Exception while requesting OAuth 2.0 credentials

[Burny92]

Hey guys,
first of all, i want to thank you for this awesome project!
I have used it since yet on a windows server machine, which is working fine so far.
Now i want to switch to a headless debian 12 with python 3.12, and there i'm having some trouble.
I have copied the config file from windows, which is working fine, because i have already cached credentials in it. But if not, i get an error in the log. Please have a look at the attachments., where i also provide my config file.
I have tried to install the project native on the system, and in a venv. In both cases, it's not working and is throwing the same error message. asyncore 1.0.4 and all requirements are installed in native and venv.
I'm starting the email proxy with the arguments --no-gui and --external-auth.
Looks i'm missing something. If you need more information, please let me know.
Hopefully you can help me solving this issue.
Thank you very much in advance!

emailproxy.config.txt

emailproxy.log

[simonrob]

Thanks for the report, and the log/config files. Just to check: have you removed/anonymised the local_address parameter from your configuration file, or is this really left blank in your setup?

I'm assuming the former, and if so, I'll need to see the actual JSON response contents in order to be able to debug further, so 8570f52 adds this. Please could you try again and post the new log file in debug mode?

[pantherra]

Hello! I've exactly the same issue with Microsoft Office 365 Exchange.
Here is all the info:
emailproxy.config:

[Server setup]
[SMTP-1587]
documentation = *** note: this server will work for both Office 365 and personal Outlook/Hotmail accounts ***
server_address = smtp.office365.com
server_port = 587
local_address = 0.0.0.0
server_starttls = True

[Account setup]
[itops@example.com]
permission_url = https://login.microsoftonline.com/tenant_id/oauth2/v2.0/devicecode
token_url = https://login.microsoftonline.com/tenant_id/oauth2/v2.0/token
oauth2_scope = https://ps.outlook.com/.default https://outlook.office365.com/.default https://outlook.office.com/SMTP.Send offline_access
oauth2_flow = device
redirect_uri = http://localhost
client_id = very_secret_id
client_secret = very_secret_pass

[emailproxy]
delete_account_token_on_password_error = True
encrypt_client_secret_on_first_use = False
use_login_password_as_client_credentials_secret = False
allow_catch_all_accounts = False

Then I've added in the source code:

        except Exception as e:
            # note that we don't currently remove cached credentials here, as failures on the initial request are before
            # caching happens, and the assumption is that refresh token request exceptions are temporal (e.g., network
            # errors: URLError(OSError(50, 'Network is down'))) - access token 400 Bad Request HTTPErrors with messages
            # such as 'authorisation code was already redeemed' are caused by our support for simultaneous requests,
            # and will work from the next request; however, please report an issue if you encounter problems here
            if isinstance(e, json.JSONDecodeError):
                 Log.debug('JSON string that triggered this exception:', e.doc)
            Log.info('Caught exception while requesting OAuth 2.0 credentials for account %s:' % username,
                     Log.error_string(e))
            return False, '%s: Login failed for account %s - please check your internet connection and retry' % (
                APP_NAME, username)

Then I've got this error log:
email2oauth-email-oauth2-proxy-75d75b7c54-bw9hk-email-oauth2-proxy.log
And finally curl command to send out email:

curl -vk smtp://127.0.0.1:1587/ \
  --mail-from itops@example.com'\
  --mail-rcpt itops@example.com'\
  --upload-file mail.txt\
  --user 'itops@example.com:password'

And the start command for the email proxy server (no gui):

python3 emailproxy.py --no-gui --config-file emailproxy.config --debug

[pantherra]

