SMTP Authentication Failed

BrunoLopes

Hi Guys,

I'm having some issues with Oauth2 - Microsoft.
It seems OAuth2 - Microsoft goes thru and i'm able to receive email but the outgoing email (SMTP) is failing to Authenticate.
When i'm using the basic Authentication (Legacy) i have no issues at all, so i know the username and password is correct.

Let me know if you need more information about the system.

KevinTheJedi

BrunoLopes

Are you sure you added SMTP to the API Permission in the registered app? Did you also check to see if you did Admin Consent to the API Permissions? If all else fails it sounds like you need to contact your mail Administrator or mail provider for further assistance.

Cheers.

BrunoLopes

Yes, SMTP to the API Permission is added i double check the instructions in the wiki.
It seems my next step is raise with the Microsoft.

Thank you

romeopavel

BrunoLopes
Have you managed to solve anything ? I am in the exact situation as you, email fetch is working, but the SMTP is failing the authentication. API Permissions are set correctly.

BrunoLopes

No solution yet.
Please let me know if you do.

romeopavel

I am currently using anonymous SMTP as a workaround.. seems to be working fine. If you have the possibility to setup a receive connector on your O365 Exchange and set the scope to your outgoing IP address, this should work.

B0ydie

I have the same issue and I'm having to use SMTP legacy as a work around until someone works out why

pcjkollmorgen

I only tried this once but had the same error so I kept with a legacy SMTP server also.

In the oauth2 settings for the remote mailbox there is https://outlook.office.com/SMTP.send in the scopes

In the Azure AD app our 0365 admin says the SMTP.send permissions are set.

I'm not sure if it would make any difference to have only SMTP.send (not https://outlook.office.com) in the scopes setting in the oauth2 plugin for the remote mailing ?

KevinTheJedi

pcjkollmorgen

I don’t think that will work as it will use a different API instead of outlook api. Mixing scopes and apis doesn’t sound like it would fair well. But maybe worth a shot?

Cheers.

citking

Same problems here. Ended up setting up a local SMTP relay for the moment, but there is something broken with PEAR and SMTP TLS sending at the moment.

ntozier

Did you grant the account SMTP in their account in M365?

https://admin.microsoft.com/
Go to Users -> Active Users
Search for the user
click on them.
On the right hand pop up bar click on the Mail tab.
See Email Apps.
Click on Manage email Apps to change settings.

jvankempen

ntozier I have the exact same error and I've checked I enabled "All Apps" and this specific app. I also checked if I have have SmtpClientAuthenticationDisabled and the the answer is "False"

Get-TransportConfig | Format-List SmtpClientAuthenticationDisabled
SmtpClientAuthenticationDisabled : False

I'm a bit lost what to try next.

ntozier

Did you follow the steps in the docs?

Microsoft Authorization Guide.
https://docs.osticket.com/en/latest/OAuth2/Microsoft%20Authorization%20Guide.html

jvankempen

ntozier I did follow this manual to the letter. I had 'basic auth' and changed it to OAUTH2 using this manual and I can pull mails from IMAP. For me this means OAUTH2 is working, only sending mails using the same credentials gives this error. The only odd thing I have found is that I don´t have the option "consent on behalf of your organisation" thick box in this screen.

Unfortunately I cannot use anonymous because I have external (not same domain) users mailing through osTicket.

KevinTheJedi

jvankempen

I would reach out to MS then as you should be able to use the same OAuth2 token for IMAP and SMTP if you set the API permissions appropriately and have SMTP enabled. I have this working with my O365 developer account with no issues.

Cheers.

ntozier

Hmmm. I'm really curious why you do not have the consent button.
Out of curiosity what Roles does your M365 account have?

jvankempen

ntozier
I'm sorry for the delay!

I've asked my external partner to look into this issue with me and we kind of fixed this by adding de "application managers" role to the account. There was also a discrepancy between the users UPN (username) and the actual e-mail address it uses. We changed the username to be the same as the e-mail address and it works now.

I've never seen the checkbox "consent on behalf of your organisation" during this process.

olliez0r

Having the exact same issue. Followed the setup guide to the letter; OAth for remote mailbox is working fine. When I go to set up outgoing SMTP, I try "same as remote mailbox" initially, which fails. Then configure Microsoft OAuth, even tried with its own secret and it fails every time - 5.7.3 Authentication unsuccessful.

I've ensured that the account has authenticated SMTP enabled. I've even added the azure application for OSTicket as a service principal for exchange and assigned to the account - no joy 🙁

I have patched includes/class.mail.php as I was just getting error 500 after the upgrade to 10.17 from 10.17.x branch if that is relevant.

It DOES display the green OAuth successful banner after completing the config and signing in/consenting, and a valid token is displayed in the OAuth config, but it displays "5.7.3 Authentication unsuccessful" when I click "Save Changes"

KevinTheJedi

olliez0r

You will need to reach out to MS for further assistance. Me and many others have no issues with O365 SMTP with OAuth2.

Cheers.

olliez0r

KevinTheJedi It strikes me as everything being fine with Microsoft, though - OAuth reports successful after the config and there's a token successfully obtained; does the save changes button just reverify the info and commit to DB, or is there some kind of different authentication process taking place on save changes for SMTP compared to remote mailbox?

KevinTheJedi

olliez0r

When saving the page it will attempt to authenticate to IMAP/POP (if enabled) then do SMTP (if enabled). I have no issues using the "Same as remote mailbox" authentication option with SMTP enabled. I use outlook.office365.com and port 587 for SMTP.

Cheers.