Internal Server Error with OAUTH config

ealtman

Hi - I am getting the following error when I try to configure the primary Support email for OAUTH2
GET https://[myserver]/osticket/scp/ajax.php/email/1/auth/config/mailbox/oauth2:msmail 500 (Internal Server Error)
My configuration information is attached

ntozier

Please download the current rc for 1.17 from osTicket.com/download
install it, and retest.

Then if you still have issues you might want to post your oauth / mail configuration settings.

ealtman

ntozier
I have 1.17rc4 installed and worked with my Azure administrator to input the following values for the OAUTH2 Client instance, which is enabled:

Name: Microsoft
Authentication Target: Agents Only
Authentication Label: Azure
Type: Authentication
Redirect URL: https://[myserver]/osticket/api/auth/oauth2
Client ID: [hash created by our Azure-AD administrator]
Client Secret: [hash created by our Azure-AD administrator]
Authorization Endpoint: https://login.microsoftonline.com/[hash created by our Azure-AD administrator]/oauth2/v2.0/authorize
Token Endpoint: https://login.microsoftonline.com/[hash created by our Azure-AD administrator]/oauth2/v2.0/token
Resource Details Endpoint: https://graph.microsoft.com/v1.0/me (Default)
Scopes: offline_access https://outlook.office.com/Mail.ReadWrite
User Identifier: mail
Given Name: givenname
Surname: surname
Email Address: EmailAddress

KevinTheJedi

ealtman

We've said this many times in other threads but maybe you just didn't see; using the Graph RDE (Resource Details Endpoint) will not work. You MUST use the default we provide (the v2.0 outlook url). You can follow the guide I posted below:

https://forum.osticket.com/d/96893-basic-authentication-retirement-for-legacy-protocols-in-exchange-online/138

Cheers.

ealtman

KevinTheJedi
Sorry I don't understand. That was the default value for Resource Details Endpoint that appeared on install -- how am I supposed to construct the correct one?

KevinTheJedi

ealtman

Then I assume you didn't update the plugin. You need to download and update your oauth2 plugin to the latest and retest. The default RDE for email authorization is https://outlook.office.com/api/v2.0/me as seen here:

https://github.com/osTicket/osTicket-plugins/blob/c8cfcf01859e6528c845617a7fe66d51bd481325/auth-oauth2/oauth2.php#L624

Cheers.

ealtman

KevinTheJedi
Configurations disconnecting?
I reinstalled 1.17 rc4 from scratch with a blank database and a zipped package of the plugins from https://github.com/osTicket/osTicket-plugins/tree/c8cfcf01859e6528c845617a7fe66d51bd481325. The "initial" (?) OAuth2 instance was configured, just registering the app to Azure/AD and all went well.
I moved on to configure oauth for Remote Inbox and Outgoing smtp for the main Support email.
The config form autopopulated some values from the first instance, but I needed to reinput the Client ID and the Secret. For each configuration, the system sent me to log into my institution's Outlook instance (which we do with SSO) and I was able to get through and save the setting in the email. However I just checked:

Three oauth2 instances are visible in osticket/scp/plugins.php?id=1#instances: the "original" one and the two associated with the Inbox and Outgoing functions for the support email.
The configurations I set up for the support email account (e.g. /osticket/scp/emails.php?id=1#mailbox and /osticket/scp/emails.php?id=1#smtp) have reverted to being blank.
When I reestablish those connections and attempt a diagnostic, that (failed) test actually wipes the configurations for that particular email (although the oauth instances remain)

Please also forgive my ignorance -- how is the password being saved? Perhaps I'm not using this plugin as intended, We need it to poll an institutional outlook email account every 5 minutes to check for messages that create tickets.

Thank you,
Elizabeth Altman

KevinTheJedi

ealtman

Please don’t use zipped packages from GitHub as those aren’t official builds and are most likely not updated. Please download the OAuth2 plugin from our website.

Also you are supposed to configure the OAuth settings for emails within the actual email account (Admin Panel > Emails > Emails > click an email). Updating the settings in the plugin instance is for Authentication (User/Agent SSO) only, not Authorization (Email Fetching/Sending).

We are currently working on official documentation as well as videos on how to set all this up for each provider. Once those are released it should better explain how to configure everything.

Cheers.

ntozier

Short version
please download both the product, plugins, language packs, etc from the product distribution site.
osticket.com/download

ealtman

I downloaded from the regular downloads page and installed the system and the plugin. Here's where I am:
I have been able to complete the connection to my institution's Azure with the help of the AD/Azure admin. I was able to get the remote mailbox OAUTH connection for the mail support email set up. But I am having trouble with the SMTP part. I clear the connection and get the token:

But then I click Save Changes and see this:

The scopes we have set (we kept adding them gradually because this failure kept happening) are:

offline_access
https://outlook.office.com/Mail.ReadWrite
https://outlook.office.com/SMTP.Send
https://outlook.office.com/IMAP.AccessAsUser.All
https://outlook.office.com/Mail.Send
https://outlook.office.com/User.Read
email
openid
profile

Any idea what could be happening?

Elizabeth

KevinTheJedi

ealtman

Have you enabled Access Tokens and ID Tokens under the Authentication Tab in Azure Portal? (Click Azure Active Directory service, click App registrations, click your app, click the Authentication tab, and then scroll down to the Implicit grant and hybrid flows section)

Cheers.

ealtman

KevinTheJedi The Azure/AD administrator says yes. And I see the token in the popup window. Is there something I've neglected to make writeable in my system? Do I need to touch ssl.conf or the sendmail configuration on the server?

KevinTheJedi

ealtman

No, if you are setting up SMTP then it should not touch sendmail at all; it will use the mail server you configured.

Cheers.

KevinTheJedi

@ealtman

Are you sure you authorized the right account? Like when you were redirected to MS to login, did you login to the email account you are setting up in osTicket?

You can follow the pre-release docs here for a better guide (although it might change in the future):

https://github.com/osTicket/docs/blob/9798d2eaebe5a9e99ba7fca7e973ad4995538055/OAuth2/Microsoft%20Authorization%20Guide.rst

Cheers.

ealtman

KevinTheJedi I have authorized the right account and yes. Thank you for the new docs. I am going to start a new thread if that's ok.