Using a form external to OS Ticket to submit tickets

mikes1979

My apologies if this has been answered, I've been picking through forums and trying things for a week, and I finally had to get clarification from the source.

I have OSTicket installed and folks are assigned as agents. We want users to hit a simple web form, fill it out, and have it create a ticket so that no login is required to submit a ticket.

I've got the form built, the api key configured, and I'm able to hit the api. My issue is that the form lives on the same server as OSticket, and the address the api is validating is the address of the user who is hitting the form page.

Do I need to spin up another web server just to host this form, so that the $_SERVER['REMOTE_ADDR'] will contain a static IP addres when submitted? Am I missing something?

KevinTheJedi

mikes1979

That doesn’t seem right. Are you saying the IP the API is checking the key against is the User's IP instead of the server's? That doesn’t make much sense as the IP comes from the server sending the request.

What message are you getting specifically when sending the API request?

Cheers.

mikes1979

Thank you for your response, KevinTheJedi. I agree it doesn't make much sense, which is why I fought and searched for an answer before coming here. I must be missing something.

The message is "Valid API key required". I added an API key for the external/WAN ip, one for the server's loopback address, one for the internal IP address of the server hosting OS Ticket and the form, and one for the workstation I'm using for testing. When I submit a Curl request via console on the server using the API key associated with the loopback address, everything comes up roses. When I use any of the API keys in the form, I get that error.

I dug into class.api.php, and noticed that the class is checking $_SERVER['REMOTE_ADDR']. When I look at phpnfo(), that variable via a page served by the server, using the workstation I'm using to test, that variable has the IP of the workstation I'm using to test. Not the server, nor the server's loopback address. It's very possible and most probable that I'm overlooking an important detail in terms of $_SERVER variable assignments, I just can't see it.

Side note: It may be helpful to know, and quite possibly will shed light on what I'm missing, that both server and the test workstation are internal to this organization. We use proxied cloudflare for DNS, and the URL is only accessible internally.

Thank you kindly in advance for your help!

Best,

Mike

Edit: Spelling, grammar, clarity.

KevinTheJedi

mikes1979

Are you sure you’re including the API Key in the request via the X-API-Key header? Like maybe the script the site form is using to generate the request is not adding the header appropriately.

Cheers.

mikes1979

KevinTheJedi I am setting it via Curl. It's very possible I've got an i that is undotted or a t that is not crossed. That would be a bit embarrassing for an old guy who's been doing this a long time, but it's a good place to start. I'm actually on vacation next week, so I'll select your answer as best, and make a note to start there. If I am still stuck when I get back to it, I'll reach out again. Thank you and have a fantastic New Year.

Best,

Mike

mikes1979

KevinTheJedi For what it's worth, here's my curl setup.

$ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $config['url']); curl_setopt($ch, CURLOPT_POST, 1); curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($formdata)); curl_setopt($ch, CURLOPT_HTTPHEADER, array( 'Expect:', 'X-API-Key: '.$config['key'])); curl_setopt($ch, CURLOPT_FOLLOWLOCATION, FALSE); curl_setopt($ch, CURLOPT_RETURNTRANSFER, TRUE); $result=curl_exec($ch); $code = curl_getinfo($ch, CURLINFO_HTTP_CODE); curl_close($ch);

KevinTheJedi

mikes1979

I mean that looks fine to me but I don’t use curl like that often. If you are behind a proxy you may need to add your proxy IP(s) to the TRUSTED_PROXIES in your include/ost-config.php file:

https://github.com/osTicket/osTicket/blob/develop/include/ost-sampleconfig.php#L117-L136

Cheers.

KevinTheJedi

mikes1979

One last thing, a good idea would be to set your Default Log Level setting in osTicket to DEBUG, make another request from the form, check your osTicket System Logs, and hover over the failed API Request entry to see what IP it’s using to make the request. It may be a different IP altogether.

Cheers.

mikes1979

KevinTheJedi Thank you. It just occured to me the WAN IP at this site may be load balanced, too. Either way, I'm back at work from vacation next week and I'm certain the last 2 items you suggested will get me through. Thank you again for your assistance.

Best,

Mike

mikes1979

So, the IP address it's evaluating in the class.api.php is the IP address of the guest user. I'm guessing because this the workstation I'm submitting the ticket on is on the same network as the server that is hosting OSTicket that is causing it to evaluate based on the internal IP address. Short of adding all 512 addresses from 192.168.0.1/23, I'm not sure where to go from here.

Edit: Nevermind, I was having a senior moment. I should be able to add a DNS record in Cloudflare and remove the internal dns record so that the lookup hits cloudflare. That's probably the easiest way to handle this.