OAuth2 Authorization

Otto2

Hello, I am currently trying to get OAuth2 working for a MS365 GCCHigh mailbox, but I’m running into an issue. Whenever I click submit after entering in all the ldP configs I get prompted to login with a Microsoft account. I enter the correct email and password and then it redirects me to the OSTicket default webpage and does not prompt for consent and then when I navigate back to the email tab and select save changes it tells me I need to configure authentication. The config I entered is being saved but is not working. I have tried re-creating the app registration in Entra and I have tried using a user mailbox and shared mailbox. I did make sure to assign the correct API permissions and grant admin consent (I know that this is a commonly missed step). If anyone has some advice or troubleshooting tips it’d be greatly appreciated.

KevinTheJedi

Otto2

So GCCHigh is special - of course. The endpoints all end with .us instead of .com and the Resource Details Endpoint is https://outlook.office365.us/api/v2.0/me.

Cheers.

Otto2

KevinTheJedi Hey Kevin, Thanks for the quick reply! I have made sure that all of the URLs in the "Outlook Scopes field" are ending in.us. I have attached a screenshot for you to review.

KevinTheJedi

Otto2

I forgot we removed the Resource Details Endpoint option in the last update. Go to the database, go to the _config table, find the values for the plugin instance here, and update the Resource Details Endpoint from https://graph.microsoft.com/v1.0/me to https://outlook.office365.us/api/v2.0/me.

Cheers.

KevinTheJedi

Otto2

Or maybe it's https://graph.microsoft.us/v1.0/me. I would try both to see what works. I haven't messed with GCCHigh since they updated their API again so it may be this one instead of the O365 one; I'm just not sure.

Cheers.

KevinTheJedi

Otto2

Also, just fyi, a shared mailbox would require you to have a fully licensed user with full "Send As" and "Read and Manage" permissions for the shared mailbox. Then when prompted to login on the MS side you login as the fully licensed user and accept the permissions on behalf of the shared mailbox. This also requires you to uncheck the box for Strict Matching within the OAuth2 config popup on the email.

Cheers.

Otto2

KevinTheJedi Hey Kevin, Thanks for the info! I have gone through and updated ost_config table in the database

with the new URL. Unfortunately it is still behaving the same way when trying to submit the changes and authenticate. I have attached a couple screenshots for you to review as well.

KevinTheJedi

Otto2

Did you try the graph endpoint as I mentioned above? Also, not sure if the scopes need the .us but I think I remember that they do. I would test with and without to make sure. I don't have a GCCHigh to play with so unfortunately you're on your own here with the testing part.

Cheers.

Otto2

KevinTheJedi I didn't see the post mentioning using the graph endpoint with .us. I'm going to try that now and see how it goes. I have tried change the outlook scope address to .us and that didn't change anything. I'll let you know how using the original graph endpoint with .us goes. I really appreciate you helping with this!

Otto2

KevinTheJedi It looks like the URLs in the Outlook Scopes need to end in .com and not .us. I was able to successfully authenticate using both Resource details endpoints https://graph.microsoft.us/v1.0/me and https://outlook.office365.us/api/v2.0/me. Thanks for all you help with this!