SMTP Authentication Failed: Page 2

SMTP Authentication Failed

ntozier

Did you follow the steps in the docs?

Microsoft Authorization Guide.
https://docs.osticket.com/en/latest/OAuth2/Microsoft%20Authorization%20Guide.html

jvankempen

ntozier I did follow this manual to the letter. I had 'basic auth' and changed it to OAUTH2 using this manual and I can pull mails from IMAP. For me this means OAUTH2 is working, only sending mails using the same credentials gives this error. The only odd thing I have found is that I don´t have the option "consent on behalf of your organisation" thick box in this screen.

Unfortunately I cannot use anonymous because I have external (not same domain) users mailing through osTicket.

KevinTheJedi

jvankempen

I would reach out to MS then as you should be able to use the same OAuth2 token for IMAP and SMTP if you set the API permissions appropriately and have SMTP enabled. I have this working with my O365 developer account with no issues.

Cheers.

ntozier

Hmmm. I'm really curious why you do not have the consent button.
Out of curiosity what Roles does your M365 account have?

jvankempen

ntozier
I'm sorry for the delay!

I've asked my external partner to look into this issue with me and we kind of fixed this by adding de "application managers" role to the account. There was also a discrepancy between the users UPN (username) and the actual e-mail address it uses. We changed the username to be the same as the e-mail address and it works now.

I've never seen the checkbox "consent on behalf of your organisation" during this process.

olliez0r

Having the exact same issue. Followed the setup guide to the letter; OAth for remote mailbox is working fine. When I go to set up outgoing SMTP, I try "same as remote mailbox" initially, which fails. Then configure Microsoft OAuth, even tried with its own secret and it fails every time - 5.7.3 Authentication unsuccessful.

I've ensured that the account has authenticated SMTP enabled. I've even added the azure application for OSTicket as a service principal for exchange and assigned to the account - no joy 🙁

I have patched includes/class.mail.php as I was just getting error 500 after the upgrade to 10.17 from 10.17.x branch if that is relevant.

It DOES display the green OAuth successful banner after completing the config and signing in/consenting, and a valid token is displayed in the OAuth config, but it displays "5.7.3 Authentication unsuccessful" when I click "Save Changes"

KevinTheJedi

olliez0r

You will need to reach out to MS for further assistance. Me and many others have no issues with O365 SMTP with OAuth2.

Cheers.

olliez0r

KevinTheJedi It strikes me as everything being fine with Microsoft, though - OAuth reports successful after the config and there's a token successfully obtained; does the save changes button just reverify the info and commit to DB, or is there some kind of different authentication process taking place on save changes for SMTP compared to remote mailbox?

KevinTheJedi

olliez0r

When saving the page it will attempt to authenticate to IMAP/POP (if enabled) then do SMTP (if enabled). I have no issues using the "Same as remote mailbox" authentication option with SMTP enabled. I use outlook.office365.com and port 587 for SMTP.

Cheers.

Glennbullion

Just wanted to add some details for this, as I'm having similar issues.

I have 3 departments (Parts, Sales, Service). Each with their own email addresses. I know I didn't need to, but I went and created secrets for all as well.

Receiving mail through OAuth with all 3 addresses works fine.

However, like others above, having issues with SMTP with "Same as Remote Mailbox" selected, BUT only for Sales and Service. The Parts email with OAuth SMTP works perfectly fine. So, I'm trying to figure out what is different between Parts and Sale / Service. Using SMTP Legacy as a workaround for now.

But indeed, I have to assume from the above symptoms for me that it is something with the accounts not quite right.

Glennbullion

More data. Note, this might just apply to me.

As noted above, I have 3 addresses through OAuth. 1 works completely fine. 2 work on receiving email, but not sending through SMTP. I have a bit more testing to do, but I did figure something out.

On the two that aren't working, the login used isn't the same as the primary email address. For our "Parts" box, the email and logon is both "parts@domain.com". That one is working fine.

On the two that aren't working, the logons are "salestickets@domain.com", while the primary email address is "sales@domain.com". Once I lined those up properly, things started working.

olliez0r

That's an interesting thought Glennbullion, we use alias logins; as our UPNs differ from the primary SMTP address. I'll try changing the UPN to match and see if that helps when I get a spare moment.

Edit - I found that moment, and it's sorted it. Legend! Might be worth adding something to the docu about ensuring the email address/login name are the same?

KevinTheJedi

olliez0r

It is clearly stated here:

https://docs.osticket.com/en/latest/OAuth2/Microsoft%20Authorization%20Guide.html

Here it is very important to login to the email you are trying to configure in the helpdesk.

Cheers.

KevinTheJedi

jvankempen

It's hit or miss. Also, with v1.17.2 and the latest OAuth2 plugin we removed the consent prompt and allow you to authorize with any global admin.

Cheers.

mbanyard

There still seems to be an issue when it comes to Shared Mailboxes.

Normal M365 mailboxes work great with the new OAuth2 plugin and v1.17.2

Its been raised in other posts and is so close to working fully, but the only remaining issue seems to be with the Outgoing SMTP when using OAuth2 to send from a Shared Mailbox.

Can this be looked into as Microsoft are now actively disabling Exchange Online Basic Auth and this will be disabled on ALL M365 tenants in the next couple of days without any way of enabling it on a tenant again.

I've tested this with the latest plugin from the downloads page as well as the one from Peter Rotich's fork for his development https://github.com/protich/osTicket-plugins/tree/plugins/auth-oauth2_strict-mode and both do the same.

KevinTheJedi

mbanyard

See here:

https://forum.osticket.com/d/102129-osticket-o365-e-mail-retrieval-sending-stopped-working/61

If all else fails contact MS and they’ll likely tell you it’s not possible with shared mailboxes.

Cheers.

mbanyard

KevinTheJedi
You can send from a Shared Mailbox via OAuth2
https://learn.microsoft.com/en-us/exchange/client-developer/legacy-protocols/how-to-authenticate-an-imap-pop-smtp-application-by-using-oauth#smtp-protocol-exchange

Please see this post which is for the same issue
https://forum.osticket.com/d/101462-oauth2-shared-mailboxes/22

It would be great to get this fixed as it is so close to be 100% complete.

KevinTheJedi

mbanyard

Already fixed with:

https://github.com/osTicket/osTicket-plugins/pull/254

I guess I should provide a little context. Before this change if you get a token with an account that’s not the email itself we’d use that account in the auth string which can cause issues. With the change it will use the email itself in the auth string regardless of what account you consent with.

It may require you to get a new token as the current one will be incorrect. I believe you can also update the associated config record to change the resource_owner to the email itself.

Cheers.

« Previous Page