OAuth2 Office 365 setup issues (I'm going mad)

Mguerrero

Hi all,
I've been searching for all the simmilar issues like mine in this forum, trying to apply a solution for my problem but I had no luck. Now I'm facing a really tight deadline and I need to have this working asap, I'll give all the info i'm able to, so hopefully anyone can give me some light because I don't know what else to do.

I'm using osticket 1.17.3 , fresh installation. My OS is debian 11 and I am using apache2 as the webserver.
Osticket is working good so far, but now I need to configure the oauth2 plugin so I can use the office365 emails, I've followed the userguide for this topic, and with the help of an azure admin, I got the information about the endpoint urls, secret, and so on...

Once I click on submit in the config page, it redirects me to the office login page, I log in successfully, but when I have to ask for the permission, a link that says "go back to the application" appears and when I click on it, it takes me to the main page of my osticket (https://10.56.27.193/osticket/)

I've read a lot of simmilar topics saying that this is that I don't have rewriting enabled in my webserver, but I've already enabled it:

I've checked with the browser console that the url that the server is triying to go to is:
https://10.56.27.193/osticket/api/auth/oauth2?error=access_denied&error_subcode=cancel&state=1174d5b22438a35c91234744367edb43&error_description=AADSTS65004%3a+User+declined+to+consent+to+access+the+app."

So looking at the URL it looks like there's an error with the consent to access the app, but it should to go to the /osticket/scp/emails.php page as I seen in other topics, not to the osticket mainpage.

The .htaccess file is in /var/www/osticket/api/ and the rights are OK.

I also did some manual redirections in the apache2 config file, like this ones, but no one worked (some of them got me a error 500 page):

RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^.*$ /osticket/api/http.php [L,QSA]

RewriteEngine On
RewriteCond %{REQUEST_URI} ^/osticket/api/auth/oauth2 [NC]
RewriteRule ^/(.*)$ /osticket/api/http.php [L,QSA]

I hope anyone can help me.

Thank you all

edit:

This is my apache2 config:

<VirtualHost *:443>
ServerAdmin admin@example.com
DocumentRoot /var/www/html/

Options Indexes FollowSymLinks MultiViews
AllowOverride All
Require all granted

</Directory>

ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined

SSLEngine on
SSLCertificateFile /etc/ssl/certs/apache-selfsigned.crt
SSLCertificateKeyFile /etc/ssl/private/apache-selfsigned.key

</VirtualHost>

edit2: Azure admin says that he has approved my request to connect to the application but I am still not able to configure the email

edit3: without touching anything it worked... I don't know if it was some kind of delay with the authorization with azure, but now I'm getting another error when fetching emails.

Mguerrero

UPDATE

Looks like after some time waiting , without doing nothing else, it worked and the authorization was successful....
Now I am facing another error when I try to enable email fetching it says: "cannot select INBOX, is this a valid transport?"
Anyone knows why this happens?

KevinTheJedi

Mguerrero

You are likely using the wrong account to authorize. When it brings you to MS you just login as the email you are trying to configure.

Also, having to request permission breaks the auth flow and we never get a token. So if you have to request permission it will not work.

Cheers.

Mguerrero

KevinTheJedi Hi Kevin, Thanks for your anwser.
I've used the same account to authorize than the one I am configuring. I also got the token and it refreshes every time I try to connect:

In fact, I've only used one account for this purpose and also did it in a private window of the browser to prevent other accounts to interfere.
Thank you!

KevinTheJedi

Mguerrero

Do you have a Delete Token button on the Token tab?

Cheers.

Mguerrero

KevinTheJedi sorry I cut that part. Yes, I have it.

KevinTheJedi

Mguerrero

Then the only things I can think of are:

The API Permissions were not added correctly or admin has not provided consent to them.
Something wrong/misconfigured with the app registration.
The email is not a real full user account with license.

Cheers.

Mguerrero

KevinTheJedi
Hi Kevin,
Going to ask the Azure admin about this two first topics you mentioned, the third one is not possible as I know the license is correct.

Thank you for your help! I'll update this in case I find the solution for anyone that faces something similar.

KevinTheJedi

Mguerrero

Also in the Admin center make sure the Iser account has IMAP and Authenticated SMTP enabled under the Mail tab.

Cheers.

Mguerrero

KevinTheJedi
Checked with the azure admin, aparently everything was Ok. Deleted the token and got it again, we tried again but is still the same error again and again "cannot select INBOX, is this a valid transport?" We dont know what more to do, also tried POP instead of IMAP and I got another error that was empty (only the red alert symbol)

KevinTheJedi

Mguerrero

Then you’ll need to post screenshots of all you App Registration config censoring any sensitive info. Something has to be configured wrong.

Cheers.

Mguerrero

KevinTheJedi
Hi Kevin,
This is my config. If you need to see something from the azure config, let me know as I don't have access to that part...

Thank you so much

Edit: more from azure

KevinTheJedi

Mguerrero

That’s what I said above. Screenshots of the App Registration. The Authentication tab, the Certificates and Secrets tab, the Endpoints tab, the API Permissions tab, etc.

Cheers.

Mguerrero

KevinTheJedi
Asked for all this... I'll be back later with that. Thanks!

Mguerrero

KevinTheJedi
Hi Kevin, I have uploaded all the screenshots from azure that the admin sent to me, in my other reply, I edited the message.
Thank you so much for your help!

KevinTheJedi

Mguerrero

I don’t see anything wrong here… are you sure the email user has a full, valid account with a license? If so I’m out of ideas.

Are you using the latest build of the OAuth2 plugin from our website?

Cheers.

Mguerrero

KevinTheJedi
Hi Kevin,
I set up the server two or three weeks ago, so everything should be last version, I think oauth2 plugin is v0.6
Also, this account has an E3 license, so it has a mailbox and is able to send emails. It had an F3 before, I changed it just to try if that was the issue.

The only thing is that in our organisation, the users we use to log in are a number like XXXXXX@company.com and the emails are the name, like "support@company.com", but I really don't think that should be an issue... I logged in successfully with the user for the accoun I'm configuring, got the token correctly, but then nothing, I'm also really confused, been hours looking for someone who had the same issue...

KevinTheJedi

Mguerrero

Go to the Microsoft Admin Center, go to Users > Active Users, click the user's name, click the Account tab, and see what the Username and email option is set to. It must match the address you are configuring in osTicket.

Cheers.

Mguerrero

KevinTheJedi

This looks good and matches:

I deleted the token to log in again to show you with wich account I logged in.

KevinTheJedi

Mguerrero

Change the "User Logon Name" to the actual email address, get new tokens, and retest.

Cheers.

KevinTheJedi

Mguerrero

Oh, and the Username in the other part of the screenshot. So two changes total, The User Logon Name and the Username in the User Account management popup. Then delete the tokens, get new ones, and retest.

Cheers.