oAuth / Shared Mailbox issue - cannot select INBOX, is this a valid transport?

swinfield

Hello all,
I'm currently trying to setup a shared mailbox using Microsoft oAuth. I'm receiving the infamous "cannot select INBOX, is this a valid transport".

System details:
osTicket Version v1.18.2 (53339df)
Web Server Software Apache/2.4.57 (Oracle Linux Server)
MySQL Version 10.5.22
PHP Version 8.2.28

We followed all the instructions in the Microsoft guide (from other's threads/posts, We've verified that IMAP is open and we are able to successfully get a token. (We also tried with a single user mailbox and received the same error.)

Is there anything else I can try to get this working?

KevinTheJedi

swinfield

Typically means a firewall issue, or the port is blocked, or IMAP is disabled on the o365 side (via a policy or direct user permissions), etc. It's always a good idea to attempt a connection to the host and port via the server's CLI so you can eliminate it being an issue on the network/security end. The error also could mean you didn't allow IMAP in the app registration or in the Scopes.

Now, since you are using a shared mailbox you must use a service account (or even a normal user account) that has full "Send As" and "Read and Manage" permissions for the shared mailbox (within o365). Shared mailboxes aren't licensed users ergo you can't login like a normal user (you can but you shouldn't as I heard you'll void terms, etc.). So you must use an account that's licensed to login and authorize the permissions on behalf of the shared mailbox. Keep in mind the first step is to uncheck (disable) the "Strict Matching" checkbox within the Authentication configuration popup so you can login as a user other than the shared mailbox. You may get an error the first save about a mismatch but simply repeat the steps and it should work the second time.

Cheers.

swinfield

KevinTheJedi Thanks for the quick reply. We've verified it's not firewall/blocked port. Verified IMAP is enabled on o365. I verified via CLI the IMAP connection iMAP is allowed in registration and scopes.

I tried two mailboxes... first the shared mailbox, and verified the user logging in has full Send As and Read and Manage permissions...strict matching off . Then, I tried using a licensed user mailbox (by setting up a new mailbox in osTicket) and received the same error (strict matching on). In both cases I was able to get a token successfully, but unable to fetch the INBOX...

Are there any other options?
For the token and authorize links, we have https://login.microsoftonline.com/<masked: xxxxxxxxx>/oauth2/v2.0/token and https://login.microsoftonline.com/<masked: xxxxxxxxx>/oauth2/v2.0/authorize

KevinTheJedi

swinfield

Those seem correct. At this point it sounds like an app registration issue, microsoft issue, or some sort of hosting/server issue.

Cheers.