OAuth 2 - sending back to login screen

cw_smith

Having a weird issue. Configured OAuth2 with Azure. After a successful login (with Azure), the client is passed back to the OSTicket portal with a token. The page the user lands on is the login page again asking them to login. I'm not seeing any errors. Does anybody know if i'm missing something here? The redirect URL is: https://helpdesk.domain.com/api/auth/oauth2

I checked and do not see any auth in the api folder so i'm not sure if I messed something up deploying this or not.

KevinTheJedi

cw_smith

Likely issue with App Registration, Plugin configuration, User Attribute Mappings, etc. We won't know until you provide screenshots or more information.

Cheers.

cw_smith

KevinTheJedi Thanks for the quick response!

See below - if you want to see something else let me know. The end result puts me back at the /scp/login.php

apache log:

OauthConfig:

Web Redirect in app

KevinTheJedi

cw_smith

The "/common/" Authorization/Token Endpoints definitely don't appear to be correct; they should have your Tenant ID instead. You will find those two endpoints within the Endpoints button at the top of the App Registration in Entra as described in the Microsoft OAuth2 Authentication (SSO) Guide below:

https://docs.osticket.com/en/latest/OAuth2/Microsoft%20Authentication%20(SSO)%20Guide.html

Cheers.

cw_smith

Apache logs:
172.30.3.57 - - [30/Sep/2024:14:03:51 -0400] "GET /scp/login.php?do=ext&bk=oauth2.agent.p2i3 HTTP/1.1" 302 1010 "https://helpdesk.domain.com/scp/login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0"

172.30.3.57 - - [30/Sep/2024:14:04:11 -0400] "-" 408 323 "-" "-"

172.30.3.57 - - [30/Sep/2024:14:04:16 -0400] "GET /api/auth/oauth2?code=0.AS4ANgDVHVobnUqDBxQLnGxUYtXQStNoZGZFhb6RPLecmy-5AAc.AgABBAIAAADW6jl31mB3T7ugrWTT8pFeAwDs_wUA9P-B9DNznQeGv-pSx87worO0Zmp_q7jOKlkFfpt2Eh8rd4b1VbG_BTeptQZ4chpicrS5rIQBhCjk86_th2Q_ysaYL3WXYcT8ZK1uCj8lvk9VIkoUM-rGldsCtZNm4xDvj-31MhmTx9xYmXvJ6NcH20vsFPf9YCmUQnbYJMz9v4AnijCYRMRXBhwX7CvAI3BTuNTpBDmD4F4ocK26SW3fWoIKEtu8U0daDRex13OLn7hnl2Bp3rbI--kwMzjnoYSxyGGR82T40yWRHgK8ikfukVDXT2P4AOJYRAcWmTUbPowEDY-rGxsxfEnl1q5TezcD_P8wRGylD0n9LxQaAos8xVnUfoDUUfZj8_lh2Kd15m8_y1m4W3gopNlE53IZWdxipQP5_hQJEnrpi-41s9Waf15cf5x8iFoTOxxOw8Q2_lhJC1E3MBTSPq4Bx0QCqFY1R584N-NeH3FP1ZuikfzEX-OOheKDA5HdtTFU37XAW5VtNfZuqfxCDBnI_ioM_cHCaPGMjuC1Xr6aB63eBWuD_C49zPYQWKSgTtBKHL_l-Y557BIVyqh2UywNXoWeTR9FfAWa-SeGcip8VJkxPyG2eAJxzPLtuWBjfVu0f1dsJxkBXY9jopoxRWrB_65BX6IH-8Pf9O7HYzz30COyjzvReQzz-sIsZQZ6ghP6_WHn5mNmAOB4Yl_t8PLkxURpKFIl3JoVxe-D5xH0_kkLteZpKqxzHswLYAzZCK7Mlt5NfoZSJuTDpPiK4ILUcT6chCa5VpJtn1i5elFoW6JSGZaXXApojgShlE5_mKuOu50m_5Zbi7O_yxxvOF4UELckv8kET3iq4NRG3EeyeogpaJTyTFocD7pDScAi2pJRau5p_09LGATFZgLtDPSqO2EwkYTOFtuEMoO4PCAeKXjalhIyz9SD2gtBTealSIB-BtHm063tom5gnzwr9bGQkdJKmSfuDgil7ShjeWiXoL3-c4RaCvs8dUBVk7vLp7XFOg&state=cd5ce450840b16aacfad464f6739cd3b&session_state=2102b67e-5d19-47cd-a655-d43c6b229769 HTTP/1.1" 302 734 "https://login.microsoftonline.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0"

172.30.3.57 - - [30/Sep/2024:14:04:16 -0400] "GET /scp/ HTTP/1.1" 302 725 "https://login.microsoftonline.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0"

172.30.3.57 - - [30/Sep/2024:14:04:16 -0400] "GET /scp/login.php HTTP/1.1" 200 3312 "https://login.microsoftonline.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0"

cw_smith

KevinTheJedi

I think it looks that way because I chose the "Multitenant and personal accounts". I removed the app and changed it to be single tenant with the same result. The updated endpoint URL's have the changed URL.

After trying, the log shows success but it keeps me locked to the login page.

KevinTheJedi

cw_smith

For the Client Secret did you make sure to use the "Value" and not the "Secret ID"?

For the Client ID did you use the "Application (client) ID" from the App Registration?

Have you tried changing the User Identifier ("userPrincipalName") attribute to "email" and retest?

Cheers.

cw_smith

KevinTheJedi

Yeah - i've made that mistake before. All data matches up correctly. I adjusted the user identifier to mail with the same results. The log says it was successfully logged in but never let's you into the system.

KevinTheJedi

cw_smith

Then could be an issue with the browser (cache/cookies), could be an issue with the session, could be browser extensions, etc. Have you checked all other logs (general server logs, webserver error logs, PHP error logs, MySQL/MariaDB error logs, osTicket System Logs, Browser Console logs, etc.) for any related errors?

Cheers.

cw_smith

KevinTheJedi Being told by OSTicket support that there is a known bug with OAuth2.0 that they are working on.

KevinTheJedi

cw_smith

Yea they meant Microsoft not us.

Cheers.