osTicket O365 E-mail Retrieval & Sending Stopped Working: Page 2

osTicket O365 E-mail Retrieval & Sending Stopped Working

KevinTheJedi

Using the same account or? If not then can you compare the accounts to see what’s different?

Cheers.

rblake

KevinTheJedi I just tested using the same test account on the other system and it works without any issues. Sent a test e-mail and it created a ticket.

KevinTheJedi

rblake

What’s the platform difference and how are you deploying the code on both?

Cheers.

rblake

KevinTheJedi The working solution is Quest KACE. It's a virtual appliance deployed using an OVA. No root access. No code to deploy, I just enter the ClientID, Secret, and click to generate an auth key. I have to use the e-mail account I want to authorize and then it's done.

KevinTheJedi

rblake

Is there a difference in osTicket versions? Plugins versions? PHP setup/configurations/extensions? Something has to be different between the two setups if one is working and one isn’t.

Cheers.

rblake

KevinTheJedi The Quest KACE isn't osTicket, it's an entirely different solution. I'm just saying that this works so I don't see how it can be our environment.

These are the configured permissions for OAUTH2 for KACE:

I added openid to the list of permissions for osTicket, but no joy.

KevinTheJedi

rblake

In my experience, when you add new permissions you have to create a new secret.

Cheers.

rblake

KevinTheJedi Just created a new secret and getting the same error message: cannot select INBOX, is this a valid transport?

Edit: I forgot to mention that I changed the SMTP settings to Basic Authentication (Legacy) and used the username/password and it worked. However, it's still not able to retrieve mail (see above error).

KevinTheJedi

rblake

You really need to get OAuth2 working instead of relying on basic but good it’s working for now.

As for fetching can you try port 995 and POP protocol?

Also, do you have a self signed certificate or something on this server?

Cheers.

rblake

KevinTheJedi I get this when I try POP:

EDIT: I changed to Legacy Auth on IMAP and it pulled down e-mails.

ramrajone

rblake
I had similar issues, the test server was working but the production server would not, so I had done this test and it helped me fix my issue.
If you like to test this, create a new folder within the same server where your current osTicket is installed, for example:
let's say your current install is on: /www/osTicket Then create a folder in it called Test /www/osTicket/Test
Then download a fresh copy of the new osTicket from osticket.com/download version 1.17.2 Go through a setup like it's a new install with a new database and for this Test to keep it live server and Test separate

You can create new app registration for this Test to keep it live server and Test separate

If this works then something else is not right

KevinTheJedi

rblake

I just re-tested my O365 setup in an instance that is getting this same error. When trying my O365 email it worked with no issues. So it definitely seems to be an issue with your MS account(s) specifically. I would have MS look deeper into this rather than saying it's an application issue.

Cheers.

rblake

ramrajone I didn't test with a separate app registration, so I will give that a try. Already have a separate server and instance altogether. Stood up another VM.

rblake

@KevinTheJedi Did I understand correctly that we don't need to use the e-mail account being used to authorize the OAUTH connection? In other words I could use my account? Or do we still need to use the e-mail account? I know it says in the documentation that you do but I thought I read on the forums that has been fixed with the latest release? I'm running 0.6.

rblake

KevinTheJedi So it appears that I can't request an app and then approve it for it to work (which is what I had been trying). I have to temporarily assign the osTicket e-mail account with Global Admin and then go through the process and then it works. Just tested on my test environment and will test on production after-hours. Any chance that will be changing as that's a huge pain (and a security risk).

KevinTheJedi

rblake

Not that I know of no. Any Global Admin should be able to consent.

Cheers.

rblake

KevinTheJedi Ok, so I was able to get it to work by assigning global admin to my test e-mail account and using that to log in and consent. It worked fine after doing that. However, I have since removed Global Admin permissions from the user and now I'm getting AUTHENTICATE failed and it's not working. We restrict the ability to consent in our company for security reasons (we're regulated heavily). However, what's interesting is that with the other solution, I am able to consent as the user without the need for global admin. So that's interesting now that I think about it. If you'll note, this is the difference in permissions: https://forum.osticket.com/d/102129-osticket-o365-e-mail-retrieval-sending-stopped-working/33

EDIT: Using my account to consent on behalf of the account does not work.

KevinTheJedi

rblake

Are you sure you are using v1.17.2 and the latest build of the OAuth2 plugin? Download just the OAuth2 plugin from our website, re-install, re-configure, and retest. Also, use a global admin (that's normally a global admin) to test authorization.

It might be that it's attempting to use the Authorizer's account (admin who consented) to select the mail from.

Cheers.

ramrajone

rblake
I had written this post, and was able to get it working using the Application admin, instead of Global admin
https://howtohelpdesk.com/how-to-setup-oauth-on-osticket-using-microsoft-365/#allow-user-Consent

zs_bln

For anyone stumbling over the post because of the same "cannot select INBOX, is this a valid transport?" error. For me the problem was caused by IMAP simply not being enabled for that Mailbox in O365, after enabling it and waiting about 30-60 Minutes it worked and osTicket could fetch the E-Mails no problem.

« Previous Page Next Page »