MS OAuth2 Error: The API version 'V2' has been depreciated.: Page 8

MS OAuth2 Error: The API version 'V2' has been depreciated.

mrudella

PHP 8.0.27
MySQL 8.0.15
osTicket 1.17.5
Oauth Plugin 0.6
Windows Server 2022

I've been using OAuth2 and just ran into this issue. I've followed the steps to unpack the auth-oauth2.phar file and edit the database. Everything there matches what @KevinTheJedi wrote here (https://forum.osticket.com/d/105728-ms-oauth2-error-the-api-version-v2-has-been-depreciated/41). OAuth2 authorization is successful, but I'm getting the 5.7.3 Authentication unsuccessful on the outgoing (SMTP).

In addition, these are full mailboxes, not shared. Authenticated SMTP (and all other protocols) is enabled on the user's mailboxes.

KevinTheJedi

mrudella

Check if the API Permission is added and admin consented in the app registration. Make sure the user has Authenticated SMTP enabled in O365. Also make sure the user doesn’t have a policy attached that restricts/blocks SMTP.

Cheers.

mrudella

KevinTheJedi
Thanks for the reply. I've verified the API permissions and Authenticated SMTP. No policies in effect that would restrict/block SMTP.

KevinTheJedi

mrudella

Is it a real email or shared mailbox/alias/resource email?

Cheers.

mrudella

KevinTheJedi These are real/full user mailboxes.

KevinTheJedi

mrudella

Are you logging in as the mailbox you are setting up each time?

Cheers.

mrudella

KevinTheJedi
Yes, I am. The enterprise app and app registration is shared among all of the email accounts within osticket, but I am using an incognito window and authenticating with each unique user/mailbox login. Also, if it matters, I’m using the tenant-created accounts with onmicrosoft.com logins/addresses. It’s been setup that way since changing over to OAuth.

KevinTheJedi

mrudella

Then you should be fine. Maybe disable SMTP, reenable it, and retest for each account?

Cheers.

mrudella

KevinTheJedi

Thanks for confirming. I have disabled and enabled Authenticated SMTP for these accounts and will be testing in a few hours.

mrudella

KevinTheJedi

I created a ticket with Office 365 support and they recommended a test via powershell:

  Let's first turn off MFA, Conditional Access Policies, Security Default.
 
  Then you could run PowerShell commands below to narrow down done if the issue occurs within our side. If the PowerShell command can send successfully, then the issue occurs within just the app scope but not from our side.
 
  $cred = get-credential
  Send-MailMessage -To "user@domain.com" -from "user@domain.com" -Subject 'Test message' -smtpserver smtp.office365.com -usessl -Credential $cred -Port 587

The results of that test email were successful and I received it from one of the accounts that is used by OSTicket.

symoss

We also have this problem with SMTP.

The "hack" worked OK for the accounts we use to only receive email, but the account we use to send cannot authenticate:

This is not a new account, used to work fine up until yesterday.

neilmcdowell

symoss
Did you find a solution to this? I'm getting the same error.

KevinTheJedi

mrudella

Then I am unsure. It’s working for everyone else so it’s a config issue somewhere in your end.

Cheers.

KevinTheJedi

symoss mrudella

The only thing I can recommend at this point is to maybe create a brand new App Registration in Entra and following the osTicket OAuth2 documentation exactly as it states. Also, you should now be using the Scopes of offline_access https://outlook.office.com/IMAP.AccessAsUser.All https://outlook.office.com/POP.AccessAsUser.All https://outlook.office.com/SMTP.Send.

As long as you modify the plugin as stated above, use the correct Scopes, and authenticate as the correct user you should have no issues. I just retested with my O365 personal email and it's working as intended for both IMAP and SMTP using these instructions.

Cheers.

symoss

KevinTheJedi As I said it's not working for us either, so it's definitely not working for "everyone else". Has anyone else confirmed specifically that SMTP works for them?

KevinTheJedi

symoss

Of course, read above.

Cheers.

jens_E

@symoss how long do you use this account?
Maybe your certificate is outdated. You can check your client secret. It will expire all two years.

KevinTheJedi

jens_E

I don't think that's it otherwise the token wouldn't have worked for Remote Mailbox tab.

Cheers.

deanmachine1969

KevinTheJedi Many thanks, working perfectly ... after I butchered the PHP file.

bbertling

KevinTheJedi
i got the plugin edited, i cant seem to figure out how to manipulate our database. i was able to login to mariadb, i got to the database, and tablet contents, but im strugging to put together the right update command to change the install path and the 1 to 0. can you provide any help on this? also, im using Government 365 if that matters.

KevinTheJedi

bbertling

Ahhh then you have completely different endpoints and everything. All endpoints for O365 government end in .us instead of .com. Furthermore SMTP is typically disabled for Government tenants and you typically use a relay for that.

As for the SQL, you should use a GUI tool instead if you don’t know how to run/write SQL statements as you can mess up quite a bit. I would recommend HeidiSQL for windows and Sequel Ace for Mac.

If you require a manual query you would just simply run:

UPDATE %TABLE_PREFIX%plugin SET `install_path` = 'plugins/auth-oauth2', `isphar` = 0 WHERE `id` = %PLUGIN_ID%;

Replace %TABLE_PREFIX% and %PLUGIN_ID% with their respective values.

Cheers.

bbertling

KevinTheJedi
ok, so do i stop what im doing and make a relay connection? or can i continue to follow your instructions with HeidiSQL to get a solution? or am i the Guinea Pig to see if it works on the gov side?

« Previous Page Next Page »