osTicket 1.17.x - OAuth2 authentication issue

spangie84

Our University recently migrated our "stand alone" office 365 shared mailbox accounts to web supported versions with users only being able to access the mailbox if they're in the authorized users group. We received an exception to allow our emails to retain a password so that we can continue to use osTicket, but we cannot log into the email using the normal email account example@college.edu. We can only log into it using the college email example@thisiscollege.edu. It's the same email, but cloud-based.
Does osTicket have to sign into the email using the exact example@college.edu email address? Do the username and email address have to be the same?

osTicket lets me authenticate the email, but it will not save it. I get the following error...

oauth-example.pdf

41kB

I've confirmed that we are entering the correct Azure Portal App permissions and that it is configured correctly.

KevinTheJedi

spangie84

Please post the errors inline as images or plain-text. We do not download anything nor go to 3rd party sites. This forum allows for image uploads and even code blocks where you can input the errors so they are formatted nicely.

So if I understand you correctly, you want to configure fetching/sending for an O365 email (ie. in the cloud), right? If so, you would need to follow the Microsoft Authorization guide below to configure their new Modern Authentication (OAuth2):

https://docs.osticket.com/en/latest/OAuth2/Microsoft%20Authorization%20Guide.html

Please note that this requires the webserver to have the URL Rewrite module to be installed and enabled for the site. Additionally, this requires the download and installation/activation of the OAuth2 plugin available here.

Note:
For Shared Mailboxes specifically, you would need an admin account or service account or user account (that you can login as) to be added to the shared mailbox's "Send as" and "Read and Manage" Permissions. Then in osTicket once you configure the OAuth2 information it's super important that you uncheck the box for Strict Matching. Once you do that, follow the OAuth2 guide, and submit the OAuth2 popup in osTicket you will be redirected to Microsoft to authenticate. At that stage you would login as the admin account/service account/user account you added to the "Send as" and "Read and Manage" permissions. You might get an error the first time saying email mismatch but you simple need to uncheck the Strict Matching box one more time and resubmit the popup.

Note 2:
It's also super important that you do all of this within an incognito window so Microsoft doesn't use your personal account to authorize. If you authorize your personal account it will not work or will start pulling in your personal emails and not the shared mailbox emails.

Cheers.

spangie84

KevinTheJedi - thank you for the feedback. My apologies for the attachment. The forum did that automatically when I tried to paste a screenshot. I will try these instructions. Thank you! - Angie

spangie84

Something I’m not finding is the “uncheck box for strict matching”. I cannot find that setting within osTicket. We have osTicket version 1.17.2 installed. Is that something that is only available for newer versions of osTicket?

• I have reached out to our Azure Portal manager and he has added the additional “user.read” permission to the Azure Portal App.
• The URL Rewrite module was already installed by my predecessor. It seems to match what I’m seeing in the other threads about URL Rewrite settings for osTicket.
• I found a GitHub thread that I believe you posted that includes some additional lines to the php files within the include and scp paths. (I saved a backup of those files in case that was the wrong move)
o Here’s the link that I referenced: https://github.com/osTicket/osTicket/commit/76149d65ef54563e294ff0982d3fd4c52d6a3999
• The OAuth2 plugin is installed and enabled.
• I have user permission to access the email account.

KevinTheJedi

spangie84

You should always be running the latest version of osTicket and latest builds of the plugins. Upgrade core and plugins to latest. Then you should see a strict matching option in the authentication config popup when configuring OAuth2.

Cheers.

spangie84

While researching, I did find something that mentioned that this Modern OAuth2 authentication isn't available on v1.17.2. I updated to 1.17.5 and am seeing the strict matching. I have access to that O365 shared mailbox via a security group. I'm getting the error, “Email Mismatch: Expecting Authorization for support@college.edu not spangie84@college.edu."

Would I need to be given permissions using my email address with "send as" and "read and manage" permissions?

Thank you.

KevinTheJedi

spangie84

Yes, you would need to add the user you are logging in as (spangie84) to the "Send As" and "Read And Manage" permissions for the "support" mailbox. Then you uncheck the strict matching again, resubmit, and re-authorize. If it gives you the mismatch error again simply reopen the popup, uncheck the box, and resubmit the popup. Sometimes that option doesn’t get saved on the first submission.

