Azure OAuth2 Login Trouble

LawBulletinTim

Hi folks. I'm setting up OS Ticket on a fresh Windows VM running Server 2022. I have IIS 10, MySQL 8.0.39, and PHP 8.3.11 working and (hopefully) fully configured. I'm trying to set up the OAuth2 plugin for agent authentication against Azure. I have installed the URL Rewrite module for IIS, followed the OAuth2 setup instructions from here, and added the Curl certificate for PHP as described here, but when I authenticate using the Sign in with Azure link on the SCP agent login page I end up being dropped on the user page showing Guest User in the upper right.

Here's my dashboard information:

Here's my sanitized OAuth2 config:

Here's my sanitized Application ID in Azure:

And here's my sanitized Authorization and Token Endpoint info in Azure:

Please let me know if there's any more information needed. Any idea what I might have done wrong here?

KevinTheJedi

LawBulletinTim

PHP 8.3 is not yet supported. You will need to downgrade to PHP 8.2.
That all seems correct however are you sure you copied and used the Client Secret Value and not the Client Secret ID?
I see you are using IIS, do you have the URL Rewrite module installed and enabled (globally and/or for the osTicket site)?
Does the Agent exist in osTicket yet? If so, does their email address match what's in microsoft? If not, that's an issue and they will need to be created in osTicket first.

Cheers.

LawBulletinTim

Hi Kevin,

Thanks for the quick reply. I really appreciate the help. This morning I downgraded PHP as you indicated was necessary. Here's the updated dashboard:

I set up a new secret in Azure to ensure I had copied the secret value into the plugin's configuration:

I do have the URL Rewrite module installed for IIS and active on the OSTicket site:

And the agent was entered into OSTicket ahead of time:

Unfortunately, my installation still behaves incorrectly when I try to sign in using Azure for authentication and lands me on the Support Center page as Guest User. Is there anything else that needs addresses in my screenshots here, or anything else I should check on?

I'm not sure if this is relevant, but in Azure the domain portion of our UserPrincipalName does not match the domain on our email addresses (UPN would be username@domainA.com and email would be username@domainB.com). Would that be an issue?

Thanks,
_Tim

KevinTheJedi

LawBulletinTim

Yea they must match exactly.

Cheers.

KevinTheJedi

LawBulletinTim

You are using the UPN as the User Identifier in the plugin settings; so the UPN will need to match the email address for the Agent in osTicket.

Cheers.

LawBulletinTim

Okay, I'll see if there's another available attribute I can use for the User Identifier that will match mail. I tried setting mail for both but it didn't work.

LawBulletinTim

Unfortunately I have not been able to get OAuth2 working, which means no agent authentication off Azure and no tickets created from emails to a M365 mailbox. I'll have to move on to another product. Thanks for your help working on my troubles.

KevinTheJedi

LawBulletinTim

You're welcome! Fwiw, it's super easy to setup and we have thousands of clients using it daily. Something just must be specific with your setup. No worries though; to each their own.

Cheers.