From the curl side I also see the error message:

sh send_email.sh
*   Trying 127.0.0.1:1587...
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0* Connected to 127.0.0.1 (127.0.0.1) port 1587 (#0)
< 220 FR0P281CA0158.outlook.office365.com Microsoft ESMTP MAIL Service ready at Mon, 28 Apr 2025 13:45:35 +0000 [08DD8018BF4BFBCB]
> EHLO mail.txt
< 250-FR0P281CA0158.outlook.office365.com Hello [195.159.169.201]
< 250-SIZE 157286400
< 250-PIPELINING
< 250-DSN
< 250-ENHANCEDSTATUSCODES
< 250-AUTH PLAIN LOGIN
< 250-8BITMIME
< 250-BINARYMIME
< 250-CHUNKING
< 250 SMTPUTF8
> AUTH PLAIN
< 334
> AGl0b3BzQHF1ZXN0YmFjay5jb20AcGFzc3dvcmQ=
  0     0    0     0    0     0      0      0 --:--:--  0:00:05 --:--:--     0< 535 5.7.8  Authentication credentials invalid. Email OAuth 2.0 Proxy: Login failed for account itops@example.com - please check your internet connection and retry
  0     0    0     0    0     0      0      0 --:--:--  0:00:05 --:--:--     0
* Closing connection 0
curl: (67) Login denied

The weird question - Is the emailproxy trying to authenticate against Office365 via plaintext username password?

[pantherra]

I've followed this article from the Microsoft to create an Application creds:
https://learn.microsoft.com/en-us/exchange/client-developer/legacy-protocols/how-to-authenticate-an-imap-pop-smtp-application-by-using-oauth

[simonrob]

This is a similar but not identical error – you're seeing a ValueError, while the original report was a JSONDecodeError. Because of this I can't see any useful error details despite the modification to the script, but my hunch is that the server response is of an unexpected format because you've modified the scope values for some reason (you're using the ones required for admin consent). Restore this to the correct value as detailed in the proxy's configuration file and things may well start to work. You've specified the device flow in your configuration file, so this is the correct scope.

(No, the proxy is not trying to authenticate against Office365 using a plaintext username and password – you're seeing this because curl is trying to authenticate against the proxy using plaintext credentials.)

[Burny92]

Hey simonrob,
i'm sorry for the late response, looks like i have missed your message.
I will add this information as soon as possible, so we can proceed solving this issue.
Thank you very much for your support!

With kind regards

[Kuemmelklaus]

Hello, I am trying to install the proxy inside docker (https://github.com/blacktirion/email-oauth2-proxy-docker) on a debian machine. We also get the JSONDecodeError. It looks like Exchange Online answers with a login webpage, but the proxy is expecting JSON.

Here is my config:

[SMTP-1587]
documentation = *** note: this server will work for both Office 365 and personal Outlook/Hotmail accounts ***
server_address = smtp-mail.outlook.com
server_port = 587
server_starttls = True
local_address = 0.0.0.0

[noreply@domain.de]
permission_url = https://login.microsoftonline.com/{TenantID}/oauth2/v2.0/authorize
token_url = https://login.microsoftonline.com/{TenantID}/oauth2/v2.0/token
oauth2_scope = https://outlook.office.com/IMAP.AccessAsUser.All https://outlook.office.com/POP.AccessAsUser.All https://outlook.office.com/SMTP.Send offline_access
redirect_uri = http://localhost
client_id = XXXXXXXXXXXXXXXXXXXXXXXXX
client_secret = XXXXXXXXXXXXXXXXXXXXXXXXX
oauth2_flow = device

[emailproxy]
delete_account_token_on_password_error = True
encrypt_client_secret_on_first_use = False
use_login_password_as_client_credentials_secret = False
allow_catch_all_accounts = False

And the log file:

