O365 OAuth Shared Mailbox issues

rhyoung

Server Information
osTicket Version v1.17 (1d8b790) — Up to date
Web Server Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/8.2.0RC3
MySQL Version 5.5.68
PHP Version 8.2.0RC3

With the discontinuation of basic auth for IMAP and POP, I have tried following various steps to set up OAuth for IMAP on a Shared Mailbox, but I keep getting one of three errors during email setup depending on my OAuth2 Authorization settings.

Invalid response received from Authorization Server. Expected JSON.
Email Mismatch: Expecting Authorization for it.operations@domain.tld not rhys.young@domain.tld
Redirects to osTicket login, doesn't provide onscreen error

This method appears to work if I was to go for user mailbox access, but it isn't working for my shared mailbox.

Any ideas?

Here are the settings I've tried so far and their outcomes.

================================================================================================================

Troubleshooting 1

Options:
Redirect URI https://support.domain.tld/api/auth/oauth2
Client ID {client_id}
Client Secret {client_secret}
Auth Endpoint https://login.microsoftonline.com/{tenant_id}/oauth2/v2.0/authorize
Token Endpoint https://login.microsoftonline.com/{tenant_id}/oauth2/v2.0/token
Resource Details https://outlook.office365.com/mail/itsupport@domain.tld/api/v2.0/me
Scopes https://outlook.office365.com/.default
Email Attribute EmailAddress

OUTCOME Invalid response received from Authorization Server. Expected JSON

================================================================================================================
Troubleshooting 2

Options:
Redirect URI https://support.domain.tld/api/auth/oauth2
Client ID {client_id}
Client Secret {client_secret}
Auth Endpoint https://login.microsoftonline.com/{tenant_id}/oauth2/v2.0/authorize
Token Endpoint https://login.microsoftonline.com/{tenant_id}/oauth2/v2.0/token
Resource Details https://outlook.office.com/api/v2.0/me
Scopes https://outlook.office365.com/.default
Email Attribute EmailAddress

OUTCOME Email Mismatch: Expecting Authorization for itsupport@domain.tld not administrator@domain.tld

================================================================================================================
Troubleshooting 3

Options:
Redirect URI https://support.domain.tld/api/auth/oauth2
Client ID {client_id}
Client Secret {client_secret}
Auth Endpoint https://login.microsoftonline.com/{tenant_id}/oauth2/v2.0/authorize
Token Endpoint https://login.microsoftonline.com/{tenant_id}/oauth2/v2.0/token
Resource Details https://outlook.office.com/api/v2.0/me
Scopes offline_access https://outlook.office.com/mail/itsupport@domain.tld/Mail.ReadWrite
Email Attribute EmailAddress

OUTCOME Redirects to osTicket login, doesn't provide onscreen error

RBGE

rhyoung

I'm not sure about this one - maybe sorting the other two will help here
It sounds like you're trying to authenticate with your account? When the prompt appears, you need to sign in as the shared mailbox. It may make things easier to temporarily allow user consent to apps at https://aad.portal.azure.com/#view/Microsoft_AAD_IAM/ConsentPoliciesMenuBlade/~/UserSettings (you can change it back afterwards).
It sounds like URL rewriting isn't enabled - if not, this needs set.

ntozier

rhyoung PHP Version 8.2.0RC3

I suspect that your problem is you appear to be running a beta version of PHP. I also dont think that osTicket supports a version of PHP over 8.1 at this time.

rhyoung

RBGE so I've had a look at your suggestions.

The shared mailbox doesn't have a username and password, how should I be authenticating with this? Allowing user consent to apps is already enabled.
I've checked the modules with httpd -M and the rewrite_module is listed.

RBGE

rhyoung

The shared mailbox will have an associated user account. Simply set a password on this account (the more complex the better), then sign in using it when setting up the OAuth2 plugin
The module being enabled doesn't mean it's active. Look in the config file for a line under your web server directory saying AllowRewrite - it'll probably say AllowRewrite None - change to AllowRewrite All and restart apache. Note that the config can be over-ridden in other directories, so if your website root is at /var/www/html, make sure to change the AllowRewrite line in that section. The /var/www part will be over-ridden by this.

websafe

I'm having the same problem with my Microsoft 365 shared mailbox.

Debian 11.5
PHP 8.1.11
osTicket v1.17

Email Mismatch: Expecting Authorization for support@contoso.com not ts@contoso.com.

support@contoso.com is my shared mailbox and ts@contoso.com in my normal mailbox, which has full permission to support@contoso.com.

