MS OAuth2 Error: The API version 'V2' has been depreciated.

cmusicfan05

New update: Tried making an entirely new Application on Azure/MS Entra ID. Same error.

KevinTheJedi

I would first upgrade osTicket and the plugin. Then I would make a new app registration which you’ve already done and reconfigure the email.

Other than that it seemed to be a microsoft issue last time:

https://forum.osticket.com/d/104885-oauth2-error-this-api-version-has-been-deprecated

Cheers.

sachithmuhandiram

Our system was running without an issue and now authentication is not working with this error. Microsoft side configurations are fine as we been using it for like a year. What could go wrong>?

cmusicfan05

sachithmuhandiram Same. Almost 2 years of using OAuth this way with no issues, now it's broken.

@KevinTheJedi I upgraded to v1.18.1 and downloaded the latest oauth phar from the website....same issue.

sachithmuhandiram

@cmusicfan05 Then it seems Microsoft side issue, right? I had tried graph configurations. But it was also giving the same.

cmusicfan05

sachithmuhandiram When I look at the logs on the MS side, it shows that it's doing what it's supposed to, but I am not sure.

I went through the directions again, made a new application, gave it the permissions, tried logging in with my admin user (for Office365) and my standard user that I use for incoming/outgoing tickets (not a shared mailbox, we pay for a full user account) and got the same error as the old application.

I have 40+ user accounts on our 365 account so I tried adding other email accounts and received the same error. Also tried opening up every permission possible on the new application. It's 2AM EDT and tickets are piling up...and I don't have an answer for my staff or customers for tomorrow except "don't use it".

ben_werk

We have the same issue on v1.17.5 since last Sunday. We have also tried all the steps mentioned in the previous posts, but no luck. Tickets are piling up....

archercentauri

Have the same issue, I have one instance of 1.17.4 which was fine until Friday. Yet also have another instance of 1.17.4 working absolutely fine. Have recreated the secrets in Azure a number of times and it hasn't solved the issue at present. Little lost at this point.

jerer

The Outlook REST API (https://outlook.office.com/api/v2.0/me) has been deprecated for a really long time, and they have been progressively decommissioning those from tenants since March 31th this year.

The replacement for it is the Graph API (https://graph.microsoft.com/v1.0/me), but it cannot be used with the same access token that is used for Outlook IMAP/SMTP/POP. Wrote about it some time ago:
https://forum.osticket.com/d/96893-basic-authentication-retirement-for-legacy-protocols-in-exchange-online/101

This needs to be addressed by either creating a separate access token for Graph calls, or allowing us to skip that API call since its only used for strict email address matching (though completely disabling this from Microsoft provider is not ideal, since it's pretty easy to accidently authorize the wrong mailbox if you are logged on with it).

For now as a quick and dirty workaround I created a "mockup API"/site that returns the JSON:
{"EmailAddress": "mailbox email address here"}

sachithmuhandiram

jerer Hi
Can you please explain how you solved this issue?

This is my endpoints. Is there a change ?

jerer

sachithmuhandiram

Hi, this is just a dirty "hack" to bypass the "User details" API call. This is not a proper fix to this problem, but just something I did temporarily to get things going again. If you do this, make sure you are not logged in to any other mailbox. This bypasses the email address matching so you could accidentally start polling emails from the wrong mailbox. I recommend starting your browser in a new incognito mode just in case.

Create a ".json" file in your osticket folder (or somewhere else) with the content:{"EmailAddress": "set your mailbox email address here"}
Configure that in the "Resource details Endpoint", e.g. https://<your-osticket-host.com>/something.json
(Technically we could use any URL here that returns JSON data, but because the access token is sent to that URL don't use any public ones for security reasons)
Keep the scopes as offline_access https://outlook.office.com/IMAP.AccessAsUser.All https://outlook.office.com/POP.AccessAsUser.All https://outlook.office.com/SMTP.Send
Keep the "Email address attribute" as "EmailAddress".

