jiggs

We actually should have a build of the OAuth2 plugin ready much sooner than that. We are wrapping up the changes for aliases, etc. now and looking at pushing the new build to the website’s download page next week. We don’t allow PHAR uploads on this Forum for security reasons; otherwise I would’ve had a build up this whole time.

Things to keep in mind if it’s not working:

  • Make sure the plugin folder and all files are fully extracted. If you’re using Windows switch the quotes around (single to double and vice versa) in the extraction command.
  • Check your include/ost-config.php file to make sure you are modifying the correct database.
  • As I’ve stated before in this thread there are multiple callback() functions in the plugin’s oauth2.php file so you need to replace the one for the OAuth2EmailAuthBackend backend specifically. Make sure you replace the entire function.
  • Make sure the database changes are saved properly by running SELECT queries afterwards.
  • Make sure that for each system email you login to osTicket in incognito window and when you are brought to Microsoft you login as the email itself. As stated earlier in this thread aliases, resource emails, and shared mailboxes WILL NOT WORK at this time until the new build is released.
  • Make sure you restart the web server and PHP-FPM (if you’re running it) to clear any file cache. PHAR files tend to be aggressively cached.

Cheers.

      Hi KevinTheJedi ,

      I had apply your patch 2 or 3 weeks ago, and oauth2 had working again.
      But today, the token expired and now I have the error message "invalid_client" ...
      I don't hunderstand why it suddundly happened ...
      Can you help us ?

      Tank you !

          !!! ATTENTION EVERYONE !!!

          A new build of the OAuth2 plugin with full support for all types of emails is now live on the downloads page.

          ** IMPORTANT NOTES: **

          • This requires you to apply a patch for the core codebase.
          • After installing the new build of plugin you should update all emails using OAuth2 just to be certain you are up-to-date.
          • If you are currently using the un-PHARed plugin make sure you update the database and set the install_path and isphar values back to their original values (ie. plugins/auth-oauth2.phar and 1 respectively).

          Follow the below steps to ensure you are up-to-date with the Microsoft changes:

          • Login to osTicket in incognito/private browsing window (repeat for each email to prevent authorizing the wrong account each time)
          • Click on a system email with OAuth2 configured
          • Click Config in Remote Mailbox tab
          • If using hared mailbox/resource email/alias email ensure the Strict Matching checkbox is disabled (unchecked) in the Info tab
          • Fully replace the Scopes value with offline_access https://outlook.office.com/IMAP.AccessAsUser.All https://outlook.office.com/POP.AccessAsUser.All https://outlook.office.com/SMTP.Send
          • Submit the popup
          • Login as the email itself -OR- if using shared mailbox/resource email/alias email sign in to the Service Account/User Account that has full Send As and Read and Manage permissions to the mailbox
          • Consent to the requested permissions
          • Once complete you should be redirected back to osTicket with a success banner. If however you are using a shared mailbox/resource email/alias email and you get an error about mismatching emails on the first submission, simply resubmit the popup and it should go through the second time.
          • Repeat these steps for the Outgoing SMTP tab if it has separate OAuth2 Authentication configured (ie. if SMTP Authentication is set to "OAuth2 - Microsoft")

          Once you have a new token you should be good to go. 🫡

          Just to note, a new set of releases for both 1.17.x and 1.18.x will be released soon that will contain the above core codebase patch.

            If we are using OSTICKET on a hosting provider i.e Krystal UK how do we apply the changes on the backend, before doing the GUI changes?

              martinleggott

              You would need to contact your hosting provider as each provider is different. Depends on if they have CPanel, or SSH, etc.

              Cheers.

                martinleggott

                But once you get access to your backend you can upload the new build of plugin to the include/plugins/ folder of your osTicket site overwriting the currently installed PHAR file. Then modify the needed core codebase files shown in the referenced pull request. You can modify the file with any editor you are comfortable with. If you aren’t comfortable doing so GitHub allows you to view and download the full files in the pull request. Go to the pull request, click Files Changed, click the three dots on the bar with the file name in it, click View File, click the three dots on the bar with Code/Blame, click Download (or press Ctrl + Shift + S), and upload the file to the matching location in your site folder overwriting the existing file. Repeat for each file in the pull request until you have replaced all the needed files. From there you should be good to go to follow the GUI steps.

                Cheers.

                  after Doing all steps , after authenticated the email , it return to ostickets home page , not the email configuration page

                    KevinTheJedi
                    Just to make sure I am understanding correctly
                    Downloading new OAuth2 plugin and installing then applying this? This requires you to apply a patch for the core codebase.
                    or before installing new OAuth2 plugin?

                        tamer229

                        That doesn’t really help much. Things can change, secrets can expire, etc. I would recommend going over the PHP changes you made to ensure you did them correctly. Then double check your plugin and app registration settings as shown in the docs. If you still have issues I’d recommend configuring a new app registration and reconfiguring the email in osTicket.

                        Cheers.

                          I've only had to upload the new th-oauth2.phar and then as soon as i re-apply the token it was successful and started pulling down emails again.?!

                            Thanks a million! Our helpdesk is back! Thanks Kevin and team, as well as community!