OAuth SCP login redirecting to Client page: Page 4

OAuth SCP login redirecting to Client page

bugeater87

Has anyone found a solution to the original OP? I've done all the upgrades, deleted and recreated the setup. Modified the claims. No matter what, the login works but then OSTicket just goes to the client page instead of logging into SCP.

KevinTheJedi

bugeater87

Have you tried this?

https://stackoverflow.com/questions/29822686/curl-error-60-ssl-certificate-unable-to-get-local-issuer-certificate

Also, are you certain you have URL Rewrite module installed/enabled on your web server?

Cheers.

bugeater87

Yes.

This is Apache on Windows with PHP 8. PHP info shows mod_rewrite installed. All Apache Allowoveride statements are set to all. I have the curl.cainfo and openssl.cainfo directed to the downloaded PEM file.

no errors in the php_errors.log

The access log shows
"GET /scp/login.php HTTP/1.1" 200 7042
"GET /scp/login.php?do=ext&bk=oauth2.agent.p4i3 HTTP/1.1" 302 13
"GET /api/auth/oauth2?code=0.ARwAa4..........................

in error.log, I get AH01991: SSL input filter read failed.

My thought is that for some reason it is not reading the openssl.cainfo/curl.cainfo PEM file. Verified it has read access to all users. But can't figure out how to test to make sure this is not the problem.

The only other thing is I use base defaults in the apache httpd.conf for the site reference and do not specify a virtual host config.

As an FYI - I know it is separate config, but email fetch via OAUTH is working.

Any other thoughts on where else to look?

Server Information
osTicket Version v1.17.4 (ea462cb) — v1.17.5 is available
Web Server Software Apache/2.4.53 (Win64) OpenSSL/1.1.1o PHP/8.0.25
MySQL Version 5.5.65
PHP Version 8.0.25
PHP Extensions
gdlib Used for image manipulation and PDF printing
imap Used for email fetching
xml XML API
xml-dom Used for HTML email processing
json Improves performance creating and processing JSON
mbstring Highly recommended for non western european language content
phar Highly recommended for plugins and language packs
intl Highly recommended for non western european language content
fileinfo Used to detect file types for uploads
zip Used for ticket and task exporting
APCu Improves overall performance
Zend Opcache Improves overall performance
PHP Settings
cgi.fix_pathinfo "1" is recommended if AJAX is not working
date.timezone America/Denver

KevinTheJedi

bugeater87

Does the URL you are using to sign-in match the Redirect URI in the plugin instance config and the Entra App Registration? Do you have the User.Read permissions enabled and Admin Consented in the Entra App Registration?

Cheers.

bugeater87

in Azure app registration, Authentication->Web Redirect URI and in OSTicket redirect URI endpoint are https://requests.wncc.edu/api/auth/oauth2

m56no79vh

I'm having issues with oauth2 client authenticating against WildApricot for user authentication. I have separately set up Google Workspace oauth2 authentication for agent authentication which is working fine. But when authentication is attempted for the user portal it fails each time. I have spent several days trying to figure out what is failing. It appears that the oauth2.agent.p7i6 session is created in the osTicket database under user sessions after getting redirected to the Wildapricot login screen and am redirected to the /api/auth/oauth2?state=xxx&code=xxx but in SAML tracer I then just see an immediate redirect to "/" instead of trying to get the token from WildApricot.

Based on the WildApricot SSO documentation, it appears that they do not support GET but instead require the token request to use Post. Does osTicket's oauth2 implemenation support POST? The requests I am seeing using SAML tracer are showing all GET requests which I suspect is the reason my authentication keeps sending me back to the new ticket page. Any help would be appreciated on this!

m56no79vh

Here's the Wildapricot documentation for their SSO:
https://gethelp.wildapricot.com/en/articles/200-single-sign-on-service-sso#request

KevinTheJedi

m56no79vh

I do not think the method is the issue. When looking at the League/OAuth2 package they seemingly use POST for token requests.

So you’re saying Agent login with SSO works with no issues however Users using that very same SSO instance is not working?

Cheers.

m56no79vh

KevinTheJedi No, actually I am only using Google Workspace for the agent login with a completely separate oauth2 instance. That's working without issue. Probably not relevant to the conversation here so I probably could have just left that part out... :-)

My problem is for the user logins I'm trying to use WildApricot and THAT is the part which is not working.

So the osTicket implementation is based on League/OAuth2? (That may help me to dig in with their support at least...)

Unfortunately I'm not seeing anything really helpful in logs that suggest anything to look at... Is there a way to enable oauth2 debug logging for the redirects and such on the back end of the server? I'm using SAML-Tracer plugin in Firefox but so far it doesn't tell me anything about why it's redirecting back to the main landing page. I'm not able to see any requests for the token either.

So one thing that may be relevant-I am running an Apache reverse proxy in front of my server on a single external address which passes different hostname traffic through to different internal servers in my network depending on the hostname... Do I need to make any additional changes to my config on the proxy or on my osTicket server to accomodate the traffic going through the reverse proxy? Is it possible that the reverse proxy is causing an issue with the redirects?

KevinTheJedi

m56no79vh

Have you tried unpacking the plugin and adding debug statements to the part that handles the redirect? This could give you further insight.

Cheers.

KevinTheJedi

m56no79vh

Also yes, when running a proxy you need to look into this setting and update it accordingly:

https://github.com/osTicket/osTicket/blob/develop/include/ost-sampleconfig.php#L117-L136

Cheers.

« Previous Page