2025-05-13 12:42:36,891: Initialising Email OAuth 2.0 Proxy (version 2025-04-27) in debug mode from config file /config/emailproxy.config
2025-05-13 12:42:36,891: Starting SMTP server at 0.0.0.0:1587 (unsecured) proxying smtp-mail.outlook.com:587 (STARTTLS)
2025-05-13 12:42:36,893: Initialised Email OAuth 2.0 Proxy - listening for authentication requests. Connect your email client to begin
2025-05-13 12:44:18,750: New incoming connection to SMTP server at 0.0.0.0:1587 (unsecured) proxying smtp-mail.outlook.com:587 (STARTTLS)
2025-05-13 12:44:18,750: Accepting new connection from 172.18.0.6:47432 to SMTP server at 0.0.0.0:1587 (unsecured) proxying smtp-mail.outlook.com:587 (STARTTLS)
2025-05-13 12:44:18,792: SMTP (172.18.0.6:47432-{172.18.0.5:1587}-smtp-mail.outlook.com:587) --> [ Client connected ]
2025-05-13 12:44:18,810: SMTP (172.18.0.6:47432-{172.18.0.5:1587}-smtp-mail.outlook.com:587)     <-- b'220 BE1P281CA0218.outlook.office365.com Microsoft ESMTP MAIL Service ready at Tue, 13 May 2025 12:44:18 +0000 [08DD91D4EEB06C38]\r\n'
2025-05-13 12:44:18,810: SMTP (172.18.0.6:47432-{172.18.0.5:1587}-smtp-mail.outlook.com:587) <-- b'220 BE1P281CA0218.outlook.office365.com Microsoft ESMTP MAIL Service ready at Tue, 13 May 2025 12:44:18 +0000 [08DD91D4EEB06C38]\r\n'
2025-05-13 12:44:18,811: SMTP (172.18.0.6:47432-{172.18.0.5:1587}-smtp-mail.outlook.com:587) --> b'ehlo 6f5edab84cfc\r\n'
2025-05-13 12:44:18,811: SMTP (172.18.0.6:47432-{172.18.0.5:1587}-smtp-mail.outlook.com:587)     --> b'ehlo 6f5edab84cfc\r\n'
2025-05-13 12:44:18,828: SMTP (172.18.0.6:47432-{172.18.0.5:1587}-smtp-mail.outlook.com:587)     <-- b'250-BE1P281CA0218.outlook.office365.com Hello [185.150.32.65]\r\n'
2025-05-13 12:44:18,829: SMTP (172.18.0.6:47432-{172.18.0.5:1587}-smtp-mail.outlook.com:587)     <-- b'250-SIZE 157286400\r\n'
2025-05-13 12:44:18,829: SMTP (172.18.0.6:47432-{172.18.0.5:1587}-smtp-mail.outlook.com:587)     <-- b'250-PIPELINING\r\n'
2025-05-13 12:44:18,829: SMTP (172.18.0.6:47432-{172.18.0.5:1587}-smtp-mail.outlook.com:587)     <-- b'250-DSN\r\n'
2025-05-13 12:44:18,829: SMTP (172.18.0.6:47432-{172.18.0.5:1587}-smtp-mail.outlook.com:587)     <-- b'250-ENHANCEDSTATUSCODES\r\n'
2025-05-13 12:44:18,830: SMTP (172.18.0.6:47432-{172.18.0.5:1587}-smtp-mail.outlook.com:587)     <-- b'250-STARTTLS\r\n'
2025-05-13 12:44:18,830: SMTP (172.18.0.6:47432-{172.18.0.5:1587}-smtp-mail.outlook.com:587)     <-- b'250-8BITMIME\r\n'
2025-05-13 12:44:18,830: SMTP (172.18.0.6:47432-{172.18.0.5:1587}-smtp-mail.outlook.com:587)     <-- b'250-BINARYMIME\r\n'
2025-05-13 12:44:18,830: SMTP (172.18.0.6:47432-{172.18.0.5:1587}-smtp-mail.outlook.com:587)     <-- b'250-CHUNKING\r\n'
2025-05-13 12:44:18,830: SMTP (172.18.0.6:47432-{172.18.0.5:1587}-smtp-mail.outlook.com:587)     <-- b'250 SMTPUTF8\r\n'
2025-05-13 12:44:18,830: SMTP (172.18.0.6:47432-{172.18.0.5:1587}-smtp-mail.outlook.com:587)     --> b'STARTTLS\r\n'
