Oauth client portal auto-registration error

nandi96

Github issue link: https://github.com/osTicket/osTicket/issues/6570

We use Microsoft 365 OAuth authentication for login.

STEP1: NORMAL OPERATION
If an e-mail is received in the system from the domain address assigned to OAuth, the user is created as not registered.
STEP 2: UNEXPECTED OPERATION
If the unregistered user subsequently enters the client portal via Oauth, the system will register him.
STEP 3: CHECK SETTINGS - CORRECT VALUE
We have checked the registration method in the settings: Closed - only an agent can register an user.

This is an unexpected operation, we request a bug fix.

Tested on:
osTicket Version v1.17.3
osTicket Version v1.17.4
osTicket Version v1.18
Web Server Software Apache/2.4.57 (Unix)
MySQL Version 10.3.37
PHP version 8.0.28
OAuth Plugin version: 0.6
https://github.com/osTicket/osTicket-plugins/tree/develop/auth-oauth2

ntozier

There are too many variables here to actually assist you.
Which version do you currently have installed and want assistance with?
What is the error that you are getting?

nandi96

ntozier this is the version, what we use now:
osTicket Version v1.18 (724de45)
Web Server Software Apache/2.4.57 (Unix)
MySQL Version 10.3.37
PHP version 8.2.5
OAuth Plugin version: 0.6

KevinTheJedi

nandi96

This is expected behavior. Users who login via OAuth2 will be auto-registered as they are considered pre-authorized users.

Cheers.

nandi96

KevinTheJedi this is so weird for me, so I simply removed a few lines from the source code of the oauth plugin: https://github.com/osTicket/osTicket-plugins/blob/4b545313f38a2f7f0e5b7e9b9c5e89dd629e51cf/auth-oauth2/oauth2.php#L241C12-L249C14

arcepaim

KevinTheJedi
Hello:
For me, this is not an expected behavior. If I have the Registration Required option and the Private Registration method for Users configured, I don't want any new user to register automatically. Google OAuth doesn't allow creating a white or black list of users, so everyone with a Google account can automatically create an account on osTicket in this case. The expected behavior with the Registration Required and Private Registration method options marked is that nobody can register automatically regardless of the method they use to log in.
Even though we have different users with Google accounts working with us, not all of them have an osTicket account and we don't want them to be able to create an account automatically... and this option allows anyone outside the company to create an account automatically because no restriction is possible.

Thanks

KevinTheJedi

arcepaim

I see what you're saying but with the auth providers the users are considered pre-authorized. Maybe we can add a setting after v2.0 to allow anyone to register or to go off the system settings. With this being said you can most definitely restrict who can access the application on the Google side. Please do some research online to see what I'm talking about. It does involve a little work but that's all on the Google side.

Edit:
We can also potentially add a setting in v2.0 for the hd param however with this you can only lock to a single domain, not multiple. So I personally don't like this approach.

Cheers.