If you are using multiple mailboxes, I guess you will have to uncheck email address "Strict matching" (again, make sure to logout other mailboxes first). Or you could use multiple json files/php script to handle that.

ben_werk

jerer
Thank you so much! This got it up an running again! 😃
Is there a permanent fix planned? How is everyone else not having this issue?

KevinTheJedi

jerer

Yea we are not updating for Graph API until absolutely required because it will require us to completely rework fetching all over again and move it to API calls. This is planned for v2.0 but not for legacy. We have thousands of customers using this with no issues. Simple seems like a Microsoft issue as earlier in the thread it started working again with no changes from our side.

Cheers.

cmusicfan05

jerer

Confirmed that this works. Sucks to have to use a workaround, hopefully MS will fix something and it'll go back to working the right way at some point...

sachithmuhandiram

jerer This worked.. Support portal is back to normal. Hope OS ticket team will officially attend to this issue and fix. As this is a workaround.

ElbowNi

jerer I have created the JSON file an placed it in the SCP directory of my OSTicket server but after I submit the ldP request I get a "Connection refused for URI https://myOSTicketURL/scp/mail.json"

Any thoughts/suggestions?

wb77

jerer Thanks a lot. That works for us.

f07pd

jerer hi, i modified the url and create the file j.son, but noew i have this error in authentication cURL error 60: SSL certificate problem: self-signed certificate (see https://curl.haxx.se/libcurl/c/libcurl-errors.html) Can you help me?

jerer

ben_werk
Not everyone is having this issue (yet) because:

Microsoft has been decommissioning the Outlook v2 API progressively, not from all organizations at once
The API is called only when you configure the OAuth, so valid refresh tokens will continue to work

But for example when the client secret expires (which is max 2 years) and it needs to be updated, people will be faced with this issue.

KevinTheJedi

jerer

That’s not what happened in the referenced thread last time. If they truly decommissioned it then those people would still be broken but it started working again once Microsoft fixed the issue on their end.

Cheers.

jerer

KevinTheJedi
Please refer to this: https://techcommunity.microsoft.com/t5/exchange-team-blog/final-reminder-outlook-rest-api-v2-0-and-beta-endpoints/ba-p/4058396

KevinTheJedi

jerer

I don’t believe they would kill IMAP/POP like that. Graph only supports API calls as far as I’m aware and outlook supports IMAP/POP protocols.

Cheers.

jerer

KevinTheJedi
They are not killing Outlook IMAP/SMTP/POP, just the REST APIs.

KevinTheJedi

jerer

Go ahead and try to get a graph token from graph then and use it for the imap endpoint. It simply won’t work which is why we used outlook in the first place.

Cheers.

jerer

KevinTheJedi
I know, please read https://forum.osticket.com/d/105728-ms-oauth2-error-the-api-version-v2-has-been-depreciated/10

https://forum.osticket.com/d/96893-basic-authentication-retirement-for-legacy-protocols-in-exchange-online/101

redrubicon

KevinTheJedi Any guidance or resources I can look into on how to do this? Referring to the instruction to get a graph token from graph and then use it for the imap endpoint.

KevinTheJedi

jerer

Maybe it’s too early and I’m not understanding you. The problem isn’t getting a graph token the problem is using the token to authenticate to IMAP/POP protocols (the only IMAP resource I know is outlook.office365.com:933 - don’t see a graph resource for this). When you authenticate using graph token it fails. Our code only supports fetching via IMAP/POP protocols we do not support fetching from retrieving mail via api calls. From all that I’ve read online graph tokens are solely used for graph api endpoints. Graph API endpoints require calling a API endpoint to retrieve mail; completely different than IMAP/POP protocols. IMAP is a protocol to fetch mail not an API endpoint. So my point is that the graph tokens are meant for graph api and graph api is only good for API calls and that essentially kills IMAP/POP which I doubt they are doing.

Cheers.

KevinTheJedi

jerer

Also, in the article you referenced directly from microsoft the recommended answer says exactly what we are already doing:

https://learn.microsoft.com/en-us/answers/questions/700838/getuserinfo-rest-api-response-with-401-by-using-sc

Which is calling the v2 endpoint.

Cheers.