OAuth2 not allowing to configure

spangie84

Currently running osTicket v1.17.2 and OAuth2 Client Plugin is enabled and an instance has been created for the email address we have been using for our instance of osTicket. Our Organization has created the Azure info on their end and it is the one we have been using since Sept of 2023.
When I go to Emails > Emails > Click the email to set up OAuth2 for Microsoft > Select Remote Mailbox > select OAuth2 Microsoft and click the Config button. When I click "config" it doesn't load the page. It just displays a slim white box across the screen. See screenshot: .
I'm not sure what to do. The person who set this up has passed away and my team exclusively uses osTicket.

Angie

KevinTheJedi

spangie84

This means there is a fatal error. You need to check your PHP/Webserver Error Logs for any related errors. It's likely you'll have to follow the same steps as this thread:

https://forum.osticket.com/d/104234-cannot-fetch-emails-from-micorsoft-account-nor-edit-the-connection-settings

Cheers.

spangie84

KevinTheJedi
Thanks for the info. I am new to this position, so I apologize for the dumb question, but where can I find the records that need to be deleted?

"You will need to delete the associated _email_account records for the email in question, associated _plugin_instance record(s) for the email in question, and any associated _config records for the email and plugin instance. Then you can go to the email and reconfigure the OAuth2 and fetching/sending information."

_email_account - The email account that needs to be deleted is the primary email for our osTicket system, so it's greyed out in the Emails > Emails section, so I cannot deleted it.
_plugin_instance - I did delete the previous plugin for OAuth2, reinstalled it and re-created the instance for the Microsoft OAuth2 that was created.
_config records for email and plugin instance - I do not know where to find these records.

Thank you,
Angie

KevinTheJedi

spangie84

All of this is within the database. Look at the _email_account table, the _plugin_instance table, and the _config table and follow the instructions above.

Cheers.

spangie84

I have deleted the records for anything in the database that was tied to the rogue email account that was in the _email_account, _plugin_instance and _config table. It let's me go through the OAuth2 set up process, but now I'm seeing an error called, "Invalid_client". I'm using all the settings that were working fine before. What causes this error?

KevinTheJedi

spangie84

Something appears to be misconfigured. I can’t tell what as I can’t see your settings but that’s typically the cause of this specific error.

Cheers.

spangie84

Sorry, here are the settings.

KevinTheJedi

spangie84

I need to see it within the email config. This is showing from the plugin instance.

Cheers.

spangie84

KevinTheJedi

spangie84

Your Authorization Endpoint and Token Endpoint values don’t look correct. You need to find the appropriate ones from your azure app.

Cheers.

spangie84

There is a separate IT team at my college that set up our Azure Portal application for our osTicket email. The settings that they have on their end don't seem to match the old settings.
https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize
https://login.microsoftonline.com/organizations/oauth2/v2.0/token
These did not help it to work either, unfortunately. Do these look more like what you'd expect?

Angie

KevinTheJedi

spangie84

If you configured your app as Multi-tenant then yes. Typically people set it as Single Tenant (your tenant only). You should look at the Endpoints button within the App Registration that you are using.

Cheers.

KevinTheJedi

spangie84

You also need to make sure that the Client ID you have is the appropriate "Application (client) ID" from the App Registration you are using. You should also ensure the Client Secret you have is the Client Secret Value; not the Client Secret ID.

Maybe you should have your IT Team read the docs and follow the steps exactly as it states:

https://docs.osticket.com/en/latest/OAuth2/Microsoft%20Authorization%20Guide.html

Cheers.

spangie84

Ok, I've been using the Client Secret ID, so that helps solve one mystery. I've adjusted everything to use the client secret value and it accepted the config, so no more "invalid_client" error. Now, I am getting an error that says, "cannot select INBOX, is this a valid transport?" What can I do for that error?
-Angie

KevinTheJedi

spangie84

Did you auth as the correct email address? When it brings you to MS to authenticate you should be authenticating as the actual email you are configuring in osTicket. If you are authenticating as that email then it sounds like this is not a real email instead a mailing list, shared mailbox, etc. If that's the case you'll need a user you can auth as to have full read/manage/send permissions to the system email you are configuring (via MS configurations). Then when you configure the auth popup disable the Strict Matching option, submit the popup, auth as the user that has full permissions to the email address, and you should be good. Sometimes the Strict Matching setting doesn't save the first time so you may need to do these last steps twice.

Cheers.

spangie84

I was able to get it up and running. I had to delete things from the _config, _plugin, _plugin_instance, _email_account tables. I cleared the cache from my browser and opened osTicket in an incognito browser. I set everything up again in that environment and it seems to be pulling in tickets again.
You really are a Jedi, Kevin! Thanks! - Angie

hsh

Dear all, I simply cannot send emails via OsTicket using MS365.

Below is a print of the OsTicket settings:

I followed all the procedures described in the manual, I was even able to generate the token.

smtp: OAuth2 Authorization Successful

https://docs.osticket.com/en/latest/OAuth2/Microsoft%20Authorization%20Guide.html

I redid the configuration process, cleaning up remnants, as advised in another help in the tables described (ost_config, ost_email, ost_email_account and ost_plugin_instance), and reconfiguring everything in anonymous tabs.

I tried to configure SINGLE TENANT and MULTIPLE TENANT, for both I can get the token, even so, the email is not sent; I even monitor the EXCHANGE SERVER, without success.

In SMTP configurations, with the two tests below, the errors are as follows:

I don't know what else to test, can you help me - guide me?

Grateful !

KevinTheJedi

hsh

Hostname should be smtp.office365.com and port number should be 587. It's always a good idea to check the mail provider's documentation for the correct host information to use.

Cheers.

hsh

Hi Kevin, tks for your quick reply.

You're right, I used the Outlook settings as a reference - OWA.
https://support.microsoft.com/en-us/office/pop-imap-and-smtp-settings-for-outlook-com-d088b986-291d-42b8-9564-9c414e2aa040

However, when entering "smtp.office365.com:587" the error persists. Any other guidance/tip?

Regards...

KevinTheJedi

hsh

Sounds like maybe a firewall issue, etc. on the webserver as your server cannot connect to that host and port over TLS. Check your server logs, etc. and/or contact your hosting provider to see if they have any External SMTP restrictions, host/port restrictions, if they allow/support TLS, etc.

Cheers.

hsh

KevinTheJedi

Yes... it makes sense. I tested it on another host and it worked. I will research more and I will question the webserver team. Thank you again.