osTicket O365 E-mail Retrieval & Sending Stopped Working

rblake

I have been using osTicket without any issues and then on Monday it stopped downloading e-mail messages. When I dug into the issue a little more, I see that Microsoft decided to disable SMTPAuth (for example), which at least explained why I couldn't send out e-mails from the ticketing system. However, it also fails to download the e-mails as well. Nothing has changed in the environment. In an attempt to resolve the issue, I updated the ticketing system to 1.17.2 with the latest .phar plugins. But it's still not working. I'm still getting the error message:

5.7.139 Authentication unsuccessful, SmtpClientAuthentication is disabled for the Mailbox. Visit https://aka.ms/smtp_auth_disabled for more information.

I have a ticket in with Microsoft on this.

For Remote Mailbox, I get this error message:

cannot select INBOX, is this a valid transport?

Any troubleshooting I can do to isolate the issue?

KevinTheJedi

rblake

That is interesting. I would be interested to hear what MS says about this. So far I haven’t had any issues with my O365 setup.

Have you tried creating a new secret?

Also just to note for you, we removed the prompt=consent option and the requirement to login as the email itself to authorize with the latest plugin.

Cheers.

rblake

@KevinTheJedi - I have a ticket open with them still and they have yet to give any resolution. They've escalated it internally. I can create a new secret but it's not saying the authentication is failing.

Is there anything I can do to enable debug logging for the plugin to see exactly what's going on with it?

KevinTheJedi

rblake

No you’ll have to unphar it and manually debug.

Cheers.

rblake

KevinTheJedi Okay, I unphared the file and set oauth2.php from private $debug = false; to private $debug = true;

EDIT: I realized this was before I updated the SQL code to point to the new plugin ID after extracting the .phar.

So, where would I be able to view the debug logs of it attempting to authenticate and where Microsoft responds with the failure?

I see that some new data was dumped to www-error.log, seen below:

[25-Nov-2022 18:32:32 UTC] PHP Fatal error:  Uncaught Error: Call to a member function setConfigClass() on null in /var/www/html/include/plugins/auth-oauth2/oauth2.php:601
Stack trace:
#0 /var/www/html/include/plugins/auth-oauth2/oauth2.php(414): GenericEmailOauth2Provider->getPluginInstance()
#1 /var/www/html/include/plugins/auth-oauth2/oauth2.php(426): OAuth2ProviderBackend->getConfig()
#2 /var/www/html/include/class.email.php(574): OAuth2ProviderBackend->getConfigForm()
#3 /var/www/html/include/class.email.php(638): EmailAccount->getOAuth2ConfigForm()
#4 /var/www/html/include/ajax.email.php(23): EmailAccount->getAuthConfigForm()
#5 /var/www/html/include/class.dispatcher.php(153): EmailAjaxAPI->configureAuth()
#6 /var/www/html/include/class.dispatcher.php(40): UrlMatcher->dispatch()
#7 /var/www/html/include/class.dispatcher.php(122): Dispatcher->resolve()
#8 /var/www/html/include/class.dispatcher.php(40): UrlMatcher->dispatch()
#9 /var/www/html/scp/ajax.php(326): Dispatcher->resolve()
#10 {main}
  thrown in /var/www/html/include/plugins/auth-oauth2/oauth2.php on line 601

KevinTheJedi

rblake

Ah that means you probably have erroneous records in your database. Look at your plugin and plugin_instance tables and see if you have any weird records.

Edit:
Also check your config, email, and email_account tables for duplicate or orphaned records.

Cheers.

rblake

KevinTheJedi I did, it was before I updated the plugin number (incremented by 1) after changing from a .phar to an extracted phar. However, still getting the same error messages that I mentioned initially.

EDIT: Should there be a hashed password under email.#.account.# with the key passwd if I'm using OAUTH2?

Also, I only see an email.1.account.1 with the access_token, refresh_token, etc. I don't see the email.1.account.2 like I do for username and passwd keys.

rblake

KevinTheJedi Just checked those and edited my previous reply.

KevinTheJedi

rblake

No, if you are using OAuth2 for an email I don’t think there shouldn’t be any other auth record (especially basic auth) tied to it except for the OAuth2 records. What I would do is delete all the email and OAuth2 plugin records that are in the config table, delete the OAuth2 plugin_instance records that are tied to the email(s), delete the email account records associated with the email(s), and reconfigure the email authentication and incoming/outgoing settings.

Cheers.

rblake

KevinTheJedi Just went through that and it's still not working so I'm thinking it has to be something on Microsoft's end. They are supposed to call me in the next few minutes so I'll update you as soon as I know something.

Thanks!

rblake

KevinTheJedi I just was speaking with Microsoft Support, and they had me create a brand-new account and try to get that to work and it wouldn't, so they are thinking the issue is with osTicket. 🙁

KevinTheJedi

rblake

You shouldn’t have any issues if you follow the steps in the documentation and if you keep the resource details endpoint, scopes, and email attribute settings as default in the OAuth2 config. I can still connect to my O365 account with no issues, also we have no reports of this in our hosted platform so it is very odd that you are running into this.

Make sure you didn’t skip any steps like enabling the Access/ID Tokens checkboxes and enabling the appropriate API Permissions (with admin consent applied).

Cheers.

rblake

KevinTheJedi I can assure you that I followed the documentation. 🙂

I copied my ClientID from the App Registration and I used the same Client Secret as well as a new one I just created, both do not work.

Authorization Endpoint: https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize
Token Endpoint: https://login.microsoftonline.com/organizations/oauth2/v2.0/token
Resource Details Endpoint: https://outlook.office.com/api/v2.0/me
Scopes: offline_access https://outlook.office.com/Mail.ReadWrite
Email Address Attribute: EmailAddress

KevinTheJedi

rblake

And when you submit that popup what happens?

Cheers.

rblake

KevinTheJedi It takes me to the consent page where I consent for my org. It then takes me back to the e-mail page and in green letters tells me it's successful. I can then go back into the Config page and I can see the token was issued (albeit for a brief time before expiration, which I presume it just refreshes as needed).

KevinTheJedi

rblake

Okay and then when you see the new Token tab in the popup what happens when you enable imap and smtp and save changes?

Cheers.

rblake

KevinTheJedi Gives this error when on the Remote Mailbox tab:

Gives this error on the SMTP page:

KevinTheJedi

rblake

Okay try deleting the email from osTicket completely and re-add and reconfigure it and see.

The smtp error is coming directly from MS so that definitely needs to be handled by them. The IMAP error I’m not so sure. I think that’s just generic when something happens with the connection where it can connect but can’t do anything else.

Cheers.

rblake

KevinTheJedi So I created an entirely new e-mail account and assigned a license and also disabled SmtpClientAuthDisable with: Set-CASMailbox -Identity test@domain.tld -SmtpClientAuthenticationDisabled $false

So this is a brand new mailbox and it also has the same behavior.

KevinTheJedi

rblake

So that email hasn’t been added to osTicket before until now?

Cheers.

rblake

KevinTheJedi Yes, that's right, brand new account.