OAuth SCP login redirecting to Client page: Page 3

OAuth SCP login redirecting to Client page

KevinTheJedi

Can you provide what I asked here?

https://forum.osticket.com/d/102517-oauth2-does-nothing-cant-save-configuration/11

Cheers.

dhoobin

KevinTheJedi
I have edited the original post added all screenshots you requested here https://forum.osticket.com/d/101915-oauth-scp-login-redirecting-to-client-page/44

KevinTheJedi

dhoobin

I think your endpoints are wrong. You must click the Endpoints button at the top of the Overview page, copy the first two links (authorization/token endpoints v2) and replace the ones in your osTicket OAuth2 config.

Cheers.

dhoobin

KevinTheJedi
You are right.
Endpoints showing up in Azure Active Directory Portal were different.
I updated the OAuth 2.0 authorization endpoint (v2) and the OAuth 2.0 token endpoint (v2) and after I clicked login I was presented with this screen:

When I clicked accept it worked!

Thanks for your support! You are a life saver!

dhoobin

Now faced with a new issue. During testing I removed the email and readded it.
Now when i am trying to make the email "default" again it wont give me the save / submit button.

KevinTheJedi

dhoobin

You have orphaned SMTP records. For this you will need to login to the database, go to the email table, grab all the id values for the emails, go to the email_account table, search for WHERE email_id NOT IN(ids_you_copied), and delete those records. You can copy the table and data beforehand in case something goes wrong just to be safe.

Cheers.

dhoobin

Also its been a good 10 minutes since I created the email and configured oauth for IMAP but I don't see any new tickets from emails.

KevinTheJedi

dhoobin

Did you setup a cron job? If so can you try running it manually to see if it runs successfully?

https://docs.osticket.com/en/latest/Getting%20Started/POP3-IMAP%20Settings.html

Cheers.

KevinTheJedi

dhoobin

You can also set your osTicket Log Level (Admin Panel > Settings > System) to DEBUG, wait for the cron to run, and check your Admin Panel > Dashboard > System Logs for any related errors.

Do you have any filters that reject tickets or do you use the system banlist at all (Admin Panel > Emails > Banlist)?

My last comment I promise 😅 The preferred method is to configure a cron job to automatically poll the mailbox every X minutes. This will keep the token refreshed consistently and fetch mail and send alerts even when no one is logged in. With this in mind I noticed you had Fetch on auto-cron and Email Fetching enabled which is not ideal. This can cause issues so once you get cron working uncheck the box for Fetch on auto-cron (leave Email Fetching Enabled however).

Cheers.

dhoobin

KevinTheJedi
Deleted non existing IDs from email_account table and the buttons are back! 🙂

FIASJason

ramrajone
I'm a bit late replying, but I've finally had time to set up a test instance in a subfolder as you described, and I'm getting a URL Rewrite Module error:

I'll try installing a test version on another machine.

ramrajone

FIASJason
You need to install the rewrite module to redirect the pages
You can check post:
https://howtohelpdesk.com/how-to-redirect-http-to-https-in-iis/

FIASJason

ramrajone
This test installation was in a subfolder of the main osTicket installation. The Rewrite module is already installed and working.

ramrajone

FIASJason
Well your screenshot show errors for rewrite module, so it maybe your module is not loading or restricted

KevinTheJedi

FIASJason

From the error it appears you have duplicate web.config items and your sever doesn’t like that.

Cheers.

FIASJason

ramrajone
I came to the same conclusion. In the end, I just backed up the VM and updated the production site, as well as update the OAUTH2 plugin.

I also tried newer versions of PHP - both 8.1.16 and 8.2.3.

The upgrade went smoothly, but there were no changes to the SSO. I've rolled back the VM to before the upgrade.

bugeater87

Has anyone found a solution to the original OP? I've done all the upgrades, deleted and recreated the setup. Modified the claims. No matter what, the login works but then OSTicket just goes to the client page instead of logging into SCP.

KevinTheJedi

bugeater87

Have you tried this?

https://stackoverflow.com/questions/29822686/curl-error-60-ssl-certificate-unable-to-get-local-issuer-certificate

Also, are you certain you have URL Rewrite module installed/enabled on your web server?

Cheers.

bugeater87

Yes.

This is Apache on Windows with PHP 8. PHP info shows mod_rewrite installed. All Apache Allowoveride statements are set to all. I have the curl.cainfo and openssl.cainfo directed to the downloaded PEM file.

no errors in the php_errors.log

The access log shows
"GET /scp/login.php HTTP/1.1" 200 7042
"GET /scp/login.php?do=ext&bk=oauth2.agent.p4i3 HTTP/1.1" 302 13
"GET /api/auth/oauth2?code=0.ARwAa4..........................

in error.log, I get AH01991: SSL input filter read failed.

My thought is that for some reason it is not reading the openssl.cainfo/curl.cainfo PEM file. Verified it has read access to all users. But can't figure out how to test to make sure this is not the problem.

The only other thing is I use base defaults in the apache httpd.conf for the site reference and do not specify a virtual host config.

As an FYI - I know it is separate config, but email fetch via OAUTH is working.

Any other thoughts on where else to look?

Server Information
osTicket Version v1.17.4 (ea462cb) — v1.17.5 is available
Web Server Software Apache/2.4.53 (Win64) OpenSSL/1.1.1o PHP/8.0.25
MySQL Version 5.5.65
PHP Version 8.0.25
PHP Extensions
gdlib Used for image manipulation and PDF printing
imap Used for email fetching
xml XML API
xml-dom Used for HTML email processing
json Improves performance creating and processing JSON
mbstring Highly recommended for non western european language content
phar Highly recommended for plugins and language packs
intl Highly recommended for non western european language content
fileinfo Used to detect file types for uploads
zip Used for ticket and task exporting
APCu Improves overall performance
Zend Opcache Improves overall performance
PHP Settings
cgi.fix_pathinfo "1" is recommended if AJAX is not working
date.timezone America/Denver

KevinTheJedi

bugeater87

Does the URL you are using to sign-in match the Redirect URI in the plugin instance config and the Entra App Registration? Do you have the User.Read permissions enabled and Admin Consented in the Entra App Registration?

Cheers.

« Previous Page Next Page »