oauth2 using ipv6

PeteB

We're trying to use the oauth2 plugin to connect to a o365 mailbox to retrieve mail, but we're having an issue setting up mailbox. When we click save, it takes us to 365 auth, but then errors out with a curl error that lists an ipv6 address - ipv6 is off server wide so we're not sure what's going on:

cURL error 7: Failed to connect to 2603:1027:1:d8::4: Network is unreachable (see https://curl.haxx.se/libcurl/c/libcurl-errors.html) for https://login.microsoftonline.com/TENNANTID/oauth2/v2.0/token

KevinTheJedi

PeteB

Seems like it’s coming from the endpoint it’s listing in the error (ie. https://login.microsoftonline.com/TENNANTID/oauth2/v2.0/token).

Cheers.

PeteB

when we try a wget or curl from the command line it comes back without error

This is the error in OSTicket:

"2603:1027:1:d8::4: Network is unreachable" implies it's trying an IPv6 address to reach it, which is probably why it's failing, but why would the plugin would be trying an IPv6 address when it's disabled server-wide?

The server itself IPv6 disabled in sysctl:
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.lo.disable_ipv6 = 1

Is there some apache/php/osticket/oauth config somewhere that we could disable this behaviour?

We've been looking at this and trying several things but nothing we've found searching the web has helped at all.

The guide we were originally following before we hit this snag was this one:
https://howtohelpdesk.com/how-to-setup-oauth-on-osticket-using-microsoft-365/

Any pointers would be much appreciated.

KevinTheJedi

PeteB

Can you make a PHP Info file in your osTicket directory and see if you can find a setting called "IPv6 Support" and see if it is set to Enabled or Disabled? Also in the "cURL" section of that PHP Info file you may see a setting called "IPv6" that may be set to Yes.

Cheers.

PeteB

Ahh, that is odd. Yes, IPv6 comes up in the phpinfo and curl -V

Any idea (on rocky 8) how I would disable that for php/curl ? (or why they don't pick up on the system settings?)

I can't find a php or curl setting to change anywhere 🙁

I'm finding very conflicting articles elsewhere on the web (some saying to just disable it system wide in sysctl like we already have, others talk about named, but we're not running named)

KevinTheJedi

PeteB

I do not, no, just never had the need personally. I see the same articles so I’m not sure. If all else fails you might have to modify the code to add a statement to disable ipv6 (ie. curl_setopt($ch, CURLOPT_IPRESOLVE, CURL_IPRESOLVE_V4); - just note the $ch variable will have a different name in our code).

Cheers.

PeteB

I think I've put that in a place that helps !?

now getting this error instead (which I think is a step forward but still stuck haha!

at least the ipv6 stuff has gone!

KevinTheJedi

PeteB

It says it's failing to connect to login.microsoftonline.com on Port 443 (ie. HTTPS). Try to do an nslookup on the domain, copy the IP, manually update your server's /etc/hosts file to include the domain name and the IP, and retest.

Does your server have a firewall running or something?

Cheers.

PeteB

Thanks for helping so far. Now that you mention it, there's nothing blocking outbound requests, however we do use a http(s) proxy, and so I wonder if I also need to set options to make curl (when invoked within php) use the http proxy (when using the --noproxy option for curl I get the same error as displayed above.
So that's my next direction of attack I think!

PeteB

We're still not having any joy with this.

We've now tried a brand new rocky9 install with fresh httpd 2.4 & php 8.2, however we cannot bypass the site proxy

We just can't find anywhere to add the php curl proxy info that makes this work:
curl_setopt($ch, CURLOPT_PROXY, "x.x.x.x:x");

I can only see curl options being refernced in these files:
include/cli/modules/i18n.php
include/mpdf/vendor/mpdf/mpdf/src/RemoteContentFetcher.php

Adding the proxy curl options in these doesn't seem to make any difference for the oauth2 plugin

I've a feeling that it's in the auth-oauth2.phar plugin that curl gets called, but that's a binary file and any attempt I made to put a proxy option in there broke the whole plugin

We can't be the only ones trying to use MS o365 / oauth2 behind a site proxy ??

Any ideas or suggestions on where to go from here greatly appreciated

KevinTheJedi

PeteB

The OAuth2 package we use is called thephpleague/oauth2-client. They use a package called guzzlehttp/guzzle to make HTTP requests. It looks like Guzzle has an option called force_ip_resolve that you can pass in to the request that will force IPv4. Unfortunately we don't call that within the codebase but rather the plugin. So you will need to unpack the plugin (eg. cd /path/to/osticket/include/plugins/ && php -r '$phar = new Phar("auth-oauth2.phar"); $phar->extractTo("./auth-oauth2");'), update the correlating _plugin record in the database (change isphar to 0 and remove .phar from the install_path), and update the following lines in the unpacked plugin files:

https://github.com/osTicket/osTicket-plugins/blob/2bb771799a54dbacddfcf87851ca534e3b2af2dc/auth-oauth2/oauth2.php#L153-L161

In both of these methods, try adding , 'force_ip_resolve' => 'v4' to the second parameter (array). Example, change:

['code' => $code]);

..to:

['code' => $code, 'force_ip_resolve' => 'v4']);

Note, you may need to reload the webserver and PHP-FPM (if you're running it) to clear the file cache. PHAR files are especially aggressively cached.

Cheers.

PeteB

We've already solved the ipv4 issue.

We were hitting a proxy issue - but we've managed to solve this by punching a http/https hole in the firewall to login.microsoftonline.com which has sorted that - have connected and obtained the token as in the setup guides

However it's still not fetching mail

I can't tell if this is because we're on a RH/Rocky distro that doesn't support php-imap in php 8, or there's some other issue at work. I can't find any errors in any logs (osticket/apache/php/entra) to suggest anything.

I saw another post saying you've moved away from native php-imap from v1.17.2 - is this also true for 1.18.1 ?

PeteB

Ok, so I'm an idiot and didn't click enable OR fill in the other settings

I'm trying these settings now - I'm not sure if it's outlook.office.com (url we use in a web browser) or outlook.office365.com but they both give same error

I'll see if this is just another firewall issue

KevinTheJedi

PeteB

That’s exactly what that is lol Network unreachable means your server cannot contact that host. Since we know it’s a legit host it’s most likely your network/firewall.

Cheers.

PeteB

ok so punching another hole in the firewall for outlook.office.com:993 seems to have done the trick.

Phew, got there in the end!!

Thanks for all the help