Error 404 when trying to configure 0auth2 with Microsoft O365 using IIS 8

jbeaudion

KevinTheJedi That explains a lot, because I basically "stole" those rewrite rules from my instance that did work, but I had no idea how they got there to begin with. 😅

KevinTheJedi

jbeaudion

I'm a complete IIS noob so I totally didn't realize that my instance already had this module installed so I couldn't replicate the issue. But after I saw your post I was like hmm let me check and sure enough it was already installed and reading the web.config so that's why mine was working already. Glad everything was worked out and it's not too big of an issue 😅

Cheers.

UnderDogMiller

I am having this exact issue. I installed the URL Rewrite too for IIS on Windows Server 2019. I still get the 404 error on the redirect for OAuth2. I looked over this thread too: https://forum.osticket.com/d/101298-oauth2-microsoft-not-working.
The URL Redirect add-in does work for redirection from HTTP to HTTPS so I know it works.

KevinTheJedi

UnderDogMiller

Well that error says otherwise. 404 means not found which means the url isn’t being rewritten.

Cheers.

UnderDogMiller

Correct - the 404 error didn't change after adding the Rewrite tool. However - the rewrite tool is working to REDIRECT (not rewrite) http to https redirects. Thus, I am missing something. I saw a previous post where someone had inserted all the custom rules for the rewrite. I guess I am not sure how to troubleshoot the rewrite tool to ensure it is rewriting URL's. Here is my redirect rule that works for http to https:

ramrajone

UnderDogMiller

You can take a look at
https://learn.microsoft.com/en-us/iis/extensions/url-rewrite-module/using-failed-request-tracing-to-trace-rewrite-rules?source=recommendations

https://learn.microsoft.com/en-us/iis/extensions/url-rewrite-module/testing-rewrite-rule-patterns

This one works for you, in case you want to double-check:
https://howtohelpdesk.com/how-to-redirect-http-to-https-in-iis/

UnderDogMiller

I'm getting closer - now instead of the 404 error I get: URL not supported.

UnderDogMiller

I'm going to drive myself insane...and probably you guys too.
I decided to remove the plugin and start from scratch...but now I get a blank banner when configuring the OAuth2 (clicking the "config" button) as shown here:

KevinTheJedi

UnderDogMiller

Look at your logs (general server logs, webserver error logs, PHP error logs, MySQL/MariaDB error logs, osTicket System Logs, Browser Console logs, etc.) for any related errors.

Cheers.

jiggs

UnderDogMiller
When this happened to me I had to totally delete the email and then re-add it. In my case it was the "Default" email account, so I couldn't delete it until I set a different email as the default in "email > settings". If that fails you'd have to delete the entry in the database for the email account with phpmyadmin or something similar to make it easier to find the entry.

UnderDogMiller

jiggs - thanks that helped me get things back - but now I still get the "URL Not Supported" message after clicking submit and authenticating with our 365 account. I'm using the email account credentials for the email address that I'm working with.. It is the Redirect URI field... the very first field that contains: https://support.company.local/api/auth/oauth2. When I put this into Chrome - it says: "URL Not Supported."

KevinTheJedi

UnderDogMiller

URL Rewriting is not enabled or not working in your instance. You will need to search online on how to enable this in your environment (it differs depending on the server and setup).

Cheers.

UnderDogMiller

KevinTheJedi - thanks for the quick reply. It does seem like the rewrite is working because the "URL Not Supported" is not coming from IIS or the client browser, but from the class.dispatcher.php code in the include folder.

KevinTheJedi

UnderDogMiller

I see, read that wrong, thought it was "not found". That typically means the URL you are attempting to visit can’t be found in the available rules. The rules are setup in the plugin and should be working properly. If not then something deeper is going on.

Cheers.

UnderDogMiller

KevinTheJedi How do I find the rules? This is what I show in our Plugin setup for OAuth2 - under the Config tab:

Also - my comment from earlier about responding so quickly was meant as a compliment. I know you are not obligated to answer me in a timely manner or even at all. So I am super appreciative of the timely and thorough responses from you and all the community members!

KevinTheJedi

UnderDogMiller

I don’t know how that happened, that last part was meant for another thread entirely. My apologies. I edited my previous reply to remove that part. Someone else was being rude, not you lol

The rules are registered in the plugin code itself. You can see it here:

https://github.com/osTicket/osTicket-plugins/blob/develop/auth-oauth2/auth.php#L26

So it’s looking for "/api/auth/oauth2".

Cheers.

UnderDogMiller

KevinTheJedi Well and that is what I have in the URL. So - as you said, it seems like something deeper is going on {sigh}.

KevinTheJedi

UnderDogMiller

Make sure the files aren’t corrupted somehow, make sure your webserver is not blocking the URL or mangling it, check your server logs to see if anything is being logged, etc. I would also make sure your registered app in azure has the correct url configured.

You can also try downloading the raw plugin files from GitHub, uploading the raw auth-oauth2 folder to your plugin folder, moving the phar plugin outside the plugin directory, going to your database.ost_plugin table, set isphar to 0 for that plugin, and retest.

Cheers.

UnderDogMiller

OK - I'm revisiting this now that PHP is configured and working correctly. I tried the settings again and it still returns with "URL not supported." I'll keep digging but let me know if you have any insight.

ntozier

Honestly I had a really hard time trying to get IIS working with PHP 8+ and gave up.
After over 10 years of running osTicket under IIS, I switched to Apache.
I figure that is not the answer that you want to hear, but you might want to consider the option.

UnderDogMiller

ntozier Yeah - not a great answer. There has to be a solution.