osTicket 1.17.x - OAuth2 authentication issue: Page 2

osTicket 1.17.x - OAuth2 authentication issue

KevinTheJedi

Yep, otherwise it would have zero rules lol So that's all fine and well.

Do you have the cURL root certificate installed/enabled in your PHP INI? You can visit the link below to read more:

https://martinsblog.dk/windows-iis-with-php-curl-60-ssl-certificate-problem-unable-to-get-local-issuer-certificate/

Cheers.

spangie84

Yes, I do see the cacert.pem is within the C:\Windows\System32\cacert.pem and the PHP.INI points to the correct location.

Angie

KevinTheJedi

spangie84

So you followed the documentation exactly step by step? You copied the correct Client ID (ie. Application (client) ID)? You copied the Client Secret Value and not the Client Secret ID? You copied the two OAuth2 v2.0 endpoints from the Endpoints button and replaced the examples given in the email oauth2 config (ie. Authorization Endpoint and Token Endpoint)? You created the MS application as a Web application and added the correct Redirect URI from the email oauth2 config? You left everything else in the email oauth2 config default (ie. everything after the two endpoints - see image below)?

Cheers.

KevinTheJedi

spangie84

Honestly it seems you were on track when you got the mismatch error. All you needed to do was resubmit the popup with the Strict Matching setting disabled. Once you did that the mismatch error should’ve gone away.

Cheers.

spangie84

I was informed of another piece of this smtp puzzle today. My College has a special SMTP server and they do not allow O365 to authenticate to SMTP.

We have an outgoing SMTP relay that uses simple SMTP authentication.
Here's the details:

hostname: smtp.college.edu
port: 587
encryption: TLS/1.2 (required)
SMTP AUTH methods: PLAIN, LOGIN
SMTP AUTH user: support-sender
SMTP AUTH pass: XXXXXXXXXX

Hopefully your ticketing software has an option for outgoing messages to use simple SMTP AUTH. Once you configure that with the user/pass credentials, you needn't login again for outgoing SMTP.

So, this means that I need to find a way for the outgoing mailbox to allow simple SMTP AUTH.
I would assume that the closest thing to this is Basic Authentication (Legacy). I've tried doing that, and the person helping me said that they are seeing my successful log ins with on the smtp server, but the osTicket software doesn't seem to like it. Is this possible with osTicket 1.17.5?

Thank you so much for all of your help. - Angie

KevinTheJedi

spangie84

Yes, all you have to do is use Basic Authentication. What do you mean by “but the osTicket software doesn’t seem to like it”?

Cheers.

spangie84

KevinTheJedi

I hope this shows up as an image. Sorry, if it doesn't...

Error message, "PROTOCOL Required" in RED at the top and a message stating, "Host, Port & Protocol Required". I have entered all of those things, but the Red message popped up every time. It does go away after a few seconds, but the "Host, Port & Protocol Required" yellow warning message always stays there. If I leave the "Basic Authentication" window and save changes on the Outgoing SMTP tab, a red message under the authentication type says, Configure Authentication.

It does this whether Header Spoofing is checked or unchecked. The Incoming settings authenticate and create a token, but I cannot get osTicket to be happy with the Basic Authentication method. Is there something in the settings that needs to be changed to allow that? The college IT team is seeing successful logins on their smtp server, but osTicket doesn't agree.

Angie

KevinTheJedi

spangie84

Set the Status to Disabled, enter the Hostname, enter the Port number, set the Authentication to None, and Save Changes. Then set Authentication to Basic Authentication, click Config, enter the Password, Save the popup, set the Status to Enabled, and Save Changes.

Cheers.

spangie84

The above workaround allowed me to save the login details for outgoing. I am now able to send outgoing emails! Thank you so much!

It was still not allowing me to save the incoming settings when saving the info on the Remote Mailbox tab. Now that I know this trick, I disabled Remote Mailbox because that is still causing some issues when I save changes...no idea why. With remote mailbox disabled, I can send myself an email from osTicket.

Do you know where I can look in the error logs to investigate why this is happening? I am entering all the correct info, to my knowledge. I am going to check with our O365 people to see if something changed when they moved the mailbox to O365. I did ask, but I'll ask again. 🙂

A big Cheers to you! - Angie

KevinTheJedi

spangie84

Sorry for the roundabout posts earlier to get to this point but when you said your emails were moved from standalone O365 to web versions I thought you meant from a local mail server to the cloud O365, in which they are forcing modern authentication. Either way glad that’s working.

As far as incoming, what errors are you seeing exactly?

Cheers.

spangie84

I was also under the impression that it was the full modern authentication, but it can be tricky when another team is in charge of the O365 environment. I believe that the Remote Mailbox set up should still use the same modern authentication method, though. When attempting to set up Remote Mailbox, I am able to authenticate and create a Token by entering my personal ID info.

Info:

IdP config:

Token:

I checked with the O365 Manager and they've confirmed that the Azure App didn't change at all. Its the same App ID and Secret Value as it has always been.

Angie

KevinTheJedi

spangie84

Is IMAP enabled on the MS side for the mailbox you are attempting to use in osTicket? Did you add the Resource Owner account to the Read and Manage Permissions of the mailbox you are attempting to use in osTicket? Did they add the correct Microsoft Graph > Delegated permissions > IMAP.ReadAll permission to the App Registration and provide Admin Consent for it? If not and they make any changes it’s best to delete the existing token (using the Delete Token button) and reauthorizing to get a new token once the permissions have been granted.

Cheers.

spangie84

We are back up. Turns out they were blocking IMAP. I gave them all the information for how we were trying to connect, but they must not have noticed that. I've been chasing a wall. Thanks for your help!

Angie

« Previous Page