OAuth SCP login redirecting to Client page

KevinTheJedi

Maybe it is, it was very early in the morning and I’m going off memory; my apologies.

You can try that as well. Can you try an incognito/private window and see? Maybe it’s holding on to an old session or something.

Cheers.

FIASJason

KevinTheJedi
I removed the SSO instance and the App registration, then rec-created everything following the guide. I'm still being redirected to the client login after attempting to log in with SSO.

I also tried an incognito window - same results.

I noticed these entries in my php80-errors.log - are they of any concern?
PHP Warning: PHP Startup: Unable to load dynamic library 'php_gd2.dll'
PHP Warning: PHP Startup: Unable to load dynamic library 'php_xmlrpc.dll'

KevinTheJedi

FIASJason

No those are irrelevant. I would check your other logs (general server logs, webserver error logs, PHP error logs, MySQL/MariaDB error logs, osTicket System Logs, Browser Console logs, etc.). Also don’t try to login with local creds first, just open a new incognito/private window and only test SSO.

Cheers.

FIASJason

KevinTheJedi

I've tested in an incognito window, SSO login only.

Chrome shows that the redirect is working OK, but it seems to have taken an incredibly long time (assuming I'm reading this right).

No errors in the MySQL log.
No errors in the osTicket System log
No errors in the browser console
No errors in the IIS logs

KevinTheJedi

FIASJason

That is definitely weird. Have you double checked your settings to ensure you have the correct Secret, Client ID, etc.? Can you explicitly set the Agent's backend to SSO and retest? Have you tried changing to PHP 8.1?

Cheers.

FIASJason

KevinTheJedi

I've updated to PHP 8.1.12

And set my agent login to SSO only

And I've just noticed that my username is not my email address (which is what I'd be using for SSO). I'll create a new agent and set their username to their email address and try again.

I really hope it wasn't something that simple...

[Edit] It looks like I can't use the @ symbol in the username field.

FIASJason

Client ID/Secrets etc match:

Whitebread

Hello,
just asking if you have an update @FIASJason on this issue? I have the same issue and don't understand what I'm doing wrong.

FIASJason

Whitebread
Sorry, no update at this stage. SSO is not working.

JuVDC

Same thing here, getting redirected to the main homepage without being logged in... 🙁

KevinTheJedi

JuVDC

Have you upgraded to v1.17.2 and installed the new OAuth2 Plugin?

Cheers.

JuVDC

KevinTheJedi
Hey Kev, I am on 1.17.1. Will try with 1.17.2. You think this will solve it?

DidierCaamano

I wonder if you found a solution, I have a similar issue

KevinTheJedi

JuVDC

I'm unable to replicate this so I'm almost sure it will.

Cheers.

FIASJason

JuVDC Please provide an update once you've updated. I would be very interested in the results.

MarkMansveld

We've updated to 1.17.2 but it hasn't solved our problem.
Fun thing is that we have a test environment, that uses the same O365 app registration and there it works, but in our production machine it does not work. Config is the same.

ramrajone

Have you given the user consent?

MarkMansveld

Yes we have. As I said. Both our test and PRD environment use the same app registration.

And in test it works, just not for PRD.

ramrajone

MarkMansveld
Check your Azure signing log
I tested it works, and the reason it was failing was due to the secret, when you make changes, you need to re-enter the secret, even though it was not giving any error

MarkMansveld

Checked the logs. They report success. And indeed we do not get a failure with loggin in. Just redirected to the wrong place.

ramrajone

MarkMansveld
Maybe some files did not copy over when you upgraded?
You can try deleting plugin and re-added
Check your server logs, something must be off, maybe rewrite mod?

This is only permission needed: I have tested on Test server and Live

FIASJason

MarkMansveld Same here.

At this point, I've gone back to LDAP authentication and using our own SMTP relay to send helpdesk responses. The only downside is that we can't have tickets by email anymore (because the Oauth doesn't work). But at least we can use the helpdesk.

Ideally, I'd like to get Oauth up and running - then users won't need to sign in, we can implement tickets by email again, and I can open the helpdesk to other organisations.