Plugin Oauth2 Client version 0.6

lillguill

Good morning,
I have a problem with page redirection using the Oauth2 plugin (microsoft).
Once validation is completed I am redirected to the main page.

I do not encounter this problem when configuring Google Oauth2 (google). so I removed the redirection problems or missing PHP components.

osTicket (v1.17.2)
Apache/2.4.59 (Ubuntu)
Version de MySQL 8.0.36
Version PHP 8.2.19

Thanks for your help.

KevinTheJedi

lillguill

For one you are using an older version. You should upgrade to either v1.17.5 or v1.18.1, install the latest OAuth2 plugin, and retest.

Also, are you trying to configure Email Authorization or are you attempting User/Agent Authentication?

Cheers.

lillguill

KevinTheJedi thanks for taking time to respond to me.
I'll try an update tomorrow.
I am trying to configure email authorization (OK for google KO for Microsoft)
What is the difference between ostickets version 18 and 17 ?

KevinTheJedi

lillguill

The main thing is that the laminas-mail package we use is upgraded. Other than that it's the same.

It's likely you are not configuring the app correctly or using some wrong info in the plugin config. Please follow the below guide exactly as is:

https://docs.osticket.com/en/latest/OAuth2/Microsoft%20Authorization%20Guide.html

Cheers.

lillguill

KevinTheJedi

The update not help 🙁

I scrupulously respected the documentation. no problem with google

My OAuth2 is correct (i think)

KevinTheJedi

lillguill

I would need a lot more information, more logs, debug info, etc. to be able to further assist. Unfortunately these OAuth2 issues are so iffy that it’s hard to figure out and solve over messages.

Cheers.

lillguill

KevinTheJedi
Here 2 HAR files

har.7z

532kB

login.microsoftonline.com.har when i have MS login page
web2.ubpartner.com.har after the authentification.

i have not detail on osticket's log (debug mode).

no error on apache's error log

on apache access log:

.2.1.4 - - [16/May/2024:15:05:29 +0200] "GET /support/scp/ajax.php/email/11/auth/config/mailbox/oauth2:msmail HTTP/1.1" 200 2653 "https://xxx/support/scp/emails.php?id=11" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
10.2.1.4 - - [16/May/2024:15:06:32 +0200] "POST /support/scp/ajax.php/email/11/auth/config/mailbox/oauth2:msmail HTTP/1.1" 201 538 "https://xxx/support/scp/emails.php?id=11" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
10.2.1.4 - - [16/May/2024:15:06:33 +0200] "GET /support/scp/emails.php?id=11&do=autho&bk=oauth2:msmail:11:8:1 HTTP/1.1" 302 704 "https://xxx/support/scp/emails.php?id=11" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
10.2.1.4 - - [16/May/2024:15:07:23 +0200] "GET /support/api/auth/oauth2?code=0.ASEAGdhPRPrDxjUCnCYgb6yI-PQcZ5Rfps4JInY-gJnOXc72GAIc.AgABBAIAAADnfolhJpSnRYB1SVj-Hgd8AgDs_wUA9P_J3Ru98DGHczeRiy8_zfizIRHRCJVmV-cRcr5xhGVUF-iIwufpWHZ0ehPUABOSDU8wuJ3BrLRjR6uIVPNTbNsHagBcUT-TvPJDvjR4iXF-Hfd75ECUO-3Sqr9wRJJoVLFSfEYNtZSwKPHB1kxyUwgnQ-VjEeogMlx5Zm7ryWVbxamXcw9EHiRnHCvL-dgS8h4iUASGAW8daw2k7qsn8ALC1hM1hHtGrcqp8SsCD9sKBsZlyxbHrLXKeAUBxgso4rXi9-RrAIF2vrL-8TXFgqVoGeR42EXrAKa16PbwfvC3XzyoeHv2peHWab_OJ1aj4QghKD9QeeH3hCzHsVxVfyZDJ2XrUSbsNJSs2MvK8h_wYfV7vcToMTTiQK2VQDw05JuPPi4j2n7MIDP8x0hug4ov-L_AsuwtHfd4KuiPhgetN6cNLhGwV1LATDS1IbwDO_pxhZLj7WYlYPciWE1tfHZRY7iHzNxnMbDejqBS-mTg6ArUeFcL1Pr4mzzyiMZ_cRQBS7BhKYW4n-zaWSwgGBdTLJ5E5sD5JqvwmNDbbfq1Y2s59TqIRuxerhNYOh9o0eBgTybziceaADnG-v6HIZlRgya_tHytji_1kvGoEeTEeIprrkx_VnhGmXlUAu6Fb3ct7wWIoBVSgtuC7Sh4sBk0RJaQh4VPjCd_yHAR6peGrzwHTG1daUS2Mzbqov6I0e81ubQTnJisXlNjpRlcNgT-yTgRSvZkvATwxvGEWefNfto_VW9L754nBW37uZu8WIB5FVsfy6zZph64Wj7PIVjS1zLw85bfBrkL1AfLzW&state=1ce63b14bcdf7b4b6481e4498x39ac9a&session_state=a749c13f-e910-4ce0-b95b-x4e4f7653261 HTTP/1.1" 302 477 "https://login.microsoftonline.com/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
10.2.1.4 - - [16/May/2024:15:07:23 +0200] "GET /support/ HTTP/1.1" 200 2582 "https://login.microsoftonline.com/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
10.2.1.4 - - [16/May/2024:15:07:23 +0200] "GET /support/ajax.php/i18n/fr/js HTTP/1.1" 200 3459 "https://xxx/support/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
10.2.1.4 - - [16/May/2024:15:08:43 +0200] "GET /support/login.php HTTP/1.1" 200 2416 "https://xxx/support/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"

KevinTheJedi

lillguill

Are you sure you used the client secret and not the secret id?

Cheers.

lillguill

KevinTheJedi Yes, I can see my authentication in Azure

KevinTheJedi

lillguill

Are you using a shared host or hosting provider? Or are you hosting your own server?

Cheers.

lillguill

KevinTheJedi

on my server (vm on azure)
HAproxy => Apache (ostickets)

KevinTheJedi

lillguill

Then I have no clue without being able to connect to your instance, replicate the issue, review your codebase and Entra application, etc. Since I’m a core dev I cannot do so without our Support Services. You can read more here:

https://osticket.com/commercial-support/

Otherwise you can either wait for a community member to chime in or you can add debug statements to the code and plugin yourself to see where it’s going wrong. You can also research older threads on this Forum to see if someone had this issue before and how they were able to resolve it. It usually means something is not configured correctly in the app or plugin settings but each case can be different. Fwiw, I cannot replicate the issue at all with my O365 tenant.

Cheers.

lillguill

KevinTheJedi
ha OK.
Thanks for taking the time to look.

KevinTheJedi

lillguill

Here is where the redirect (callback()) is called:

https://github.com/osTicket/osTicket-plugins/blob/develop/auth-oauth2/oauth2.php#L346

... and here is the actual content of the callback() function:

https://github.com/osTicket/osTicket-plugins/blob/develop/auth-oauth2/oauth2.php#L362-L368

Cheers.

lillguill

KevinTheJedi
I found the problem.
It comes from the cookie configuration.
Indeed, for security reasons we activate “SameSite=strict”.
By deactivating this option, the Oauth2's settings are done correctly.
Reactivating this option does not seem to interfere with refreshing the token.