dschuett
This is spot on. In my environment, the application registration is configured with all the relevant rights, admin consent is granted, and our admin consent configuration should not require this application to have admin consent performed as all the permissions have been set to allow for user consent.

https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-auth-code-flow
The prompt field is optional, and as configured within osTicket, is forcing the consent dialog at each sign on attempt. I believe that the prompt=consent item needs to be removed.

https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-permissions-and-consent#requesting-individual-user-consent
If consent doesn't exist for the user, or admin consent doesn't exist, a user will be prompted for consent after successful auth. This does not require the prompt parameter to be set.

      bbour53

      We are not going to remove it but make it optional later in the future. We have the consent prompt to verify and make sure you are authorizing the right email. For now, you can simply remove it if you don't want/need it but we will make it optional later on.

      Cheers.

          KevinTheJedi
          I am an azure security administrator advising a user on setting up your application and do not have direct access or knowledge of your product. Could you elaborate on what you mean by "you can simply remove it" so that the user can configure your application properly for this use case?

          EDIT: Found the settings in the oauth2.php file: https://github.com/osTicket/osTicket-plugins/blob/develop/auth-oauth2/oauth2.php

          Note that if no administrator has performed admin consent for the application in the environment and users are permitted to perform consent for third party applications, they will still receive the consent prompt and confirmation of the email address without the prompt setting explicitly set. You may be better served using the prompt=login or prompt=select_account flags if that is your goal, not prompt=consent.

              I'm not sure if i'm going about this correctly but under the concept of removing the line we don't need I have tried following the instructions from https://github.com/osTicket/osTicket-plugins but I'm having some issues.

              I have downloaded the repo, successfully hydrated, then modified the oauth2.php to comment out line 640. I then ran the build command and it has given me an auth-oauth2.phar. I have copied this into my includes/plugin folder and successfully activated it in osTicket however when I then go to configure the authentication the popup box containing all the IDP info is just blank.

                4 days later

                I am experiencing the same issue as CPC

                I have ensured the plugin entries in the DB were cleared when I attempted removing the plugin to reinstall it.

                  For anyone else, TAS solved it.
                  Delete associated email from system, readd.

                    8 days later

                    bbour53

                    Good Afternoon,

                    You mention that you found the settings in the oauth2.php file (I also was able to locate within the file), but would you mind expanding on how you made the change (if you were able to)?

                        KevinTheJedi
                        bbour53

                        Hi,

                        I can confirm that setting prompt=login was the only way to make the plugin work with our Azure environment, even with discretionary user consent enabled.

                        Currently, it seems osTicket is unable to get an oAuth2 token from Azure as long as prompt=consent is used, as in Microsoft's implementation, this option is meant to require explicit/interactive admin approval for any new token issuance (see this link's last point). So unless I'm missing something, the current version of the plugin is unusable with Azure.

                        Setting prompt=login does fix this issue, while still enforcing user login to avoid using the wrong account. is it possible to push this change upstream in the plugin repository to avoid dealing with manual mods on future updates ?

                              marinbernard-pep06

                              Your statement is untrue. prompt=consent does work and will allow you to get a token. Maybe you have a different setup than most.

                              Cheers.

                                marinbernard-pep06
                                Thanks, I must be missing something because I tried using the make.php to make a new phar file, but kept getting an error about an unsupported make function, despite the function being listed in /help so I kinda gave up trying to remake it.

                                  8 days later

                                  I can confirm that setting prompt=login was the only way to make the plugin work with our Azure environment, even with discretionary user consent enabled.

                                  I couldn't find this option, could someone help from where I can make this change to give it a try?

                                    abeermuh

                                    It's in the plugin. You can unphar the plugin, change the plugin record in the database to remove .phar and change isphar to 0, then make the changes there.

                                    Cheers.

                                      I am not a programmer so unsure on how this can be done. If you could place some snapshots please?

                                      after making changes per Prompt = login , I had to reconfigure the Plugin from scratch also deleted the email address and added again, but after providing email address and password it redirects to localhost URL with the below error. Am i missing something?

                                        abeermuh

                                        You either messed something up or URL rewriting is not enabled on your webserver.

                                        Cheers.

                                          How and where I need to enable URL rewriting on webserver? I am running apache2 with php8.0

                                          Furthermore, I unphar the plugin , modified and made it .phar again instead of doing further changes on Database. So trying to work with .phar file after modifying it to "Prompt=login"