Invalid response received from Authorization Server. Expected JSON

CoastalData

Our osTicket install had been working perfectly for a few months since we upgraded and added the o365 plugin, but it just stopped last week and nothing I've tried over the weekend will get it going again.

After submitting the config and authorizing with the office account, I just get the error message:

I've re-reviewed the docs repeatedly and can't figure out what might be missing. Is there any way to see that the "non-json" error response was? Maybe that would help to point me in the right direction.

Thoughts?

KevinTheJedi

CoastalData

Can you post screenshots of your OAuth2 config in osTicket as well as all the places in the App Registration in Azure? Please make sure you censor any sensitive info before posting.

Cheers.

CoastalData

OK, we found the v1.17.3 upgrade version, installing that now, it seems to have fixes for oauth. We're on 1.17.2 now.

CoastalData

Did I miss any from enterprise applications?

KevinTheJedi

CoastalData

Here are the only things I can see out-of-place:

The Resource Details Endpoint need to be https://outlook.office.com/api/v2.0/me (you are missing the HTTPS).
You need the Access Tokens checkbox checked (enabled) and save the changes.
Make sure you are using the Client secret Value; not the Secret ID.

Cheers.

CoastalData

OK, so I added the https, I think that was a defaulted value, no? I also enabled Access Tokens, which I had disabled because a users account had gotten taken over by OS Tickets, he said his personal emails were being put out on OST, but I've now installed the .3 fix, and enabled the Access tokens checkbox. I had already been correctly using the Secret Value, not ID.

And it authenticated! And I could send a test outbound message!

But, it still has not fetched any new messages even though email fetching is enabled.

Thoughts?

CoastalData

I'm now seeing this in the logs:

API Error (403)

Unable to create new ticket :Ticket denied: info@abc.com This help desk is for use by authorized users only
Log Date: Monday, May 1, 2023 at 11:42 AM IP Address: 73.10.133.251

KevinTheJedi

CoastalData

That just means you don’t accept emails from non-existent users. You can disable this in your settings: Admin Panel > Emails > Settings > Accept All Emails

Cheers.

KevinTheJedi

CoastalData

Also, pulling in personal emails means that person authorized OAuth2 for the system email with their personal email account which you should NEVER do. You should always authorize as the email itself or with a Service Account.

Cheers.

CoastalData

KevinTheJedi Also, pulling in personal emails means that person authorized OAuth2 for the system email with their personal email account which you should NEVER do. You should always authorize as the email itself or with a Service Account.

Yes, I think the user went in to try and fix the issue himself, and just kind of made it worse by getting his own account mixed up.

On this screen, the users' email got listed as the Resource Owner, and I believe that "Delete Token" button is new to the .3 release, and so I was not able to find and remove that users' token until we upgraded.

CoastalData

Already checked:

KevinTheJedi

CoastalData

Yes, this was introduced with v1.17.3. You could always delete the config through the database.

Cheers.

CoastalData

OK, so I un-checked and then re-checked that option to accept all mail and then re-enabled fetching and email is flowing once again!

Thank you very much for your help!