2025-05-13 12:44:18,847: SMTP (172.18.0.6:47432-{172.18.0.5:1587}-smtp-mail.outlook.com:587)     <-- b'220 2.0.0 SMTP server ready\r\n'
2025-05-13 12:44:18,848: SMTP (172.18.0.6:47432-{172.18.0.5:1587}-smtp-mail.outlook.com:587) <-> [ Starting TLS handshake ]
2025-05-13 12:44:18,866: SMTP (172.18.0.6:47432-{172.18.0.5:1587}-smtp-mail.outlook.com:587) [ Successfully negotiated SMTP server STARTTLS connection - re-sending greeting ]
2025-05-13 12:44:18,866: SMTP (172.18.0.6:47432-{172.18.0.5:1587}-smtp-mail.outlook.com:587)     --> b'ehlo 6f5edab84cfc\r\n'
2025-05-13 12:44:18,914: SMTP (172.18.0.6:47432-{172.18.0.5:1587}-smtp-mail.outlook.com:587) <-> [ TLSv1.3 handshake complete ]
2025-05-13 12:44:18,948: SMTP (172.18.0.6:47432-{172.18.0.5:1587}-smtp-mail.outlook.com:587)     <-- b'250-BE1P281CA0218.outlook.office365.com Hello [185.150.32.65]\r\n'
2025-05-13 12:44:18,949: SMTP (172.18.0.6:47432-{172.18.0.5:1587}-smtp-mail.outlook.com:587)     <-- b'250-SIZE 157286400\r\n'
2025-05-13 12:44:18,949: SMTP (172.18.0.6:47432-{172.18.0.5:1587}-smtp-mail.outlook.com:587)     <-- b'250-PIPELINING\r\n'
2025-05-13 12:44:18,949: SMTP (172.18.0.6:47432-{172.18.0.5:1587}-smtp-mail.outlook.com:587)     <-- b'250-DSN\r\n'
2025-05-13 12:44:18,949: SMTP (172.18.0.6:47432-{172.18.0.5:1587}-smtp-mail.outlook.com:587)     <-- b'250-ENHANCEDSTATUSCODES\r\n'
2025-05-13 12:44:18,949: SMTP (172.18.0.6:47432-{172.18.0.5:1587}-smtp-mail.outlook.com:587)     <-- b'250-AUTH LOGIN XOAUTH2\r\n'
2025-05-13 12:44:18,949: SMTP (172.18.0.6:47432-{172.18.0.5:1587}-smtp-mail.outlook.com:587)     <-- b'250-8BITMIME\r\n'
2025-05-13 12:44:18,949: SMTP (172.18.0.6:47432-{172.18.0.5:1587}-smtp-mail.outlook.com:587)     <-- b'250-BINARYMIME\r\n'
2025-05-13 12:44:18,949: SMTP (172.18.0.6:47432-{172.18.0.5:1587}-smtp-mail.outlook.com:587)     <-- b'250-CHUNKING\r\n'
2025-05-13 12:44:18,949: SMTP (172.18.0.6:47432-{172.18.0.5:1587}-smtp-mail.outlook.com:587)     <-- b'250 SMTPUTF8\r\n'
2025-05-13 12:44:18,949: SMTP (172.18.0.6:47432-{172.18.0.5:1587}-smtp-mail.outlook.com:587) <-- b'250-BE1P281CA0218.outlook.office365.com Hello [185.150.32.65]\r\n250-SIZE 157286400\r\n250-PIPELINING\r\n250-DSN\r\n250-ENHANCEDSTATUSCODES\r\n250-AUTH PLAIN LOGIN\r\n250-8BITMIME\r\n250-BINARYMIME\r\n250-CHUNKING\r\n250 SMTPUTF8\r\n'
2025-05-13 12:44:18,950: SMTP (172.18.0.6:47432-{172.18.0.5:1587}-smtp-mail.outlook.com:587) --> b'AUTH PLAIN [[ Credentials removed from proxy log ]]\r\n'
2025-05-13 12:44:18,950: SMTP (172.18.0.6:47432-{172.18.0.5:1587}-smtp-mail.outlook.com:587)     --> b'AUTH XOAUTH2\r\n'
2025-05-13 12:44:18,967: SMTP (172.18.0.6:47432-{172.18.0.5:1587}-smtp-mail.outlook.com:587)     <-- b'334 \r\n'
2025-05-13 12:44:19,697: Caught exception while requesting OAuth 2.0 credentials for account noreply@domain.de: JSONDecodeError('Expecting value: line 3 column 1 (char 4)')
2025-05-13 12:44:19,697: JSON string that triggered this exception:

