Gmail blocks login attempt from Python with app specific password

Question

I'm trying to send an email from a Google account using Python's smtplib, but getting an error, and now I'm kind of at a loss. Google responds with the following: Please log in via your web browser and then try again. Learn more at https://support.google.com/mail/answer/78754.

The account has two factor authentication enabled, so I'm using an app specific password for my login. To my understanding, this should then work without enabling the setting for less secure apps, shouldn't it? I've been doing the same with another account while testing without a problem, but now I finally got the credentials for the proper account and there it won't accept the authentication.

I'm aware that there is a Python Gmail API thingy to use with OAuth, but if at all possible I don't want to include more packages and rewrite much, and I don't really want to enable the "less secure apps" setting either. Is there a way to get this working without either?

If it makes a difference, here is the code I use for sending email. As said before, this was working fine with another account, so I'm not sure if it's actually relevant.

def send_mail(to_address, subject, body):
    smtp_user = "[email protected]"
    smtp_password = "MyAppPasswordFromGoogle"
    server = "smtp.gmail.com"
    port = 587

    msg = MIMEMultipart("alternative")
    msg["Subject"] = subject
    msg["From"] = smtp_user
    msg["To"] = to_address
    msg.attach(MIMEText(body, "html"))
    s = smtplib.SMTP(server, port)
    s.connect(server, port)
    s.ehlo()
    s.starttls()
    s.ehlo()
    s.login(smtp_user, smtp_password)
    s.sendmail(smtp_user, to_address, msg.as_string())
    s.quit()

Edit: There is an interesting difference between the two accounts: on https://myaccount.google.com/lesssecureapps, my old (working) one says "this setting isn't available for accounts that have two factor authentication enabled", while the new one says "this setting is managed by your domain administrator", even though both use 2FA and it's also forced in both domains. So I suppose there is some setting that the domain admin has to change, but I don't know which one that would be.

Solution 1

I tried to replicate exactly your case (with an account that has a two factor authentication enabled). After creating my app password, I used it in the code.

Anyway, I think your problem is the following:

s = smtplib.SMTP(server, port)
s.connect(server, port)

You execute the connection twice.

Try with

s = smtplib.SMTP()
s.connect(server, port)

or just this

s = smtplib.SMTP(server, port)

The entire code:

import smtplib
from email.mime.multipart import MIMEMultipart
from email.mime.text import MIMEText


smtp_user = '[email protected]'
smtp_password = 'my16charactersAppPassword'
server = 'smtp.gmail.com'
port = 587
msg = MIMEMultipart("alternative")
msg["Subject"] = 'Why,Oh why!'
msg["From"] = smtp_user
msg["To"] = "[email protected]"
msg.attach(MIMEText('\nsent via python', 'plain'))
s = smtplib.SMTP(server, port)
s.ehlo()
s.starttls()
s.login(smtp_user, smtp_password)
s.sendmail(smtp_user, "[email protected]", msg.as_string())
s.quit()

Solution 2

Seems simple, but check to make sure Allow less secure apps is enabled.

Comments

[Christian]

Sadly, that wasn't it. I've tried various combinations of that, and apparently I've accidentally copied one with both connections. I'll edit the question to reflect this. Anyway, I get the same result with both of your versions. Also, as I've said before, the same code works fine with another account, so while it may not be pretty, I very much doubt there's an actual logical error in the code that would only surface in one account and not the other.

[Davide Patti]

Ok, np. In my account, in myaccount.google.com/lesssecureapps, there is written "This setting is not available for accounts with 2-Step Verification enabled. Such accounts require an application-specific password for less secure apps access.". As in your account where it works. Are you using Gsuite? the only thing that I found (from the description of your problem) is support.google.com/a/answer/35232?hl=en&ref_topic=4361128

[Christian]

Yes, we're using GSuite (for both accounts). We've set up MX records and all that already, of course.

[Davide Patti]

Probably there is something misconfigurated. You could try to compare the configuration of the account where it works with the other one (trying to find somemthing "different"). In my test I didn't use Gsuite.

[Christian]

That's what I'm thinking. Settings that are obviously relevant (such as "less secure apps" and "force 2FA") are the same, but I didn't find any other setting that should be affecting this behaviour, hence the question.The problem is that I am not admin of either suite, so I don't have access to a lot of settings to just try things out. Still, I'd rather be able to tell my boss "change setting x, that should solve it" rather than "compare each and every menu, some of which are borderline inaccessible from the navigation without using a direct link, and see if you can find something different".

[Davide Patti]

Clear. You could use the free trial of Gsuite (gsuite.google.com/signup/basic/products) to try to create an account in wich you are able to send the email. And after tell your employer what should be the settings.

[Christian]

I don't know where to even look any more though. I have been researching this for quite a bit before I've opened the question here, and I'm not aware of any relevant settings other than the two mentioned above.

[Christian]

One more correction: if I just do s = smtplib.SMTP(), the authentication doesn't work at all and I get an tlsv1 unrecognized name error.

[Christian]

That's exactly the setting I don't want to use, as I've written in the question. It should be possible without it.

[Christian]

Yes, I have IMAP enabled. I'll try out the solutions in your link in the next few days.

[Gad D Lord]

Details on how to generate your 16 characters long app password are available at support.google.com/accounts/answer/185833

[Nick Lothian]

This was the solution for me. I believe "Less secure apps" means "allow application specific passwords to work", but this doesn't appear to be written anywhere. Noting it here for future references..

[Dominique Paul]

@Christian Where you eventually able to solve the problem? I'm encountering the same issue and I have no idea what else to try right now. Code is working if I use my private gmail account (with 2F and app-specific password).

[Christian]

@DominiquePaul Unfortunately no. I ended up sending emails over AWS SES, circumventing this whole issue. I think Google's app-specific password approach is very wobbly in general - I couldn't even get it to work with Outlook on one machine. Which is a shame, because the idea behind it is not bad.

[modernxart]

Do you know how to login with app password with 'smtplib' ? Thanks.

[modernxart]

for those people seeking how to use it with smtplib, here it is : just replace the original password with the app password.