OAuth2 not redirecting | IIS 10 PHP 8.x

Unai

Hi,
Im trying to set-up an email and having trouble in the last part of the authentication. I mean, I try to authenticate and to proceed with all the steps setting up the different parts in the token, client ID, secret ID, etc... Once I go to the Microsoft login page and enter the email I have set up for the page and accept the authorization in it, I get redirected to a 404 error page. I have followed different discussions and set up everything on Azure and IIS but I can't pass from this error.
Im desperated for an answer.

Thanks beforehand.

KevinTheJedi

Unai

URL Rewriting is not enabled on your server.

Cheers.

Unai

KevinTheJedi From what I know it should be enabled.

KevinTheJedi

Unai

Please look at the other threads on this or google "how to enable url rewriting on iis".

Cheers.

Unai

KevinTheJedi

If these files aooear does it mean it's enabled?

KevinTheJedi

Unai

I would assume so but I'm no IIS expert. If you get 404 then that means they aren't working appropriately.

Cheers.

Unai

KevinTheJedi Then I can't seem to find an answer to my error as these have appeared from the beginning.

Seems like I won't find an answer to my error.

Thanks for the try!

Unai

KevinTheJedi

Seems like adding this lines to the .htaccess in the "Include" folder fixed the problem.

Just showing the answer if someone sees this.

ntozier

I'm confused about this thread.
You said that you were running IIS and then posted information about Apache.
Did you switch from IIS to Apache or something?

brunotg

I am with the same problem with IIS. Rewrite is enable but i dont know what rule need to be setting.

Any news about that?

KevinTheJedi

brunotg

If it’s enabled properly it should automatically pick up the web.config we ship with.

Cheers.

bc_admin

Hi,
Authorisation with oauth2 worked very well on our company but since last week the tokens didn't renew automaticaly.
On doing it manually we were redirected to starting page and nothing happened.

I tried different suggested solutions from forum but nothing helped.
I think URL Rewrite is active but don't know how to check and if the right web.config is used - but since there were no changes from our side, I belive they working fine.

KevinTheJedi

bc_admin

Seems like something isn't configured properly. I would check your logs (general server logs, webserver error logs, PHP error logs, MySQL/MariaDB error logs, osTicket System Logs, Browser Console logs, etc.) for any related errors.

Cheers.

bc_admin

KevinTheJedi

Didn't find anything which will help me to solve the problem.

Server logs are fine, no PHP log file in Folder,
Webserver logs show the urls and at least the GET /osTicket/api/auth/oauth2 code=XXXXXXXX and GET /osticket/ - 80 -

I'm not very familiar with this configurations. Do you have any idea or other suggest that will help me.
As I said, there haven't been any changes from our site

KevinTheJedi

bc_admin

That definitely means something isn’t configured correctly or you have a URL mismatch. When doing the email config what’s the hostname you are using in the browser?

Cheers.

bc_admin

Hi,
I tried upgrade MSSQL and PHP to latest version with no result.
Also I added a new MS App to test.

Still the same behavior.
It realy seems to be the Redirect-URL which makes troubles suddenly.
"http://localhost/osTicket/api/auth/oauth2" -> MS Authentication works (verified in Azure) -> Back to osTicket and it gets me to "http://localhost/osticket/"

KevinTheJedi

bc_admin

You say http://localhost/osTicket/api/auth/oauth2 then you say it brings you to http://localhost/osticket/. Is your webserver case sensitive? Also, please post a screenshot of the URL when you are submitting the popup from osTicket, a screenshot of your osTicket OAuth2 config, and a screenshot of your Redirect URI configuration in the App Registration.

Cheers.

bc_admin

KevinTheJedi
tested it but it is not case sensitive!

I tried a new installation of osTicket with a new DB and eMail-Konfiguration works fine. I have taken the same settings on both osTickets-Installation.
After I updated the tables in the Database excepting config, plugins, etc... the redirection doesn't work anymore.

So this must be due to an wrong entry in one table!

Tables which I have not migrated:
ost_syslog
ost_session
ost_schedule_entry
ost_schedule
ost_role
ost_plugin_instance
ost_plugin
ost_lock
ost_list_items
ost_list
ost_group
ost_filter_rule
ost_filter_action
ost_filter
ost_email_template_group
ost_email_template
ost_email_account
ost_email
ost_draft
ost_department
ost_content
ost_config
ost_canned_response
ost_api_key

jeffgumbel

We are having the same issue. We upgraded our existing OSTicket instance. We are on IIS and was seeing the 404 error with the web.config in place, then we installed the URL Rewrite for IIS and the system did not error, however, when we log on to our /scp site and we login with Azure the authentication works, but we are taken back to the /scp login page. If I grab a URL of a ticket https://helpdesk.iecc.edu/scp/tickets.php?id=29035 then it still redirects to the login page. We are using the shipped web.config, no changes. The authentication with Azure is working.
Other notes:
1) We can still get in as our local admin account, however, disabling Oath2 and trying to use our ldap auth method in place will not allow login. We cannot disable Oath2 and revert to our LDAP auth as in the past, it will not work, I suspect because of the Rewrite issue, just spins.
2) Under agent accounts there is no longer any kind of "Save" option so I cannot make any changes to an agent. I thought maybe the username needed to be the full email, but you cannot save, so any existing agent the Save nor any other buttons show.
3) There seems to be some issues even when in as the local admin account with saving.
Sadly we had to revert back to our old install until this can be resolved.

KevinTheJedi

jeffgumbel

You will need to check your logs (general server logs, webserver error logs, PHP error logs, MySQL/MariaDB error logs, osTicket System Logs, Browser Console logs, etc.) for any related errors.

Have you updated your plugins to the latest ones?

Can you check the backend of the agents that can’t login? Go to the database, go to the staff table, and look at the value of the backend column.

Cheers.

jeffgumbel

KevinTheJedi

jeffgumbel

You still need to check what I mentioned above.

Also, are you using v1.17.2 and the latest versions of the plugins?

Lastly, as long as the attributes are correct in your OAuth2 config it should allow the username and email address.

Cheers.