<!-- Copyright (C) Microsoft Corporation. All rights reserved. -->
<!DOCTYPE html>
<html dir="ltr" class="" lang="en">
<head>
    <title>Sign in to your account</title>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=2.0, user-scalable=yes">
    <meta http-equiv="Pragma" content="no-cache">
    <meta http-equiv="Expires" content="-1">
    <link rel="preconnect" href="https://aadcdn.msauth.net" crossorigin>
<meta http-equiv="x-dns-prefetch-control" content="on">
<link rel="dns-prefetch" href="//aadcdn.msauth.net">
<link rel="dns-prefetch" href="//aadcdn.msftauth.net">

    <meta name="PageID" content="ConvergedSignIn" />
    <meta name="SiteID" content="" />
    <meta name="ReqLC" content="1033" />
    <meta name="LocLC" content="en-US" />

        <meta name="referrer" content="origin" />

        <meta name="format-detection" content="telephone=no" />

    <noscript>
        <meta http-equiv="Refresh" content="0; URL=https://login.microsoftonline.com/jsdisabled" />
    </noscript>



<meta name="robots" content="none" />

<script type="text/javascript" nonce='V9dBykE5ED2qau39bp-ycg'>//<![CDATA[
$Config={"fShowPersistentCookiesWarning":false,"urlMsaSignUp":"https://login.live.com/oauth20_authorize.srf?scope=openid+profile+email+offline_access\u0026response_type=code\u0026client_id=51483342-085c-4d86-bf88-cf50c7252078\u0026response_mode=form_post\u0026redirect_uri=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2ffederation%2foauth2msa\u0026state=rQQIARAA02I20jOwUjE1NzZNSTFJ1jVNTjTXNTExN9BNMrQw0E1ONjJNsUyzNDNPSioS4hIQVOz87Fwp5zIth01P1S-OfRYjZ3xOZlmqXnJ-7g5GxguMjC8YGScxieflF6UW5FQ6JKUW5WTmAYn [ NOTE: message over syslog length limit truncated to 2048 characters; run `emailproxy.py --debug` in a terminal to see the full output ]
2025-05-13 12:44:19,698: SMTP (172.18.0.6:47432-{172.18.0.5:1587}-smtp-mail.outlook.com:587)     --> b'*\r\n'
2025-05-13 12:44:24,726: SMTP (172.18.0.6:47432-{172.18.0.5:1587}-smtp-mail.outlook.com:587)     <-- b'535 5.7.3 Authentication unsuccessful [BE1P281CA0218.DEUP281.PROD.OUTLOOK.COM 2025-05-13T12:44:24.706Z 08DD91D4EEB06C38]\r\n'
2025-05-13 12:44:24,726: SMTP (172.18.0.6:47432-{172.18.0.5:1587}-smtp-mail.outlook.com:587) <-- b'535 5.7.8  Authentication credentials invalid. Email OAuth 2.0 Proxy: Login failed for account noreply@domain.de - please check your internet connection and retry\r\n'
2025-05-13 12:44:24,727: SMTP (172.18.0.6:47432-{172.18.0.5:1587}-smtp-mail.outlook.com:587) --> b'AUTH LOGIN [[ Credentials removed from proxy log ]]\r\n'
2025-05-13 12:44:24,727: SMTP (172.18.0.6:47432-{172.18.0.5:1587}-smtp-mail.outlook.com:587) <-- b'334 UGFzc3dvcmQ6\r\n'
2025-05-13 12:44:24,727: SMTP (172.18.0.6:47432-{172.18.0.5:1587}-smtp-mail.outlook.com:587) --> b'[[ Credentials removed from proxy log ]]'
2025-05-13 12:44:24,727: SMTP (172.18.0.6:47432-{172.18.0.5:1587}-smtp-mail.outlook.com:587)     --> b'AUTH XOAUTH2\r\n'
2025-05-13 12:44:24,744: SMTP (172.18.0.6:47432-{172.18.0.5:1587}-smtp-mail.outlook.com:587)     <-- b'334 \r\n'
2025-05-13 12:44:25,666: Caught exception while requesting OAuth 2.0 credentials for account noreply@domain.de: JSONDecodeError('Expecting value: line 3 column 1 (char 4)')
2025-05-13 12:44:25,667: JSON string that triggered this exception:

