OAuth with Microsoft

calgia

Good Day togehter!

I'm having a OSTicket on a Webserver hosted by Swiss Hoster "Hostpoint".
I tried to implement Microsoft 365 Authentication, but it won't work.

What make i wrong? Where is the bug?

First of all i have the following OSTicket Informations:

I installed the plugin and configured it properly (followed the docs from osticket)

If i then test it with a Microsoft 365 account from the tenant (example@domain.com) it won't work. It's showing me the following error:


My .htaccess looks like the following:
<IfModule mod_rewrite.c>
RewriteEngine On

# Exclude existing files and directories from rewrite
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_URI} (.*/api)

# Rewrite URLs that match the /api pattern
RewriteRule ^api/(.*)$ http.php/$1 [R,L]

</IfModule>

Based on a talk with KI / AI i got the follow solution for checking about url rewriting:

2. Überprüfung durch ein kleines Skript
Du kannst ein kleines PHP-Skript in deinem Webserver-Dokumentenstamm erstellen, das speziell für das Testen von URL-Rewriting formuliert ist. Lade eine Datei mit folgendem Inhalt hoch:

Erstelle eine Datei test_rewrite.php:
<?php
if (isset($_GET['rewritetest'])) {
    echo "URL rewriting is enabled.";
} else {
    echo "URL rewriting is not enabled.";
}
?>


Erstelle eine URL-Rewriting-Regel in deiner .htaccess-Datei:
RewriteEngine On
RewriteRule ^test-rewrite$ test_rewrite.php?rewritetest=1 [L]

Versuche dann, im Browser die URL http://yourdomain.com/test-rewrite aufzurufen. Wenn URL-Rewriting korrekt konfiguriert ist, sollte die Nachricht "URL rewriting is enabled." angezeigt werden.

I'm with my knowledge at the end.
Can anyone assist me solving my problem?

Greetings,
calgia

KevinTheJedi

calgia

You do not have the URL rewrite module installed and enabled for the site. Please reach out to your hosting provider for further assistance.

Cheers.

calgia

but i think the postet php script for testing this is working, so why should this not be enabled?

KevinTheJedi

calgia

The URL Not Found error typically means either the Redirect URI is not correct (unlikely as it's auto-generated based on your Helpdesk URL setting - if that is incorrect then your Redirect URI would be incorrect as well) or you do not have the URL Rewrite module installed an enabled for the site. You could also be having PHP cURL issues however you would see that from the PHP error logs and/or webserver error logs.

Typically people have the module installed just not enabled/allowed for the site. Typically you need to add AllowOverride All to your Directory block within the site config. You can look at guides online on how to enable and allow the URL Rewrite module for individual sites on Apache.

Cheers.

calgia

Thank You!

If the UPN in 365 is diffrent from mail, is this some problem?

upn=doej@domain.com
mail = john.doe@domain.com

KevinTheJedi

calgia

No, this is a webserver error telling you that the URL/path you are attempting to access (ie. the Redirect URI) doesn't exist. This means your webserver is not allowing the URL rewrites that we ship with in the various .htaccess files. To fix the "Not Found" error you simply need to update your Apache site config to allow the rewrite as I've explained above (ie. AllowOverride All). If you've done this and still get the same error then you should check your PHP error logs and/or webserver error logs for any related errors such as cURL errors, etc.

Cheers.

calgia

Hello Kevin

Got some answer from my Hoster.

Good Day
Thank you for your Request.
mod_rewrite is definitly active at our side.
A small mistake we fount at the Ticket.
RewriteRule ^api/(.)$ http.php /$1 {R,L}
--> here's missing a slash. Correct is
RewriteRule ^api/(.)$ /http.php /$1 {R,L}
Tell me, if it after still not working.
For more questions or issues we here to help.
Kind Regards
B. L.

I was able by removing "api/" to get customer access over Microsoft 365.

<IfModule mod_rewrite.c>

RewriteEngine On

RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_URI} (.*/api)

# RewriteRule ^(.*)$ %1/http.php/$1 [L]
# RewriteRule ^api/(.*)$ http.php/$1 [R,L]
# RewriteRule ^api/(.*)$ /http.php/$1 [R,L]
RewriteRule ^(.*)$ %1/http.php/$1 [R,L]
</IfModule>

If i try to log in to the Staff panel it give me the error
Have your administrator create a local account (username@domain.net)

My Company uses as UserPrincipalName UPN something diffrend than the Primary E-Mail-Adress.
The UserPrincipalName (UPN) is set to as example "doej@domain.net".
The Primary E-Mail-Adress is set to as example "john.doe@domain.com".

Have i somewhere the ability to choose what the Username is because i'm only able to change the user's E-Mail.

Greetings,
calgia

KevinTheJedi

calgia

Change the username/email attributes in the plugin config to get different values. Otherwise username is in the profile for users and agents.

And idk why they say there is a mistake in the .htaccess when no one else but like 3 people in the past have had this issue. I guess some servers are very picky.

Cheers.

calgia

Hi Kevin

Thank You for your response.
I'll would be able to see it for myself, if i really would open my eyes and search 😃

Now it's working by changing the User Identifyer from "userPrincipalName" to "mail".

Thanks for your help!

Greetings,
calgia