"cannot login, user or password wrong" IMAP 143 with Exchange

deepoisa

Trying to connect to Exchange using port 143. IMAP is enabled in exchange, port is set correctly. Firewall is accepting 143. It is not blocking and it worked before upgrading to 1.17.

Now when saving authentication parameters it shows:

Passwort has been reset to be sure, doesnt contain special characters as seen in another thread.

Any idea what we are doing wrong?

KevinTheJedi

deepoisa

MS disabled basic auth nearly a month ago. You'll need to use OAuth2 (Modern Authentication). Follow the docs here:

https://docs.osticket.com/en/latest/OAuth2/Microsoft%20Authorization%20Guide.html

Cheers.

deepoisa

Thank you for the reply.

I forgot to mention we are using exchange on-premise in that case.

We also have another adress using office365 with oauth2 running succesfully, thats why we upgraded. But since then the other one isn't working anymore with port 143 to the on-premise exchange.

Regards

KevinTheJedi

deepoisa

I would not use 143 that is an unencrypted IMAP port. I would use 993 as the port for IMAP - this uses SSL.

Cheers.

deepoisa

That's exactly what I thought too after upgrading to osTicket 1.17 and seeing that unencrypted 143 failed.

So I tried with 993, installed the certificate from our own internal certificate authority, but:

We tried adding a ssl:// or tls:// in front of the servername. Didn't help.
Tried reissueing the certificate from target server, didn't help.(Also making sure the is no mismatch in CN etc.)
Tried installing the certificate in any of the available folder in Windows Computer Certificates, didn't help.
CA certificate is installed.

Firewall isn't blocking according to logs. Port is accepted. Can reach the target server through other protocols.

We are using IIS(unfortunately we have to).
Is osTicket using openssl, so using a selfsigned certificate will not work as openssl doesnt use the windows certificate store?
Checking the connection with "openssl s_client -connect server:993" will fail with "unable to get local issuer certificate" which as I understand is normal. Because it doesnt know about my self signed certificate in the windows computer certificates.

I will try to put all 3 certificates I need into a single .pem, so I can use curl.cainfo in php.ini to make the certificates available. But this is not really helpful as no one in my company will be able to manage this when certificate are out of date.

Sorry for the long post.

Regards

deepoisa

So I tried that, put all my certificates into one .pem, added it to php.ini:

curl.cainfo="C:/Support/Zertifikate/cacert.pem"
openssl.cafile="C:/Support/Zertifikate/cacert.pem"

Now when I try to save the mail configuration it shows:

cannot login, user or password wrong

I can succesfully login to the account using this password and user has IMAP enabled.
PHP-log shows nothing.

KevinTheJedi

deepoisa

Basic Auth is disabled for your tenant. You need to setup Modern Auth. Please follow our docs for step-by-step instructions.

Cheers.

deepoisa

Nope 😃

deepoisa

KevinTheJedi

deepoisa

Then you can upgrade to tip of 1.17.x and try again:

https://github.com/osTicket/osTicket/issues/6295#issuecomment-1272563459

If that doesn’t work then you must contact your mail provider for further assistance. Maybe you are using self-signed certificates and it’s not liking that?

Cheers.

deepoisa

Thank you, I tried a fresh installation of 1.17.X with new db on same webserver. Because I was thinking about creating a new installation anyway. But again, same result; "cannot login, user or password wrong".
Will try another user with another mailbox now.

We are running our own mail server so we don't have a mail provider or anyone else offering us 3-level support for that.

deepoisa

new user/mailbox with port 993 or 143 -> same result
So i'm not sure if it is certificate related.

KevinTheJedi

deepoisa

When you get that error that means either the username/password is incorrect or your server doesn't allow basic authentication. Other than that you'll have to debug on your mailserver why it's not allowing the authentication to succeed.

Cheers.

deepoisa

Found the solution:
We have a subdomain int.* which we are using internally. The mailadresses dont use this subdomain obviously. So the mailbox had the adress helpdesk@mycompany.ch. But the users UPN is helpdesk@int.mycompany.ch.

For the authentication in osticket settings I had to enter "INT.MYCOMPANY.CH\helpdesk" as username. It didn't work any other way. It didn't work with helpdesk@int.mycompany.ch for example. So my issue was AD and Exchange related.

Maybe this can be a guide for someone in the future.

Cheers