Cheers.

spangie84

Unfortunately, I am still struggling to get our default O365 shared mailbox to authenticate with osTicket 1.17.5.

I believe that the Azure app is configured correctly after working with our University IT rep. I'm suspecting that the issue has something to do with the URL Rewrite. It is installed, but I suspect that it may not be configured correctly for the site to allow the incoming/outgoing O365 email. I've been combing through all of the OSTicket documentation/videos/forums and I see that others have been able to set this up, but I cannot find out what specific information needs to be entered in the URL Rewrite rules for incoming and outgoing emails. I am very new to my role here and the person who did set this up has passed away.

Our server is using IIS, but the instructions for IIS do not specifically cover how to enable that for incoming/outgoing O365 email. Do you know of any documentation that gives those specific instructions?

Thank you, Angie

KevinTheJedi

spangie84

I’m sorry to hear that. There are no specific rules to add if you are using IIS. Just make sure the URL rewrite is enabled for the specific site. Go to the site in the iis manager directory tree and see if it shows URL Rewrite option. If so, click on it and make sure it has the basic http.php rules and you should be good.

For a shared mailbox you have to add a service account/admin account/user account (basically a user with a login) to the Send As and Read And Manage permissions for the shared mailbox in the O365 side. Then when it takes you to MS to authenticate you login as the account you added to the permissions. The important note is to uncheck the box for Strict Matching in the OAuth2 config popup before submitting. You may get an error the first time about a mismatch but you simply open the config popup again, make sure Strict Matching is unchecked, then resubmit the popup, and you should be good.

Cheers.

spangie84

Here's what I'm seeing in the web.config file for our osTicket site:
`<?xml version="1.0" encoding="UTF-8"?>
<configuration>

<system.webServer>
    <directoryBrowse enabled="false" />
    <rewrite>
        <rules>
            <rule name="HTTP api" stopProcessing="true">
                <match url="^(.*/)?api/(.*)$" ignoreCase="true" />
                <conditions>
                    <add input="{REQUEST_FILENAME}" matchType="IsFile" ignoreCase="false" negate="true" />
                    <add input="{REQUEST_FILENAME}" matchType="IsDirectory" ignoreCase="false" negate="true" />
                </conditions>
                <action type="Rewrite" url="{R:1}api/http.php/{R:2}" />
            </rule>
            <rule name="Site pages" stopProcessing="true">
                <match url="^(.*/)?pages/(.*)$" ignoreCase="true" />
                <conditions>
                    <add input="{REQUEST_FILENAME}" matchType="IsFile" ignoreCase="false" negate="true" />
                    <add input="{REQUEST_FILENAME}" matchType="IsDirectory" ignoreCase="false" negate="true" />
                </conditions>
                <action type="Rewrite" url="{R:1}pages/index.php/{R:2}" />
            </rule>
            <rule name="Staff applications" stopProcessing="true">
                <match url="^(.*/)?scp/apps/(.*)$" ignoreCase="true" />
                <conditions>
                    <add input="{REQUEST_FILENAME}" matchType="IsFile" ignoreCase="false" negate="true" />
                    <add input="{REQUEST_FILENAME}" matchType="IsDirectory" ignoreCase="false" negate="true" />
                </conditions>
                <action type="Rewrite" url="{R:1}scp/apps/dispatcher.php/{R:2}" />
            </rule>
            <rule name="OAuth2">
                <match url="^xxxx.xxx.edu/([0-9]+)/([_0-9a-z-]+)" />
                <action type="Rewrite" url="article.aspx?id={R:1}&amp;title={R:2}" />
            </rule>
        </rules>
    </rewrite>
    <defaultDocument>
        <files>
            <remove value="index.php" />
            <add value="index.php" />
        </files>
    </defaultDocument>
</system.webServer>

</configuration>`

Does that look like url rewrite is configured to you?

KevinTheJedi

spangie84

Yep, otherwise it would have zero rules lol So that's all fine and well.

