OAuth2 Microsoft Not Working: Page 6

OAuth2 Microsoft Not Working

quare85

I have this error when try to configure authentication

Double checked all settings, seems the token can't be redeemed, first part of getting authorization code works.
Can I have a detailed log to know what is the server response??

Thanks

KevinTheJedi

quare85

It looks like you either didn’t use the correct endpoints or your connection is being refused. Double check your endpoints and make sure you are using the v2 Authorization/Token Endpoints. If all else fails contact Microsoft.

Cheers.

quare85

KevinTheJedi
Thank you for reply. I solved. I discovered the problem was related to PHP.ini that not have openssl extension enabled.
So Endpoint refused connections because were not requested with the correct transport protocol.

ranved82

KevinTheJedi
Thank you for answering back to me,

I was using these instructions https://github.com/osTicket/docs/blob/3b6b623c026c15bb267e404a4afd72b19d29f035/OAuth2/Microsoft%20Authorization%20Guide.rst but they look the same like the one you gave me.

Although it is possible I have missed something (I will double check) and I will also try with multitenant option, I have noticed that in one step I differ from the instructions:

"Now with all the information filled in you can click Submit and you should be redirected to Microsoft to authorize the connection.

Here it is very important to login to the email you are trying to configure in the helpdesk. Once logged in as the system email you are trying to configure, you can opt to Consent on behalf of your organization, and then click Accept."

Here when I click submit, I do not get this page and option to consent on behalf of my organization:

Instead I get only option to Request approval (I am logging in with the email I am trying to configure in the helpdesk):

Afterwards, when admin log-in with his account on his PC he only has this option:

He accepts the request but that doesn't work, when I log-in to the osTicket I get the same error again and it is asking me to Request the same approval again... and I am stuck in the loop.

"Unable to update this email. Correct any errors below and try again.
Configure Authentication"

What should I change to get the option to consent on behalf of my organization and accept, instead of the requesting approval option that I am getting?

Does this helpdesk account needs to have admin rights for the organization? or there is another step I have missed?

Thank you

KevinTheJedi

ranved82

Sounds like you didn’t grant admin consent in the app registration for the API Permissions.

Cheers.

KevinTheJedi

ranved82

Okay so just encountered this today and actually came across a fix! So all you need to do is follow the below guide:

https://docs.revenuegrid.com/ri/fast/articles/Need-Admin-Approval/#how_to_resolve_the_need_admin_approval_error

So apparently, with stricter org setups, you have to grant admin consent twice, once on the API Permissions and again under Enterprise Applications > click app > click Permissions > grant admin consent.

Cheers.

ranved82

KevinTheJedi Thank you Kevin,

Option 3 did the trick for me. 🙂
Unfortunately I cannot keep those settings due to our company policy.
Hopefully if will continue working now after initial approvals have been granted.

lstrom

KevinTheJedi

I wish I could say the same worked for me. I have followed the guide verbatim, and also ensured I granted admin consent to the enterprise app as well as the app registration. However, I still cannot for the life of me get a token. The closest I have gotten is getting redirected back to my end user portal. I am not seeing the green banner and going back into the email authentication config does not show the token tab as expected.

I know this is on the line between osTicket and a MS issue, so I am willing to open a ticket with MS if needed. Thank you for all your work on this.

RBGE

ranved82 Just to confirm, I did migrate our test server to 1.17 using OAuth yesterday and noticed this. It was all sorted after allowing users to grant consent to apps, and I did turn it back to admin approval required afterwards and everything is still working. It should be fine without having to change this setting again unless the app itself is replaced.

jswope

I also had the Auth Failed error and found that the default scopes in the Add on are not correct.

I added the following and everything is good to go.

https://outlook.office.com/IMAP.AccessAsUser.All https://outlook.office.com/POP.AccessAsUser.All https://outlook.office.com/SMTP.Send

KevinTheJedi

jswope

You don't really need those as the scopes in the osTicket config. In the osTicket config the scopes should just be offline_access https://outlook.office.com/Mail.ReadWrite. But you do still need to enable those scopes in the API Permissions.

Cheers.

KevinTheJedi

lstrom

If you go back to the client portal then URL Rewriting is not enabled on your web server (or if you are using IIS it may be due to web.config not being loaded properly or at all) and if you get errors when redirecting back you need to investigate the errors or post them here.

