Issues configuring OAuth2 with Microsoft

DidierCaamano

Hello, I am following the published guide to configuring OAuth2.0 with osTicket 1.17 and Microsoft Azure, however, when I submit the login information I get the following error:
Connection refused for URI https://login.microsoftonline.com/xxxxxxx-yyyy-zzzz-zzzzzyyyyyyxxxxxx/oauth2/v2.0/token
Has anyone seen this issue before
I appreciate any assistance with this issue.

Thank you

KevinTheJedi

DidierCaamano

No, you will need to look at your server logs, firewall, etc. for any further information. If all else fails you can contact MS to see if it’s something on their end.

Cheers.

DidierCaamano

Further details,
Reviewing the Sign-in diagnostic I get this message:
Based on the information you provided we have identified following issue and recommend taking the action to resolve the issue.

Error Code: 65001

Message: The user or administrator has not consented to use the application with ID '{identifier}'{namePhrase}. Send an interactive authorization request for this user and resource.

More information in: https://learn.microsoft.com/en-us/azure/active-directory/develop/reference-aadsts-error-codes
AADSTS65001 DelegationDoesNotExist - The user or administrator has not consented to use the application with ID X. Send an interactive authorization request for this user and resource.

I have followed the guide and I have ensured to delegate permissions using Microsoft Graph, the only difference I see between the guide and my implementation is that when I am authorizing the user, in the Permissions Requested page I do not get the checkbox that says: Consent on behalf of your organization.

KevinTheJedi

DidierCaamano

That should be fine. Seems like you’ll need to double check your settings in osTicket or contact MS for further assistance.

Cheers.

ramrajone

DidierCaamano
I wrote this post for my own reference of the official documentation
Most likely you might be missing the user consent, I had that issue
Also, once you make changes to Azure, it sometimes takes 10-15 minutes for changes to take effect and also clear your browser cache
https://howtohelpdesk.com/how-to-setup-oauth-on-osticket-using-microsoft-365/#allow-user-Consent

DidierCaamano

Update on this.
I have followed the official guide with no results
https://docs.osticket.com/en/latest/OAuth2/Microsoft%20Authorization%20Guide.html

I followed this guide https://howtohelpdesk.com/how-to-setup-oauth-on-osticket-using-microsoft-365/ with no results either.
For the records, the information on the howtohelpguide (which has been used on this site as a reference) is different than the official documentation.
Further, the official documentation uses OAuth2 version 0.5, whereas the currently available version is 0.6. I wonder if there are some differences in the version.
My non-production environment is:

Windows Server 2019
osTicket 1.17.2
IIS 10.
PHP 8.0.25
MariaDB 10.5.15 on Debain 11

I have tried
Re-creating the Application in Azure three times (two using the steps in the official guide, once using the steps in the howtohelp guide)
Using two IIS servers (one running Windows Server 2022, the other running Windows Server 2019), the current server is Windows Server 2019.
I have used
http://localhost/osticket/api/auth/oauth2
https://tickets.mydomain.com/osticket/api/auth/oauth2
But I always get this error:
Connection refused for URI https://login.microsoftonline.com/zzzzzzzz-xxxx-wwww-yyyy-aaaaaaaaaaaa/oauth2/v2.0/token.

I wonder if anyone has experienced something similar that can provide some guidance

KevinTheJedi

DidierCaamano

For the records, the information on the howtohelpguide (which has been used on this site as a reference) is different than the official documentation.

That's because the howto one was made by a community member, not an official team member.

Further, the official documentation uses OAuth2 version 0.5, whereas the currently available version is 0.6. I wonder if there are some differences in the version.

Of course there are differences. You should always update your plugins when you update the code.

Connection refused for URI https://login.microsoftonline.com/zzzzzzzz-xxxx-wwww-yyyy-aaaaaaaaaaaa/oauth2/v2.0/token.

Again, I don't believe this has anything to do with our application. From the error message alone it appears your webserver and/or provider is refusing the connection. You will need to reach out to your system's administrator and your provider (MS) for further assistance.

Cheers.

DidierCaamano

ramrajone Thank you for the reply. I tried your post on one of my attempts but without positive results.

As I mentioned in my post above, the solution for me was to enable OpenSSL in PHP.

The issue now is Fetching email from the mailbox using IMAP, it does not work when using Oauth or Legacy Authentication (User name and Password); so I have to figure that one out.

DidierCaamano

Update,
I was able to get past the Microsoft OAuth configuration.
The solution for me: Enable OpenSSL on PHP.
It turns out the solution was on a thread on this forum
https://forum.osticket.com/d/101298-oauth2-microsoft-not-working/106

Now the system is not fetching email from the mailbox using IMAP.

Sending emails through smtp.office365.com using the OAuth credentials works just fine.