Also having the same issue. Our Token expired yesterday, and we are unable to refresh. Verified all the endpoints, secrets, etc. are correct.

@jerer

I really recommend you try this yourself. You can uncheck Strict Matching if it's not letting you get passed that part. But once you get a token with the user endpoint set to graph you can't authenticate to IMAP/POP3. If i'm missing something please let me know.

Cheers.

redrubicon

For now try the following until ms fixes their issue:

• https://forum.osticket.com/d/105728-ms-oauth2-error-the-api-version-v2-has-been-depreciated/12

Cheers.

KevinTheJedi
I understand that Outlook IMAP/SMTP/POP does not work if any Graph scopes are used. That's why you have been using the Outlook REST API.

And now that the Outlook REST API has been deprecated (for many years) and decommissioning has begun, we can't use that anymore. The replacement for that is the Graph API, but I do understand we cannot use that either with the same access token we use Outlook IMAP/SMTP/POP.

The only solution to this problem is to create 2 access tokens, one scoped for Graph and one scoped for Outlook IMAP/SMTP/POP. Or give us an option to skip that API call completely.

That's what I have been trying to point out (since 2 years ago). I know dealing with these Microsoft things must be annoying, but it is what it is.

Hola,
OSticket ya no funciona mas con O365?

@jerer

I just did a test to remove the call to the user endpoint and it gets a token but still same authentication failed message when attempting to authenticate to IMAP and SMTP. So this definitely appears to be an issue on their end as I can't even auth using a token I'm given.

Cheers.

KevinTheJedi
Yeah I can agree this is at least horrible design by Microsoft. The thing is, it has been like this for years and I don't see them fixing it :/

https://stackoverflow.com/questions/61597263/office-365-xoauth2-for-imap-and-smtp-authentication-fails/61678485#61678485

https://techcommunity.microsoft.com/t5/exchange/cannot-connect-to-imap-and-smtp-using-oauth2-0-to-exchange/m-p/1359651

This is not the only thing we have been struggling with since the introduction of Graph and things being deprecated by it.

@jerer

To test this yourself you can unpack the plugin (cd to the plugin directory and run php -r '$phar = new Phar("auth-oauth2.phar"); $phar->extractTo("./auth-oauth2");'), edit the auth-oauth2/oauth2.php file, and update the callback() method for class OAuth2EmailAuthBackend to the following:

    public function callback($resp, $ref=null) {
        $errors = [];
        $err = sprintf('%s_auth_bk', $this->account->getType());
        try {
            // MOD
            //if ($this->getState() == $resp['state']
            //        && ($token=$this->getAccessToken($resp['code']))
            //        && ($owner=$this->client->getResourceOwner($token))
            //        && ($attrs=$this->mapAttributes($owner->toArray()))) {
            if ($this->getState() == $resp['state']
                    && ($token=$this->getAccessToken($resp['code']))) {
                $this->resetState();
                $info =  [
                    'access_token' => $token->getToken(),
                    'refresh_token' => $token->getRefreshToken(),
                    'expires' => $token->getExpires(),
                    'resource_owner_id' => $token->getResourceOwnerId(),
                    //'resource_owner_email' => $attrs['email'],
                    'resource_owner_email' => $this->getEmailAddress(),
                ];
/*
                if (!isset($attrs['email']))
                    $errors[$err] = $this->error_msg(self::ERR_EMAIL_ATTR, $attrs);
                elseif (!$info['refresh_token'])
                    $errors[$err] = $this->error_msg(self::ERR_REFRESH_TOKEN);
                elseif (!$this->signIn($attrs)) {
                    // On strict mode email mismatch is an error, otherwise
                    // set email address being authorized as the resource
                    // owner - with the assumption that a global admin
                    // authorized the account.
                    if ($this->isStrict())
                        $errors[$err] = $this->error_msg(self::ERR_EMAIL_MISMATCH, $attrs);
                    else
                        $info['resource_owner_email'] = $this->getEmailAddress();
                }
*/
                if (!$info['refresh_token'])
                    $errors[$err] = $this->error_msg(self::ERR_REFRESH_TOKEN);
                // END

                // Update the credentials if no validation errors
                if (!$errors
                        && !$this->updateCredentials($info, $errors)
                        && !isset($errors[$err]))
                     $errors[$err] = $this->error_msg(self::ERR_UNKNOWN);
            }
        } catch (Exception $ex) {
            $errors[$err] =  $ex->getMessage();
        }

        // stash the results before redirecting
        $email = $this->getEmail();
        // TODO: check if email implements StashableTrait
        if ($errors)
            $email->stash('errors', $errors);
        else
            $email->stash('notice', sprintf('%s: %s',
                        $this->account->getType(),
                        __('OAuth2 Authorization Successful')
                        ));
        // redirect back to email page
        $this->onSignIn();
    }

Then login to the database, go to the _plugin table, modify your OAuth2 plugin record, set the install_path to plugins/auth-oauth2 (just remove the .phar), and set isphar to 0. Now the system will use the unpacked plugin with the custom changes.

With the above changes applied the system will skip the user endpoint altogether during token retrieval. You will then get a token successfully (as previously) but then when you try to authenticate using that token you are given it doesn't work (go figure).

Cheers.

KevinTheJedi
This is weird, things work fine for me at the moment (after removing the call to the user endpoing API). Did you forget some other scopes there? (like openid, User.Read, etc.).

Can only use offline_access and https://outlook.office.com/XXXXXX scopes or IMAP/SMTP/POP authentication fails.

jerer

That's exactly what I used offline_access https://outlook.office.com/IMAP.AccessAsUser.All https://outlook.office.com/SMTP.Send.

Cheers.

!!! ANNOUNCEMENT !!!

Everyone still experiencing this issue:
Please retest after following these instructions to see if it starts working again:

• https://forum.osticket.com/d/105728-ms-oauth2-error-the-api-version-v2-has-been-depreciated/41

Once I get enough confirmations that the changes work I'll make the changes official.

KevinTheJedi
Although I already bypassed it the other way, I still would like to confirm I tested this modification and it works. Thanks for looking into this!

I've modified the plugin... What other settings should we use for the Auth, Token and Scopes?