Troubleshooting OAuth2

Drahgoone

Hello, I am trying to use Discord to sign in with the OAuth2 plugin, I've installed the plugin without issue and I have configured it, though with the current configuration nothing happens after signin. They are redirected back to the homepage and no account is created. How can I troubleshoot this issue? Thanks!

KevinTheJedi

Drahgoone

I've never used Discord for this (might try to soon) but a lot of the times this is either due to the scopes being insufficient or incorrect or the attributes being incorrect. You should inspect the request in the browser to see what Discord is returning to osTicket on sign-in.

Cheers.

KevinTheJedi

Drahgoone

I just reviewed their docs and identify email should be the correct scopes so I’m thinking it’s the attributes. Did you go through the Role and Attribute mappings? If so, try using the email attribute as the User Identifier in osTicket.

Cheers.

Drahgoone

KevinTheJedi the output of "https://discord.com/api/oauth2/@me" should look like this

{ "id": "80351110224678912", "username": "Nelly", "discriminator": "1337", "avatar": "8342729096ea3675442027381ff50dfe", "verified": true, "email": "nelly@discord.com", "flags": 64, "banner": "06c16474723fe537c283b8efa61a30c8", "accent_color": 16711680, "premium_type": 1, "public_flags": 64 }

I tried replacing id with email but there was no change.

KevinTheJedi

Drahgoone

Using the ID will be a problem as we don’t allow fully numeric usernames. So it’s have to be an actual username or email address.

Cheers.

Drahgoone

KevinTheJedi Still has not worked for me, in inspect element is there a specific area I should see the response? Not sure what it's returning.

This is what the token response should be as an example:
{ "access_token": "6qrZcUqja7812RVdnEKjpzOL4CvHBFG", "token_type": "Bearer", "expires_in": 604800, "refresh_token": "D43f5y0ahjqew82jZ4NViEr2YafMKhue", "scope": "identify" }

KevinTheJedi

Drahgoone

That example you just posted is missing email scope.

Cheers.

Drahgoone

KevinTheJedi yes, its just an example.

KevinTheJedi

Drahgoone

Okay well if you get no further you’ll have to wait for me to try this setup and see the proper settings to use. In the meantime, are you trying to authenticate an existing user/agent? If so, go to the user_account or agent table in the database (depending on what you are trying to authenticate as) and check the backend column for the user/agent in question. If this is set to a value then the user/agent is locked into using a particular authentication method and cannot use SSO. I doubt this is the case though as we typically return an error instead of redirecting to client portal. That usually means misconfiguration issues.

Cheers.

KevinTheJedi

Drahgoone

I was able to get Discord OAuth2 SSO working with the following information:

I used email attribute for User Identifier just for testing purposes but you can set this to username attribute for the actual Username. Just note that the Agent's username from Discord has to match the Agent's username in osTicket in order for that to work properly. Also, Agents have to be registered in osTicket prior to them authenticating via Discord. However, if a User authetnicates and they don't exist an account will be created for them. You can of course restrict registration for Users to change this behavior.

Lastly, I used username for Given Name and displayname for Surname as Discord sadly doesn't provide this information in the response.

Cheers.