OAuth2 to Microsoft 365 only works once

npadmin

KevinTheJedi
Hi KevinTheJedi - thanks for your quick response.
I've downgraded to PHP 8.2.16, but there's no change, even when testing in a private browser window.
There's no change in the (lack of) log output, even with osTicket's log level set to debug.
The backend value I'm seeing in _user_account entries is: oauth2.user.p10i8.

KevinTheJedi

npadmin

Is that the correct Plugin ID (10) and Instance ID (8)? You can compare the IDs to the ones in the _staff table backend values to confirm.

Are the Users showing as Active (Registered) in the Agent Panel > Users > User Directory?

Cheers.

npadmin

Hi Kevin.

I can't confirm the values from the _staff table - the entry for my working account has no value for backend (although it is not null). Looking at the _plugin and _plugin_instance tables I can see those IDs match, though.

Yes, users show as 'Active (Registered)' in the user directory.

KevinTheJedi

npadmin

the entry for my working account has no value for backend (although it is not null).

I’m confused by this statement. It has not value but not null? Is it just empty (blank)?

Can you test with your own account?

Cheers.

npadmin

KevinTheJedi
Yes. In the _staff table, the value for backend is blank.

In the _users table, it is oauth2.user.p10i8

I can log in as both a User and an Agent using the OAuth2 client's "Sign in with" button.

KevinTheJedi

npadmin

What does your OAuth2 SSO Plugin Config look like (including the attributes)?

Cheers.

npadmin

Here are the current settings. As far as I can see, they're correct.

KevinTheJedi

npadmin

That all looks correct to me. Can you replicate this issue? If so, once you are able to replicate it open an Incognito/Private window (or even better a completely different browser) and see if it lets you login again. If so then it sounds like session issues. For clarity I'm unable to replicate this issue so I'm just throwing things out there that I can think of.

Cheers.

KevinTheJedi

npadmin

Also, do you have a non-docker server to test with? We don't have an official osTicket docker container so all the ones you see out there are not recommended.

Cheers.

npadmin

Hi Kevin. Thanks for your continued support 🙂

I'll have a look at rebuilding outside docker to see if it behaves the same.

To note, I've built my own docker image (pastebin[dot]com/92Vu47nV) - based on php-apache (hub[dot]docker[dot]com/_/php/tags?page=1&name=8.2.16-apache). I added the various dependencies much as you would for a manual build, then I connected my www/root as a bind mount.

Anyway, I'll let you know how I get on.
Thanks for your help!

npadmin

Well, now I wish I was a good internet citizen and came back to share my fix...

I eventually did get everything working with my Entra auth for users, but I don't remember how. Which would come in really useful right now, since I'm trying to do a 'lift and shift' of the setup (still Docker) to a new server, and it's doing this same thing again:

New users can log in via Entra OAuth2, but once they've logged out or the session expires, the login does not work any more.
Existing users who have already logged in with OAuth2 once now can't log in at all - they're redirected to the home screen without being logged in.

I've been trying to figure this out for two days, now. Http headers, Entra app secrets, reverse proxy setups, php versions, file permissions - I've tried every 'fix' and bit of advice I can find! I really with I'd noted down what I did before!

If anyone has any suggestions that might save me from starting over from scratch, please share!

KevinTheJedi

npadmin

If you clear sessions and cookies does it start working again?

Cheers.

npadmin

I might just have cracked it for now.

I was snooping through the database to see what differences I could find between agent and user accounts, and I noticed a discrepancy in the fields returned from the OAuth process.

I have no idea how the data returned from Entra ended up being different, but for some reason it was returning the <user>@<domain>.onmicrosoft.com email address where it needed the plain email address. A quick change of mappings and my test accounts are now behaving!

Just got to wait until the next user opens a ticket to see if it works for everyone - it's a bit late on a Friday to ask anyone to log a test ticket, now.

Thanks for jumping in and responding so quickly, KevinTheJedi . Reading through this forum, your name is everywhere, helping people out. What a legend 😃

npadmin

Sadly no. I've been testing in private browser sessions across a couple of browsers and not got anywhere 🙁

I have discovered that if an email address is already registered to an Agent, Entra SSO works fine when accessing the user pages. (I don't use SSO for agent logins. Those are still local db entries..)