OAuth2 Office 365 setup issues (I'm going mad)

Mguerrero

UPDATE

Looks like after some time waiting , without doing nothing else, it worked and the authorization was successful....
Now I am facing another error when I try to enable email fetching it says: "cannot select INBOX, is this a valid transport?"
Anyone knows why this happens?

KevinTheJedi

Mguerrero

You are likely using the wrong account to authorize. When it brings you to MS you just login as the email you are trying to configure.

Also, having to request permission breaks the auth flow and we never get a token. So if you have to request permission it will not work.

Cheers.

Mguerrero

KevinTheJedi Hi Kevin, Thanks for your anwser.
I've used the same account to authorize than the one I am configuring. I also got the token and it refreshes every time I try to connect:

In fact, I've only used one account for this purpose and also did it in a private window of the browser to prevent other accounts to interfere.
Thank you!

KevinTheJedi

Mguerrero

Do you have a Delete Token button on the Token tab?

Cheers.

Mguerrero

KevinTheJedi sorry I cut that part. Yes, I have it.

KevinTheJedi

Mguerrero

Then the only things I can think of are:

The API Permissions were not added correctly or admin has not provided consent to them.
Something wrong/misconfigured with the app registration.
The email is not a real full user account with license.

Cheers.

Mguerrero

KevinTheJedi
Hi Kevin,
Going to ask the Azure admin about this two first topics you mentioned, the third one is not possible as I know the license is correct.

Thank you for your help! I'll update this in case I find the solution for anyone that faces something similar.

KevinTheJedi

Mguerrero

Also in the Admin center make sure the Iser account has IMAP and Authenticated SMTP enabled under the Mail tab.

Cheers.

Mguerrero

KevinTheJedi
Checked with the azure admin, aparently everything was Ok. Deleted the token and got it again, we tried again but is still the same error again and again "cannot select INBOX, is this a valid transport?" We dont know what more to do, also tried POP instead of IMAP and I got another error that was empty (only the red alert symbol)

KevinTheJedi

Mguerrero

Then you’ll need to post screenshots of all you App Registration config censoring any sensitive info. Something has to be configured wrong.

Cheers.

Mguerrero

KevinTheJedi
Hi Kevin,
This is my config. If you need to see something from the azure config, let me know as I don't have access to that part...

Thank you so much

Edit: more from azure

KevinTheJedi

Mguerrero

That’s what I said above. Screenshots of the App Registration. The Authentication tab, the Certificates and Secrets tab, the Endpoints tab, the API Permissions tab, etc.

Cheers.

Mguerrero

KevinTheJedi
Asked for all this... I'll be back later with that. Thanks!

Mguerrero

KevinTheJedi
Hi Kevin, I have uploaded all the screenshots from azure that the admin sent to me, in my other reply, I edited the message.
Thank you so much for your help!

KevinTheJedi

Mguerrero

I don’t see anything wrong here… are you sure the email user has a full, valid account with a license? If so I’m out of ideas.

Are you using the latest build of the OAuth2 plugin from our website?

Cheers.

Mguerrero

KevinTheJedi
Hi Kevin,
I set up the server two or three weeks ago, so everything should be last version, I think oauth2 plugin is v0.6
Also, this account has an E3 license, so it has a mailbox and is able to send emails. It had an F3 before, I changed it just to try if that was the issue.

The only thing is that in our organisation, the users we use to log in are a number like XXXXXX@company.com and the emails are the name, like "support@company.com", but I really don't think that should be an issue... I logged in successfully with the user for the accoun I'm configuring, got the token correctly, but then nothing, I'm also really confused, been hours looking for someone who had the same issue...

KevinTheJedi

Mguerrero

Go to the Microsoft Admin Center, go to Users > Active Users, click the user's name, click the Account tab, and see what the Username and email option is set to. It must match the address you are configuring in osTicket.

Cheers.

Mguerrero

KevinTheJedi

This looks good and matches:

I deleted the token to log in again to show you with wich account I logged in.

KevinTheJedi

Mguerrero

Change the "User Logon Name" to the actual email address, get new tokens, and retest.

Cheers.

KevinTheJedi

Mguerrero

Oh, and the Username in the other part of the screenshot. So two changes total, The User Logon Name and the Username in the User Account management popup. Then delete the tokens, get new ones, and retest.

Cheers.

Mguerrero

KevinTheJedi
I understand what you say, but I'm not sure I can change the username inside our organisation, all usernames must meet some rules, that's why usernames are numbers and not the actual email adress...