Do you have the cURL root certificate installed/enabled in your PHP INI? You can visit the link below to read more:

https://martinsblog.dk/windows-iis-with-php-curl-60-ssl-certificate-problem-unable-to-get-local-issuer-certificate/

Cheers.

spangie84

Yes, I do see the cacert.pem is within the C:\Windows\System32\cacert.pem and the PHP.INI points to the correct location.

Angie

KevinTheJedi

spangie84

So you followed the documentation exactly step by step? You copied the correct Client ID (ie. Application (client) ID)? You copied the Client Secret Value and not the Client Secret ID? You copied the two OAuth2 v2.0 endpoints from the Endpoints button and replaced the examples given in the email oauth2 config (ie. Authorization Endpoint and Token Endpoint)? You created the MS application as a Web application and added the correct Redirect URI from the email oauth2 config? You left everything else in the email oauth2 config default (ie. everything after the two endpoints - see image below)?

Cheers.

KevinTheJedi

spangie84

Honestly it seems you were on track when you got the mismatch error. All you needed to do was resubmit the popup with the Strict Matching setting disabled. Once you did that the mismatch error should’ve gone away.

Cheers.

spangie84

I was informed of another piece of this smtp puzzle today. My College has a special SMTP server and they do not allow O365 to authenticate to SMTP.

We have an outgoing SMTP relay that uses simple SMTP authentication.
Here's the details:

hostname: smtp.college.edu
port: 587
encryption: TLS/1.2 (required)
SMTP AUTH methods: PLAIN, LOGIN
SMTP AUTH user: support-sender
SMTP AUTH pass: XXXXXXXXXX

Hopefully your ticketing software has an option for outgoing messages to use simple SMTP AUTH. Once you configure that with the user/pass credentials, you needn't login again for outgoing SMTP.

So, this means that I need to find a way for the outgoing mailbox to allow simple SMTP AUTH.
I would assume that the closest thing to this is Basic Authentication (Legacy). I've tried doing that, and the person helping me said that they are seeing my successful log ins with on the smtp server, but the osTicket software doesn't seem to like it. Is this possible with osTicket 1.17.5?

Thank you so much for all of your help. - Angie

KevinTheJedi

spangie84

Yes, all you have to do is use Basic Authentication. What do you mean by “but the osTicket software doesn’t seem to like it”?

Cheers.

spangie84

KevinTheJedi

I hope this shows up as an image. Sorry, if it doesn't...

Error message, "PROTOCOL Required" in RED at the top and a message stating, "Host, Port & Protocol Required". I have entered all of those things, but the Red message popped up every time. It does go away after a few seconds, but the "Host, Port & Protocol Required" yellow warning message always stays there. If I leave the "Basic Authentication" window and save changes on the Outgoing SMTP tab, a red message under the authentication type says, Configure Authentication.

It does this whether Header Spoofing is checked or unchecked. The Incoming settings authenticate and create a token, but I cannot get osTicket to be happy with the Basic Authentication method. Is there something in the settings that needs to be changed to allow that? The college IT team is seeing successful logins on their smtp server, but osTicket doesn't agree.

Angie

KevinTheJedi

spangie84

Set the Status to Disabled, enter the Hostname, enter the Port number, set the Authentication to None, and Save Changes. Then set Authentication to Basic Authentication, click Config, enter the Password, Save the popup, set the Status to Enabled, and Save Changes.

Cheers.

spangie84

The above workaround allowed me to save the login details for outgoing. I am now able to send outgoing emails! Thank you so much!

It was still not allowing me to save the incoming settings when saving the info on the Remote Mailbox tab. Now that I know this trick, I disabled Remote Mailbox because that is still causing some issues when I save changes...no idea why. With remote mailbox disabled, I can send myself an email from osTicket.

Do you know where I can look in the error logs to investigate why this is happening? I am entering all the correct info, to my knowledge. I am going to check with our O365 people to see if something changed when they moved the mailbox to O365. I did ask, but I'll ask again. 🙂

A big Cheers to you! - Angie

KevinTheJedi

spangie84

Sorry for the roundabout posts earlier to get to this point but when you said your emails were moved from standalone O365 to web versions I thought you meant from a local mail server to the cloud O365, in which they are forcing modern authentication. Either way glad that’s working.

As far as incoming, what errors are you seeing exactly?

Cheers.