Oauth2 google cannot sign in

dolon

Hi @KevinTheJedi , All,
I just setup the google OAuth2 and looks like it works until the moment the system should signed you in. After successfull authentication on google login, it drops you back to the client portal without any sign-in option.
Once I type again the domain.com/scp the login to portal appears again.

KevinTheJedi

dolon

What version of osTicket and when did you download the plugin?

Cheers.

dolon

KevinTheJedi
Hi,
1.17.3 and most recent plugin v0.6

KevinTheJedi

dolon

Okay, have you tried in an incognito/private window or an entirely new browser?

Cheers.

dolon

KevinTheJedi
Yes I have tried, also with several google account, admin, staff or simple user roles as well. Everytime the same result.
I guess the redirect URI could be wrong or get it wrong. As per the guide I copied into google cloud console the same as the plugin mentiones (copy-paste, no tipo) Somehow because the URI wrong I think it cannot register the session and drop to the main page.

KevinTheJedi

dolon

Should be your domain + /api/auth/oauth2. You may need to restart your webserver and PHP-FPM if you're running it.

Cheers.

dolon

Just restarted the server, no change unfortunately. I also increased the debug level, which confirms google auth is complete, but osticket cannot handle looks like:
[Thu Mar 16 17:22:50.225171 2023] [authz_core:debug] [pid 19636] mod_authz_core.c(815): [client 149.200.76.98:62674] AH01626: authorization result of Require all granted: granted, referer: https://accounts.google.hu/
[Thu Mar 16 17:22:50.225204 2023] [authz_core:debug] [pid 19636] mod_authz_core.c(815): [client 149.200.76.98:62674] AH01626: authorization result of <RequireAny>: granted, referer: https://accounts.google.hu/
[Thu Mar 16 17:22:50.403643 2023] [ssl:debug] [pid 19636] ssl_engine_kernel.c(415): [client 149.200.76.98:62674] AH02034: Subsequent (No.2) HTTPS request received for child 7 (server demo.hazimano.hu:443), referer: https://accounts.google.hu/
[Thu Mar 16 17:22:50.403722 2023] [authz_core:debug] [pid 19636] mod_authz_core.c(815): [client 149.200.76.98:62674] AH01626: authorization result of Require all granted: granted, referer: https://accounts.google.hu/
[Thu Mar 16 17:22:50.403729 2023] [authz_core:debug] [pid 19636] mod_authz_core.c(815): [client 149.200.76.98:62674] AH01626: authorization result of <RequireAny>: granted, referer: https://accounts.google.hu/
[Thu Mar 16 17:22:50.403805 2023] [authz_core:debug] [pid 19636] mod_authz_core.c(815): [client 149.200.76.98:62674] AH01626: authorization result of Require all granted: granted, referer: https://accounts.google.hu/
[Thu Mar 16 17:22:50.403825 2023] [authz_core:debug] [pid 19636] mod_authz_core.c(815): [client 149.200.76.98:62674] AH01626: authorization result of <RequireAny>: granted, referer: https://accounts.google.hu/
[Thu Mar 16 17:22:50.432662 2023] [deflate:debug] [pid 19636] mod_deflate.c(869): [client 149.200.76.98:62674] AH01384: Zlib: Compressed 4991 to 1615 : URL /index.php, referer: https://accounts.google.hu/

KevinTheJedi

dolon

Could be an issue with app registration. Did you add all the required info like in the documentation?

https://docs.osticket.com/en/latest/OAuth2/Google%20Authentication%20(SSO)%20Guide.html

Cheers.

dolon

KevinTheJedi
yes its a pretty good guide and everything is exactly the same. As I mentioned, the authentication works as per the debug too. OSTicekt cannot register the session

KevinTheJedi

dolon

I am unable to replicate this. I just tested and cannot replicate using v1.17.3 and the latest build of the OAuth2 plugin. Are you using a proxy or load balancer or something? Also, the Agent MUST exist in the system in order to be authenticated. Also, the Agent's Email Address must match the email Google is returning.

Cheers.

dolon

KevinTheJedi
yes you are right and all is good as you said. It is in Google Cloud, so not sure what kind of load balancers or ifra is underlying .
Is there any way to log the session or what happens after the authentication on osticket level?

KevinTheJedi

dolon

I’m talking about in your setup, not googles. I use google cloud as well.

Cheers.

dolon

KevinTheJedi
sorry, I just realized the issue which is it wasn't clear from the guide that I don't need to rewrite the last part. It is not clear they are variables and proper data. I thought Its prefield kind of hints and need to rewrite. I put back the variable names and now all good. Please close this one and sorry again wasting your time. May would worth to highlight in the guide those are variables.

KevinTheJedi

dolon

Read the help tip in the section header: Consult your IdP documentation for supported attributes and scopes.

Google's docs will show the attributes to use and you’ll see they are the same as the defaults we provide.

Cheers.