Is there any solution for this problem?

ramrajone

websafe
Have you set a password on shared account? That's what you need to login as for OAuth

websafe

ramrajone Now this is VERY strange, because:

I didn't know a shared mailbox (an unlicensed one) can have an individual password (it appears it can have a password).
Microsoft suggests "Signing in: A shared mailbox is not intended for direct sign-in by its associated user account. You should always block sign-in for the shared mailbox account and keep it blocked." https://learn.microsoft.com/en-us/microsoft-365/admin/email/about-shared-mailboxes?view=o365-worldwide so this is the first time ever I've setup a password for a shared mailbox - I'm not sure this is safe?
All other apps never required a direct login for a shared mailbox, they were always using my licensed user login credentials to access a shared mailbox.

After I've setup a password for my unlicensed shared mailbox here: https://admin.microsoft.com/Adminportal/Home?source=applauncher#/users I've resubmitted the configuration in /scp/emails.php?id=1#mailbox and when the Microsoft 365 logon page appeared I've signed in with my shared mailbox email and the previously created password and the error disappeared!

Now I have to check if it really works ;-)

But still - Microsoft doesn't recommend direct sign-in for shared mailboxes.

Why is the forum asking me for I'm not a robot every few seconds while I'm writing this post?

websafe

websafe OK, I can confirm - sending (via Oauth2 thru Microsoft 365 shared mailbox with a dedicated password) is working and fetching is also working - but I had to ENABLE fetching again for this email, because it somehow got disabled during the configuration process.

AlanF

@websafe I'm having a similar issue, but with a regular account, not a shared mailbox, so I'm not sure if it's the same thing. When you say "fetching got disabled" do you mean on the OSTicket Remote Email tab or on the Azure side?

We had to temporarily grant rights on the help desk account to authorize apps, because when we tried to sign in with the help desk email and then use an Azure admin's account to authorize, we got the "Email Mismatch: Expecting Authorization for X not Y" error.

After that it successfully fetched emails one time. We can still send outgoing emails ok. However fetching of emails is no longer working, and I get an "AUTHENTICATE failed." error in OsTicket when I try to enable fetching on the remote email tab and click Save Changes. I don't know if that is because we turned off the app authorization rights for this user or if something else is going on. No errors are being logged by osTicket.

We are using outlook.office365.com, port 993, IMAP.

I tried POP on port 995, but that causes an error bar with no text in it:

KevinTheJedi

AlanF

I don't know if that is because we turned off the app authorization rights for this user or if something else is going on.

Then try reverting those changes and retest?

Cheers.

websafe

AlanF Fetching got disabled on the osTicket side somehow during the configuration process.

AlanF

Granting admin rights to an account is a pretty big deal in our domain. I'm surprised I was able to get it done to get the initial setup to work. The process should definitely NOT require the help desk's email account to be an Azure admin, but we tried everything else before turning that on temporarily.

Even if that fixes it, it doesn't get us anywhere as we can't leave that turned on. It doesn't make sense that removing that right would cause email fetching to fail. Should the authentication failure be getting logged anywhere?

KevinTheJedi

AlanF

This has been discussed many times before on here and Github. The restriction will be removed next release.

My suggestion was to see if it started working again and then you would definitively know if that's the cause of the issue or not.

Cheers.

AlanF

#@$#! - I walked away from the keyboard for a few minutes and something popped into my head. Given my issue with LDAP lookups not working on PHP 8.1 (https://forum.osticket.com/d/101561-ldap-doesnt-work-after-update/18) I thought... what about the PHP version?

I switched the site to PHP 8.1, the "Save Changes" worked without any issue, and when I ran the cron job at osticket\api\cron.php, it fetched email.

Then, to see what would happen, I switched it back to PHP 8.0. I disabled and re-enabled the email fetching and there was no error displayed. However running the Cron job didn't fetch emails.

So I switched back to PHP 8,1 and tried again. Still didn't fetch emails.

So running under 8.1, I disabled and re-enabled email fetching for the account.

The I re-ran the cron job and it fetched the emails.

EDIT: I just realized the command I used to call the CRON while running under PHP 8.0 was pointed at the PHP 8.1 directory, for what that is worth as far as it not fetching under 8.0. Still doesn't explain why I had to disable/reenable to get it work after switching the site back to 8.1