osTicket 1.18.2 oAuth2 against Cisco Duo

TheExpert

Hi all,

I have an issue with osTicket 1.18.2 and oAuth2 against Cisco Duo. When logging in the login formular of Cisco Duo is opened. I can successfully log in but then I'm redirected back to login page for the staff or sometimes to start page for the customers.

osTicket 1.18.2 is running on Windows Server 2022 with IIS 10 and PHP 8.2.27. osTicket has its own site so it isn't a subfolder of the defualt website of IIS.

I have also a test environment with XAMPP on the same server and here the Oauth2 authentication and redirection works fine. osTicket is on a subfolder of the default website.

I can log in to osTicket 1.18.2 by LDAPs without issues and anything else of osTicket is running fine.

Thank you.

KevinTheJedi

TheExpert

You need to check to see if IIS has the appropriate rewrite rules setup for the site. You can go to the URL Rewrite module in IIS Manager for the specific site (click the site in the sidebar under Sites) and you should see the rules pre-populated. If not then that's an issue that you need to work out. osTicket ships with the needed files (web.config files in various places) you just need to ensure the module is enabled in IIS and it picks up the files correctly.

Another thing to check is the actual Redirect URI. Make sure what you are using in the browser to access osTicket matches the root of the Redirect URI (eg. if redirect uri is http://localhost/api/oauth2 then you need to access osTicket in your browser via http://localhost). Also make sure the Redirect URI is the same in both the OAuth2 configuration within osTicket and within the cisco configurations. I've never used cisco before but I'm sure it's relatively the same as other providers. Plus, you have it working in another setup so I'm not really sure what's going on in your non-working instance. I would simply compare the configurations in the working instance and the non-working instance.

Cheers.

TheExpert

KevinTheJedi

This issue isn't related to the rewrite rules. The rules are the ones you provide in the web.config.

After more research I found a hint regarding cURL and the certificate which has to be placed in PHP, see https://forum.osticket.com/d/103590-oauth2-for-sso and https://martinsblog.dk/windows-iis-with-php-curl-60-ssl-certificate-problem-unable-to-get-local-issuer-certificate/.

After doing this the Oauth2 login seems to work.

When using XAMPP this is already done and that's why it's working with XAMPP without any further configuration.