SMTP

[Joe123]

Good evening everyone.

Does anybody know and confirm if TNG (15.0.5) supprts OAuth2/Modern Auth for SMTP 

Thank you Joe

[Rob Severijns]

Hi Joe,

Not sure how many TNG users know what OAuth2 is. I didn't know so I searched for it and this is what I found.

No. TNG (The Next Generation of Genealogy Sitebuilding) does not natively support OAuth 2.0 or OpenID Connect (OIDC) for user authentication.

TNG uses its own authentication system:

• User accounts are stored in its MySQL database.
• uthentication is handled through PHP sessions.
• There is no built-in support for OAuth 2.0, OpenID Connect, or SAML.

If you want to use OAuth2 with TNG there are several approaches:

Protect TNG with a reverse proxy

• Use a solution such as Authentik, Keycloak, Authelia, or OAuth2 Proxy.
• The proxy performs the OAuth2/OIDC authentication before users reach TNG.
• This is the simplest approach if you want to restrict access to the entire site.

Modify TNG's login process

• Since TNG is written in PHP, you can integrate an OAuth2/OIDC client library.
• This allows users to sign in with providers such as:
  • Microsoft Entra ID
  • Google
  • Authentik
  • Keycloak
  • Okta
• This requires custom development because there is no official plugin for OAuth2 authentication.

Implement Single Sign-On (SSO)

• Configure your web server (Apache or Nginx) to authenticate users via OpenID Connect.
• Customize TNG to trust the authenticated user provided by the web server.

API access

TNG also does not provide an official REST API secured with OAuth2. Most integrations are implemented by:

• Accessing the MySQL database directly.
• Using GEDCOM import/export.
• Creating custom PHP endpoints.

Recommendation

If your goal is simply to let users sign in with an external identity provider (such as Microsoft Entra ID, Google, Authentik, or Keycloak), the most maintainable solution is usually to place TNG behind an OIDC-enabled reverse proxy rather than modifying TNG itself.

Hope this helps.

[theKiwi]

@Rob Severijns - the question was about TNG being able to do OAuth2/Modern Auth for SMTP - i.e. for TNG to be able to connect by OAuth2/Modern Auth to an eMail server to send eMails from TNG.

Roger 

[Rob Severijns]

@theKiwi

Thx for your additional comment.

TNG cannot authenticate directly using Modern Auth.
TNG's built-in email functionality relies on PHP's mail capabilities and/or a traditional SMTP configuration (username/password).
It does not have native support for OAtuth2 / Modern Authentication.

Most common solution is to use an SMTP relay:

• Configure TNG to send to a local or external SMTP relay.
• The relay authenticates to Microsoft 365 or Gmail using OAuth2.