smtp2go.com:2525",
+						PlainAuth: &smtp.PlainAuthConfig{
+							User:     "user",
+							Password: "password",
+						},
+						Host: "mail.smtp2go.com:2525",
 					},
 				},
 			},
@@ -1914,11 +2363,103 @@ func TestCommandSide_TestSMTPConfig(t *testing.T) {
 								"",
 								"mail.smtp2go.com:2525",
 								"user",
-								&crypto.CryptoValue{
-									CryptoType: crypto.TypeEncryption,
-									Algorithm:  "enc",
-									KeyID:      "id",
-									Crypted:    []byte("password"),
+								&instance.PlainAuth{
+									Password: &crypto.CryptoValue{
+										CryptoType: crypto.TypeEncryption,
+										Algorithm:  "enc",
+										KeyID:      "id",
+										Crypted:    []byte("password"),
+									},
+								},
+								nil,
+							),
+						),
+					),
+				),
+				alg: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+			},
+			args: args{
+				ctx:        context.Background(),
+				instanceID: "INSTANCE",
+				email:      "email",
+				id:         "ID",
+				config: smtp.Config{
+					From:     "[email protected]",
+					FromName: "Test",
+					SMTP: smtp.SMTP{
+						PlainAuth: &smtp.PlainAuthConfig{
+							User:     "user",
+							Password: "",
+						},
+						Host: "mail.smtp2go.com:2525",
+					},
+				},
+			},
+			res: res{
+				err: zerrors.IsInternal,
+			},
+		},
+		{
+			name: "valid new smtp config, wrong xoauth2 auth, ok",
+			fields: fields{
+				eventstore: expectEventstore(),
+				alg:        crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+			},
+			args: args{
+				ctx:        context.Background(),
+				instanceID: "INSTANCE",
+				email:      "email",
+				config: smtp.Config{
+					From:     "[email protected]",
+					FromName: "Test",
+					SMTP: smtp.SMTP{
+						XOAuth2Auth: &smtp.XOAuth2AuthConfig{
+							User:          "user",
+							TokenEndpoint: "auth.example.com/token",
+							Scopes:        []string{"scope"},
+							ClientCredentialsAuth: &smtp.OAuth2ClientCredentials{
+								ClientId:     "client-id",
+								ClientSecret: "client-secret",
+							},
+						},
+						Host: "mail.smtp2go.com:2525",
+					},
+				},
+			},
+			res: res{
+				err: zerrors.IsInternal,
+			},
+		},
+		{
+			name: "valid smtp config using stored password, wrong auth, ok",
+			fields: fields{
+				eventstore: expectEventstore(
+					expectFilter(
+						eventFromEventPusher(
+							instance.NewSMTPConfigAddedEvent(
+								context.Background(),
+								&instance.NewAggregate("INSTANCE").Aggregate,
+								"ID",
+								"test",
+								true,
+								"from",
+								"name",
+								"",
+								"mail.smtp2go.com:2525",
+								"user",
+								nil,
+								&instance.XOAuth2Auth{
+									TokenEndpoint: "auth.example.com/token",
+									Scopes:        []string{"scope"},
+									ClientCredentials: &instance.XOAuth2ClientCredentials{
+										ClientId: "client-id",
+										ClientSecret: &crypto.CryptoValue{
+											CryptoType: crypto.TypeEncryption,
+											Algorithm:  "enc",
+											KeyID:      "id",
+											Crypted:    []byte("password"),
+										},
+									},
 								},
 							),
 						),
@@ -1935,9 +2476,15 @@ func TestCommandSide_TestSMTPConfig(t *testing.T) {
 					From:     "[email protected]",
 					FromName: "Test",
 					SMTP: smtp.SMTP{
-						User:     "user",
-						Password: "",
-						Host:     "mail.smtp2go.com:2525",
+						XOAuth2Auth: &smtp.XOAuth2AuthConfig{
+							User:          "user",
+							TokenEndpoint: "auth.example.com/token",
+							Scopes:        []string{"scope"},
+							ClientCredentialsAuth: &smtp.OAuth2ClientCredentials{
+								ClientId: "client-id",
+							},
+						},
+						Host: "mail.smtp2go.com:2525",
 					},
