title: OAuth 2.0 authentication to Gmail works for accounts with gmail.com domain but not for Google Apps domains
body: <p>I have a C# installed application that accesses Gmail via IMAP.  Using traditional IMAP authentication, it works well both for individual Gmail users and for Google Apps users.</p>
  
  <p>I have now added support for OAuth 2.0 authentication using Google's .Net APIs.  This works beautifully for regular Gmail accounts (e.g. someone@gmail.com) but fails for Google Apps accounts that have a different domain.  The user is prompted to login via web browser and accept the access but then the IMAP authentication attempt fails with "Invalid credentials".  Is there something that needs to be done differently for a Google Apps domain?</p>
  
  <hr>
  
  <p>As I first reported in a comment below, I made a minor breakthrough with this.  Originally I was calling GoogleWebAuthorizationBroker.AuthorizeAsync() with the literal string "user" for the user argument (because this is what I had seen done in many examples). This works for regular Gmail users but I find that, for Google Apps, one must pass the actual email address of the authorizing user.</p>
  
  <p>For a while I thought that this was the whole solution to the problem.  It turns out not to be however.  The trouble is that it now works perfectly in in-house testing but routinely fails in the same old way at the one beta site we have.  I can think of only 4 possible reasons for the failure:  (1) the program is getting an invalid access token, (2) it is corrupting that token somehow, (3) it is doing the XOAUTH authentication wrongly or (4) it is using the token to authenticate an account that the token does not apply for.  I assume Google is unlikely to supply an invalid token so (1) can largely be discounted.  (2) and (3) are always possible but the fact that the code works for our own several Gmail and Google Apps accounts makes them seem unlikely.  And the customer insists that (4) is not the case.  So I remain puzzled.</p>
  
  <p>It was suggested early on that I post some of my code and I am now ready to do that.  Here is the start of the C# function that performs the authentication:</p>
  
  <pre><code>private void AuthenticateXOAuth2(string strUsername, string strAccessToken)
  {
      uint uStatus = 0;
  
      // The SASL XOAUTH2 initial client response has the following format:
      //
      //  base64("user=" {User} "^Aauth=Bearer " {Access Token} "^A^A")
      string strInitialClientResponse = "user=" + strUsername + "\x1" + "auth=Bearer " + strAccessToken + "\x1\x1";
  
      byte[] vbInitialClientResponse = Encoding.UTF8.GetBytes(strInitialClientResponse);
      string strBase64InitialClientResponse = System.Convert.ToBase64String(vbInitialClientResponse);
  
      string strCommand = "AUTHENTICATE XOAUTH2 " + strBase64InitialClientResponse;
  
      SendCommand(strCommand);
  ...
  </code></pre>
  
  <hr>
  
  <p>I am still struggling with this, going up blind alleys and getting even more frustrated. I have to correct one thing I said before: I asserted that the program was working for Google Apps domains in in-house testing. This was an illusion; it actually never has.</p>
  
  <p>Someone told me that I need to use a Service Account to cover domain users.  This seems puzzling to me since my program is in no sense a server but I tried it.  And it did not work the way I tried it -- but I cannot be sure I did it right.  Having some confirmation or negation that using a Service Account is the right strategy would help tremendously.</p>