Oauth - Microsoft - osTicket Forum

Oauth - Microsoft

OpenSourcerer

I imagine there's a few people who upgraded to 1.17 just now and are having trouble with the email authentication.

I think I have most of the settings correctly configured. It does correctly go through the workflow of moving to microsoft's site to authenticate. If I put in the wrong password it says no, and if I put the correct one in it
(correctly) redirects me to the endpoint authentication on my OsTicket installation. The trouble is, I'm getting a 404 not found error for the oath api endpoint. I found another thread here that mentioned this is a modrewrite problem, so i checked and it was enabled (sudo a2enmod rewrite)

Any other ideas what could be happening? I don't see anything in the error.log or access.log that are helpful either.

OpenSourcerer

After correct login:

After Redirect:

and the access log from that 404 is:

10.1.0.001 - - [19/Oct/2022:11:02:09 -0500] "GET /api/auth/oauth2?code=0.AVsAjDm-IFvhpxtohYKXXXXXXXXXXXezVbAD4.AgABAAIAAAD--DLA3VO7QrddgJg7WevrAgDs_wQA9P8y2tt5FQ0EfnBAnKA4xRBRUSX2ngCbBsjSI37qwM0Z7-rYhuUcdG3fXXXXXXXXXXXXXXXXU8R7x3PtNGGEtw6ljxxsounTTp79Ib-xvjHQSHD9q3tQQ9NMKufnM1XAOxWUznn33PSDqpWpDI12GLsR1dszO3R5xZtgezNjmiIiAhcVotlx7uZZGmflFKmqq-9Nu17rPbKIpyG4BVCKeufW8pHfm3y9Yc76XO0bIXGQi4PItPcN5N5K8L1-uJzzpGzfoh6Ij1CDEiuNINVl HTTP/1.1" 404 850 "https://login.microsoftonline.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36"

KevinTheJedi

OpenSourcerer

Please search older threads before making a post. There are about 20 threads on this already. Anyways URL Rewriting is not enabled on your webserver. Please look at the older threads or google "how to enable url rewriting on xxx" where "xxx" is your webserver OS (apache, nginx, iis).

Cheers.

OpenSourcerer

KevinTheJedi I don't want to be combative, but I did say in my post i found that thread, and specifically made sure modrewrite was enabled BEFORE posting this.

KevinTheJedi

OpenSourcerer

No that’s fine.

If you get “Not found” then that definitely means URL Rewriting is not working properly on your webserver.

Cheers.

KevinTheJedi

OpenSourcerer

If you use IIS then we ship with web.config that should be loaded by IIS. Which it appears your instance is not loading this properly.

Cheers.

jvogt

I am having the same issue on Ubuntu

KevinTheJedi

jvogt

Please see the below snippet from my previous response:

Please look at the older threads or google "how to enable url rewriting on xxx" where "xxx" is your webserver OS (apache, nginx, iis).

URL Rewriting is not enabled or not working properly on your webserver. If you are using Ubuntu then I assume you use Apache and if that's the case you'll need to enable the rewrite module. There are many guides online that explain how to do this.

Cheers.

KevinTheJedi

@OpenSourcerer

Here is a post from a community member about IIS that might help you:

https://forum.osticket.com/d/96893-basic-authentication-retirement-for-legacy-protocols-in-exchange-online/219

Cheers.

OpenSourcerer

KevinTheJedi
I got the authentication piece working, but now I can't get the email fetching to work!

I did get a good token to use for this mailbox:

But then when I try to enable email fetching it wants some other mailbox settings:

So if I put in the old IMAP settings, it just says that it can't authenticate.

What else can I check? Am I missing something obvious?

KevinTheJedi

OpenSourcerer

Did you follow our documentation to a "T"? Reason I ask is it appears you didn't add the appropriate API Permissions in the Azure App. If you did add all the appropriate API Permissions in the Azure App and you Admin Consented to those API Permissions then you can only contact MS for further assistance.

Cheers.

OpenSourcerer

KevinTheJedi

It looks like I have all the API permissions:

Is there someplace I can look to see what error messages are being thrown? I'm confident that the authenticate piece is working. Its just the mail fetch that isn't... But i can't see anything that is happening on the backend to tell if it's an issue on MS side, or on OsT side.

Also, is it supposed to create 2 entries in the DB for the one email address? After creating this email address, there's now two "email_id=26" in the ost_email_account table:

KevinTheJedi

OpenSourcerer

You’ll need to look at the logs on MS end. Also yes two entries as one is mailbox and one is smtp. Different backends and configs so different records.

Cheers.

KevinTheJedi

OpenSourcerer

What does the config look like in osticket? Like what scopes, etc.

Cheers.

OpenSourcerer

KevinTheJedi

I got the email working, but i can't say for sure what fixed it. I hadn't changed any of the Azure portal settings and just deleted and recreated the email queue using an identical process a few times. One time it worked. Can't say for sure what fixed it.

If i had to hazard a guess, it would be that either there is some delay between when you grant the api permissions and the client gets them; or if you grant the api permissions, you need a new a new oauth token after that.

KevinTheJedi

OpenSourcerer

That's what I've found. When you add new permissions or make any changes to the permissions you need new token or new secret. It seems secrets hold onto old permissions.

Cheers.