Mailfetch needs occasional toggling

jfried

Using 1.17.3 we recently migrated our mailboxes to 365 and switched to using OAuth2 for Authentication. It is configured and fetches emails for a while, maybe an hour then stops fetching. To fix fetching needs to be disabled then re-enabled. There are no errors in the OSTicket log. Anyone run into this? Almost seems like a throttling issue, but changing frequency to 10 minutes had no effect.

KevinTheJedi

jfried

You need to figure out why it's failing after an hour. Do the tokens expire and don't get updated properly? You can view the Token tab in the Authentication Config popup to see if it expires and doesn't get updated properly.

You need to make sure you install the latest build of the OAuth2 plugin from our website. This latest build includes a patch to fix the MS refresh token expiration issue.

Cheers.

jfried

Ok, I overwrote the .phar file with one from a fresh download. Will re-check the token post expiration. Thanks as always Kevin.

jfried

Running version 0.6 of the plugin I'm still seeing the same problem. The token is expiring and not being updated. The only way to update is to disable then re-enable mail fetch. Does anything need to be done to update the plugin other than overwriting it with the new version?

KevinTheJedi

jfried

Try deleting the token and getting a new one. You may also need to check your app in azure to see if there are any restrictions on it. Should be an Internal application that doesn’t need verification or anything like that.

Cheers.

jfried

Deleting the token then re-authorizing to get a new one has the same effect. How would I check for restrictions on the app?
Looking at the git repository for the plugin it appears what was corrected was a new refresh token was not being retrieved which meant new access tokens were not being retrieved after the initial refresh token expired in 90 days. In my case the initial access and refresh tokens are retrieved, but after an hour the new access token is not retrieved using the refresh token issued with it.

KevinTheJedi

jfried

Then that sounds like the app has some weird restrictions or maybe the tokens have too short of a lifetime. I'd contact your Azure Admin and have them take a deeper look.

If you are running v1.17.3 plus the new build of the OAuth2 plugin you should not have such issues.

Cheers.

KevinTheJedi

jfried

Are you by chance adding a specific permission to the user and removing it after getting a token?

Cheers.

jfried

Nope, the user and app registration are not modified after the initial tokens are retrieved..

KevinTheJedi

jfried

Interesting...I've never seen this before. I'm thinking the tokens have a short lifetime or something.

Cheers.

jfried

Had a support session with Microsoft. They investigated the logs and confirmed an updated token was being sent. For whatever reason OSticket is not updating with the new token.

KevinTheJedi

jfried

So you updated to v1.17.3, installed the latest build of the plugin from our website, deleted your previous tokens, retrieved new tokens, and still running into the issue?

When you updated the plugin did you restart the webserver and PHP-FPM (if you're running it)? A lot of the times servers will cache the files so you must restart to clear any file cache so the changes take affect.

Cheers.

jfried

Running 1.17.3.
Re-downloaded and overwrote plugin auth-oauth2.phar file version 0.6.
Deleted the token by clicking here. Then re-authenticated to retrieve new tokens.

Not able to restart the web server which is hosted, but cleared the cache. Running PHP 8.0.28 currently.

KevinTheJedi

jfried

If you're using a shared host they likely aggressively cache the files. You may need to reach out to your host and ask them to provide the steps needed to completely clear any file cache on the server. Just to make sure it's truly loading the new core/plugin files.

Cheers.

jfried

This is interesting. If the token is expired and I send an email (SMTP request) from Osticket the token updates with a new expiration. It is only the pickup (IMAP request) that fails to update the token. Are you able to reproduce this behavior with a MS 365 mailbox? If not, I will replace my application and plugin files next week and re-register the application in Azure.

KevinTheJedi

jfried

No, all of my O365 accounts update and run properly. Even many, many customers on our hosted platform.

Cheers.