Cheers.

lstrom

KevinTheJedi
Thank you, we are using IIS and URL rewrite is active (we are doing something with URL shortening via YouRLs on the site, though the person that set all that up has since departed). Could there be a rewrite rule we need to configure? I don't get an error on the redirect, it just loads the customer portal as if I was going to open a ticket.

I will also be opening a ticket with MS as I did find the enterprise app logs in Azure and see the following:

mika_y

We are having problems as well, both in our production environment and in a freshly installed test environment. I have followed the official instructions to the letter: https://docs.osticket.com/en/latest/OAuth2/Microsoft%20Authentication%20(SSO)%20Guide.html

But when I try to log in as an agent, authentication is successfull (it shows up in our Azure portal logs) and I'm redirected back to the default osTicket homepage. When I try to access the admin panel, I'm not signed in.

We are running the latest osTicket version and OAuth2 plugin on a freshly installed IIS on a fresh Windows Server 2019, php version 8 and MySQL version 8 aswell.

korcom

Good day all
I have installed and been operational on nginx with the correct redirects etc, however after successful authentication, redirect I get this error:

File not found.

Error log indicates: 2022/10/13 16:15:04 [error] 716270#716270: *7043 FastCGI sent in stderr: "Primary script unknown" while reading response header from upstream

KevinTheJedi

korcom

You do not have URL Rewriting enabled on your server. Since you are using NGINX you may not have the correct configuration either. You can look for the other threads on this. A community member posted their working NGINX config.

Cheers.

atahaynah

i have a problem with configuring remote mail box , after submitting all my entries the application keeps loading endlessly .
SMTP is working pretty great can you please hint me what mistake might be happened ?

KevinTheJedi

atahaynah

You’ll need to check your logs for any related errors.

Cheers.

atahaynah

KevinTheJedi

this is the error that i am receiving
/Osticket/scp/ajax.php/email/4/auth/config/mailbox/oauth2:msmail:1 Failed to load resource: the server responded with a status of 500 ()

Request URL: https://"localserver"/osTicket/scp/ajax.php/email/4/auth/config/mailbox/oauth2:msmail
Request Method: POST
Status Code: 500
Remote Address: **********:443
Referrer Policy: strict-origin-when-cross-origin

atahaynah

KevinTheJedi

it worked for now with fresh installation of App and Plugin .

now when configuring Remote Mailbox
cannot connect to host ; error = fsockopen(): Unable to connect to outlook.office365.com:143 (A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond) (errno = 0 )

DvDaf

Hi All,

I configured OAuth2 with osTicket 1.17 (1d8b790) with Microsoft AzureAD per the osTicket documentation Documentation

The logs within AD was indicating that the end-user was successfully authenticating, however it kept redirecting back to the login page! It turns out that the cURL SSL certificate for PHP was missing. After installing the certificates, the authentication worked fine!

Try these steps, hopefully it'll save someone an headache!

Open up your PHP.ini configuration.
Ensure you have your CA cert installed for cURL. You can also use this one for testing Certificate
Place the certificate within a directory which PHP has READ access to.
Edit your PHP.ini configuration and point to the .PEM certificate files (see entry below).

curl.cainfo = "C:\PHP\v8_1_11\certs\cacert.pem"
openssl.cafile= "C:\PHP\v8_1_11\certs\cacert.pem"

Restart Internet Information Services (IIS).

Staging Server Configuration:
osTicket Version: v1.17 (1d8b790)
Web Server: Microsoft-IIS/10.0
MySql: 5.7.17
PHP version: 8.1.11

mika_y

DvDaf Thx mate! That did it! I had added CA cert file and edited php.ini file, adding line

curl.cainfo = "C:\PHP\v8_1_11\certs\cacert.pem"

but I was missing the second one,

openssl.cafile= "C:\PHP\v8_1_11\certs\cacert.pem"

I also thought I was editing the right .ini file, but after double checking I realized it was using a different .ini since our server is full of PHP folders of older installations. Now everything seems to be working properly.

lstrom

KevinTheJedi
DvDaf

Can confirm that this has not fixed my issue. I have been working with MS support as well, but they have not been able to see any issues with my app registration or other parts of the setup.

toann

DvDaf

Thank you so much. It worked for me.

For future reference, I set up osTicket with IIS and Window Server 2019. I was struggling with this error because I wasn't too familiar with language in the php.ini file. As the solution, I removed the semicolon in the front of curl.cainfo to uncommented it.

Kind regards,

« Previous Page Next Page »