<!-- Copyright (C) Microsoft Corporation. All rights reserved. -->
<!DOCTYPE html>
<html dir="ltr" class="" lang="en">
<head>
    <title>Sign in to your account</title>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=2.0, user-scalable=yes">
    <meta http-equiv="Pragma" content="no-cache">
    <meta http-equiv="Expires" content="-1">
    <link rel="preconnect" href="https://aadcdn.msftauth.net" crossorigin>
<meta http-equiv="x-dns-prefetch-control" content="on">
<link rel="dns-prefetch" href="//aadcdn.msftauth.net">
<link rel="dns-prefetch" href="//aadcdn.msauth.net">

    <meta name="PageID" content="ConvergedSignIn" />
    <meta name="SiteID" content="" />
    <meta name="ReqLC" content="1033" />
    <meta name="LocLC" content="en-US" />

        <meta name="referrer" content="origin" />

        <meta name="format-detection" content="telephone=no" />

    <noscript>
        <meta http-equiv="Refresh" content="0; URL=https://login.microsoftonline.com/jsdisabled" />
    </noscript>



<meta name="robots" content="none" />

<script type="text/javascript" nonce='aJprg-KQ5vCoqZIs1TEI9w'>//<![CDATA[
$Config={"fShowPersistentCookiesWarning":false,"urlMsaSignUp":"https://login.live.com/oauth20_authorize.srf?scope=openid+profile+email+offline_access\u0026response_type=code\u0026client_id=51483342-085c-4d86-bf88-cf50c7252078\u0026response_mode=form_post\u0026redirect_uri=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2ffederation%2foauth2msa\u0026state=rQQIARAA02I20jOwUjE1NzZNSTFJ1jVNTjTXNTExN9BNMrQw0E1ONjJNsUyzNDNPSioS4hLYx1968Ma7Os9dP966rsuz2DOLkTM-J7MsVS85P3cHI-MFRsYXjIyTmMTz8otSC3IqHZJSi3Iy8 [ NOTE: message over syslog length limit truncated to 2048 characters; run `emailproxy.py --debug` in a terminal to see the full output ]
2025-05-13 12:44:25,668: SMTP (172.18.0.6:47432-{172.18.0.5:1587}-smtp-mail.outlook.com:587)     --> b'*\r\n'
2025-05-13 12:44:30,679: SMTP (172.18.0.6:47432-{172.18.0.5:1587}-smtp-mail.outlook.com:587)     <-- b'535 5.7.3 Authentication unsuccessful [BE1P281CA0218.DEUP281.PROD.OUTLOOK.COM 2025-05-13T12:44:30.659Z 08DD91D4EEB06C38]\r\n'
2025-05-13 12:44:30,680: SMTP (172.18.0.6:47432-{172.18.0.5:1587}-smtp-mail.outlook.com:587) <-- b'535 5.7.8  Authentication credentials invalid. Email OAuth 2.0 Proxy: Login failed for account noreply@domain.de - please check your internet connection and retry\r\n'
2025-05-13 12:44:30,710: SMTP (172.18.0.6:47432-{172.18.0.5:1587}-smtp-mail.outlook.com:587) --> [ Client disconnected ]
2025-05-13 12:44:30,712: SMTP (172.18.0.6:47432-{172.18.0.5:1587}-smtp-mail.outlook.com:587) <-- [ Server disconnected ]

[simonrob]

Thanks for the extra detail here. I'm afraid I can't replicate this – authorisation works fine with my own O365 account.

Can you provide a test account and OAuth client configuration so I can investigate? (Best to email to my GitHub username at Gmail).

[Kuemmelklaus]

Thanks for the quick reply. I've sent you an email.

[simonrob]

I appreciate that providing a test account won't be possible in many cases, but since I can't replicate this myself, it's the only real option here.

If anyone who is experiencing this problem can provide me with an account and OAuth client details that replicate this issue I'm happy to look into it further.

[beckjim]

Looks like sometimes people are using the wrong permission URL for DAG flows:
wrong:
permission_url = https://login.microsoftonline.com/common/oauth2/v2.0/authorize
correct:
permission_url = https://login.microsoftonline.com/common/oauth2/v2.0/devicecode

The wrong URL gives you a login page.

[simonrob]

Thanks, but I don't think this is the problem. This example above uses the correct URL for DAG, but apparently still triggers the issue.