 				},
 			},
@@ -2032,7 +2579,7 @@ func TestCommandSide_TestSMTPConfigById(t *testing.T) {
 			},
 		},
 		{
-			name: "valid smtp config, wrong auth, ok",
+			name: "valid smtp config, wrong plain auth, ok",
 			fields: fields{
 				eventstore: eventstoreExpect(
 					t,
@@ -2049,11 +2596,62 @@ func TestCommandSide_TestSMTPConfigById(t *testing.T) {
 								"",
 								"mail.smtp2go.com:2525",
 								"user",
-								&crypto.CryptoValue{
-									CryptoType: crypto.TypeEncryption,
-									Algorithm:  "enc",
-									KeyID:      "id",
-									Crypted:    []byte("password"),
+								&instance.PlainAuth{
+									Password: &crypto.CryptoValue{
+										CryptoType: crypto.TypeEncryption,
+										Algorithm:  "enc",
+										KeyID:      "id",
+										Crypted:    []byte("password"),
+									},
+								},
+								nil,
+							),
+						),
+					),
+				),
+				alg: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+			},
+			args: args{
+				ctx:        authz.WithInstanceID(context.Background(), "INSTANCE"),
+				id:         "ID",
+				instanceID: "INSTANCE",
+				email:      "[email protected]",
+			},
+			res: res{
+				err: zerrors.IsInternal,
+			},
+		},
+		{
+			name: "valid smtp config, wrong xoauth2 auth, ok",
+			fields: fields{
+				eventstore: eventstoreExpect(
+					t,
+					expectFilter(
+						eventFromEventPusher(
+							instance.NewSMTPConfigAddedEvent(
+								context.Background(),
+								&instance.NewAggregate("INSTANCE").Aggregate,
+								"ID",
+								"test",
+								true,
+								"from",
+								"name",
+								"",
+								"mail.smtp2go.com:2525",
+								"user",
+								nil,
+								&instance.XOAuth2Auth{
+									TokenEndpoint: "auth.example.com/token",
+									Scopes:        []string{"scope"},
+									ClientCredentials: &instance.XOAuth2ClientCredentials{
+										ClientId: "client-id",
+										ClientSecret: &crypto.CryptoValue{
+											CryptoType: crypto.TypeEncryption,
+											Algorithm:  "enc",
+											KeyID:      "id",
+											Crypted:    []byte("client-secret"),
+										},
+									},
 								},
 							),
 						),
@@ -2089,7 +2687,7 @@ func TestCommandSide_TestSMTPConfigById(t *testing.T) {
 	}
 }
 
-func newSMTPConfigChangedEvent(ctx context.Context, id, description string, tls bool, fromAddress, fromName, replyTo, host, user string) *instance.SMTPConfigChangedEvent {
+func newSMTPConfigChangedEvent(ctx context.Context, id, description string, tls bool, fromAddress, fromName, replyTo, host, user string, plainAuth *instance.PlainAuth, xoauth2Auth *instance.XOAuth2Auth) *instance.SMTPConfigChangedEvent {
 	changes := []instance.SMTPConfigChanges{
 		instance.ChangeSMTPConfigDescription(description),
 		instance.ChangeSMTPConfigTLS(tls),
@@ -2099,6 +2697,23 @@ func newSMTPConfigChangedEvent(ctx context.Context, id, description string, tls
 		instance.ChangeSMTPConfigSMTPHost(host),
 		instance.ChangeSMTPConfigSMTPUser(user),
 	}
+	if plainAuth != nil {
+		changes = append(changes,
+			instance.ChangeSMTPConfigSMTPPassword(plainAuth.Password),
+		)
+	}
+	if xoauth2Auth != nil {
+		changes = append(changes,
+			instance.ChangeSMTPConfigXOAuth2TokenEndpoint(xoauth2Auth.TokenEndpoint),
+			instance.ChangeSMTPConfigXOAuth2Scopes(xoauth2Auth.Scopes),
+		)
+		if xoauth2Auth.ClientCredentials != nil {
+			changes = append(changes,
+				instance.ChangeSMTPConfigXOAuth2ClientCredentialsClientId(xoauth2Auth.ClientCredentials.ClientId),
+				instance.ChangeSMTPConfigXOAuth2ClientCredentialsClientSecret(xoauth2Auth.ClientCredentials.ClientSecret),
+			)
+		}
+	}
 	event, _ := instance.NewSMTPConfigChangeEvent(ctx,
 		&instance.NewAggregate("INSTANCE").Aggregate,
 		id,