Microsoft 365 OAuth2 - invalid_client response

Ralf77

Hello,

I installed a comlete new instance osticket 1.17 RC3 for testing OAuth2 authentification with Microsoft 365.

In Azure I added a new App registration with the following Microsoft Graph permissions:

The Web URL in Azure is identical with the Callback Endpoint set in osTicket.

What could be the reason for the error "invalid_client"?

Thank you

KevinTheJedi

Ralf77

You're using the /common/ urls. You need to use the token and auth urls that include your /tenant-id/ or /orgnaizations/. You should be able to go to Enterprise Applications (or Application Registrations - cant' remember off the top of my head), click the app, and click Endpoints at the top to find the URLs with your tenant-id or organizations.

Cheers.

KevinTheJedi

Ralf77

Okay, it's actually just under App Registrations. At the top of this page you'll see a tab called Endpoints. Click that and you should see the appropriate URLs to use. The ones we provide are just defaults that need to be replaced.

Cheers.

alybrooktech

KevinTheJedi
I just did a fresh install of v1.17 the other day and the certificates/secret values from Azure were actually recreated just this evening. I do get the redirect and can sign-in to office365 just fine, but when it bounces back to the config page, I get the "invlaid_client" error - and it's driving me nutty. I have gone through multiple install guides, etc, to no avail. Any other thoughts?

scruzado

Can someone share this info?

scruzado

I dont know how filling the inputs

KevinTheJedi

scruzado

It looks like you are using an RC or old 1.17 release. Upgrade to v1.17.2, install the new OAuth2 plugin, and retest.

Cheers.

ntozier

@scruzado
Did you read the docs and follow the guides?
https://docs.osticket.com/en/latest/Guides/OAuth2%20Guide.html#authentication

KevinTheJedi

alybrooktech

Make sure you are using v1.18.1 or v1.17.5, install the latest build of OAuth2 plugin, and follow the steps listed here:

https://docs.osticket.com/en/latest/OAuth2/Microsoft%20Authorization%20Guide.html

When you get to the part before popup submission make sure you follow the instructions in the Attention notice at the top of the referenced page to replace the Scopes.

Some helpful things include:

Make sure you are using the "Application (client) Id" from the app registration as the Client Id in the email config
Make sure you are using the Client Secret's "Value" from the app registration as the Client Secret in the email config
Make sure you use the two OAuth2 v2 endpoints from the app registration in the email config
When it brings you to MS to authenticate always login as the email you are configuring in osTicket; unless it's a shared mailbox, resource email, or alias. For those you'd have to login as a service account or user account that has "Send As" and "Read and Manage" permissions for the mailbox (done through EAC).

Cheers.