Generic OAuth2 redirects to homepage instead of logging in

che75

Thanks @KevinTheJedi for your reply and your advice.

I've checked the 4 user attributes mapping :

User identifier (well saved in the new user's field : "Username")
Given name / Surname (saved in "Name")
Email address (saved in "email" field)

When I modify one of those fields on Keycloak, they are well saved in osticket, so I assume the mapping is correct.

For URLs, I checked again, everything is ok.

Callback Endpoint: http://oursupporturl.com/api/auth/oauth2
Authorization Endpoint: https://oursso.com/auth/realms/our_realm/protocol/openid-connect/auth
Token Endpoint: https://oursso.com/auth/realms/our_realm/protocol/openid-connect/token
Resource Details Endpoint: https://oursso.com/auth/realms/our_realm/protocol/openid-connect/userinfo

On Keycloak, I have authorized the redirect on the URL http://oursupporturl.com/api/auth/oauth2.

During the worflow, everything seems to be coherent:

Can I activate somewhere more debug logs to try to understand? I have no error in System logs tab (in DEBUG mode).

KevinTheJedi

che75

Go to include/class.auth.php and search for regenerateSession(. There should be 2 lines with this method and you want to comment these lines out, save the changes, and fully retest login.

We should have a fix coming for this in RC4.

Cheers.

prayogi

KevinTheJedi Hi Kevin, would you like inform which lines should be commented out, i search for regenerateSession( but cant find it

Bmill

Hey Kevin, thanks for being on top of it and so supportive.

We are still experiencing all the same described symptoms. We did go in and comment those lines on Line637 and Line854. Its still the same results.

We are attempting a fresh install of RC3, verse using the upgrade path. We'll let you know if we have any different success.

Update: So we did a fresh install of OSTicket RC3 with a new db, and came to the same results. After authing with the IdP, the token is returned to OSTicket, but goes to the landing page with no user/agent logged in.

KevinTheJedi

Bmill

Then you definitely don’t have something configured correctly or you didn’t download the latest build of the plugin.

Cheers.

che75

@KevinTheJedi

Works perfectly for me! I've commented the two lines out and I'm connected now.
I don't known if it's already in the pipe, but It should be awesome to be able to disable the change password feature in the user profile when it's connected using OAuth.

Next release looks very promising indeed. Thanks for your time @KevinTheJedi!

KevinTheJedi

che75

Do you have the password policy plugin installed/enabled? If so this is a bug that we are working on.

Cheers.

che75

@KevinTheJedi

No, I have only the OAuth2 Client enabled, and the Help Desk Audit installed but not activated

Since I'd deactivated the two lines in include/class.auth.php, everything works perfectly. I don't have found any other bug on the RC.

KevinTheJedi

che75

Ah, I see now. You were saying to disable the option for Change Password for Users if they are using OAuth2. Well, even if you have OAuth2 installed/configured/enabled you still have local authentication (As what happens when OAuth2 fails for whatever reason? They won't be able to access the system at all). With this the standard rules still apply like being able to change/reset the local password. So with this in mind I doubt this will ever come to fruition.

Cheers.

ntozier

@KevinTheJedi
I think that the problem here is that many people do not realize that there is a local account that people can still log into when their preferred auth backend fails. We might need to add some verbiage some where (? help mouse overs? docs?) that explains that a little better.

cslob

I'm using stable v17 and am seeing oauth attempts bring the user back to the sign in screen after logging into the oauth provider. I'm using Google as the source and IIS is the webserver. I'm suspecting it could be the URL rewrite but not sure what to look at to troubleshoot.

naseemnaser

I am getting redirected to the landing page as well; I am using v1.17 (1d8b790) recent Outh2 client Plugin.

Everything in my settings matching the OS Ticket Documentation - Microsoft one.
User identifiers are correct; not sure what to do else..

KevinTheJedi

naseemnaser

Do you have URL Rewriting enabled on your webserver?

Cheers.

reberhardt

I am running into the same thing and I do NOT have URL Rewriting enabled that I am aware of. There are no rules there. Just installed 2 days ago.

Microsoft Server 2022
IIS 10.0
v1.17
PHP 8.0.0
MySQL 5.5.45
Oauth2 Client Plugin version 0.6

KevinTheJedi

reberhardt

You’ll need to enable that then. We ship with web.config that should handle the URL Rewriting itself but you need to make sure that URL Rewriting is enabled. You can google this to see how.

Cheers.

reberhardt

It is enabled. Do I need to define rules specific to osTicket?

KevinTheJedi

reberhardt

You shouldn’t have to as I said we ship with web.config that should handle the rules. Maybe your server isn’t allowing web.config?

Cheers.

cslob

I have Windows Server 2022, IIS 10, php 8.0, mysql 5.5, osTicket 1.17 and the oauth2 plugin loaded. I do have URL rewrite enabled and have tested its working. I've verified the rules are present in the web.config. I cannot get it to authenticate (using Google) and just bringing me back to the homepage unauthenticated. I've verfied the project in Google and the settings in osTicket. I'm not sure where else I should look to troubleshoot further.

KevinTheJedi

cslob

In the meantime you can manually add the rewrite rules. But you need to eventually figure out why web.config isn’t loading.

Cheers.

cslob

KevinTheJedi
I've got the rules loaded without any issues. For some reason the final redirect back to osticket doesn't complete the authentication.

jw9000

I have same issue. We use cPanel to host our OSTicket platform and I have the .htaccess file to include the value RewriteEngine On. However, OAuth 2 is taking me to our homepage upon authentication for our support ticketing system. We are using the latest stable version 17 of OSTicket and the most up to date OAuth2 plugin. I am not sure what I am doing wrong here because upon authentication, I am redirected to our OSTicket home page and I am not logged in as Guest. You mentioned in previous thread that the rewrite rules can be manually entered. What is the syntax for this.

DobromirStoev

jw9000 Hi, i am using Control Panel, and the authentication with Microsoft365 is also not working. Sending me to the home page without the user to be logged in. Did you manage to find a solution?