OAuth2 with Entra ID only works on first login

Ingo

Hi,

i just setup a new instance of osTicket and configured OAuth2 with Entra ID, unfortunately only the first login works and i dont know what is wrong.

What's happening?
When a user tries to log in using the Oauth2 Client plugin for the first time, they're successfully logged in - they can access the user pages and log tickets.

When the user logs out of osTicket, they cannot log in with the OAuth2 Client again. Authentication takes place - I can see successful entries in the Microsoft Entra sign in logs - but users are returned to the client home page and are not logged in. If i delete the User he can again log in with OAuth2 once.

What can i do to fix this issue ?

System Info (Ubuntu 24.04.3 LTS):
osTicket-Version v1.18.2 (53339df)
Server-Software Apache/2.4.58 (Ubuntu)
MySQL-Version 10.11.13
PHP-Version 8.3.6

Active plugins
Oauth2 Client, version: 0.6

KevinTheJedi

Ingo

Have you tried this?

https://forum.osticket.com/d/107272-authentication-required-error/2

Cheers.

Ingo

Hi,

there is no issue with idle session/cache/cookies. When u simply log out and back in it wont work. I tried in seperate private browser session to make sure there is nothing stored. When i delete the user he can login again, no need to delete session/cache/cookies.

KevinTheJedi

Ingo

Deleting the user is too much; simply try deleting all cache/cookies/sessions, force/hard refresh the browser, and retest. If that works then you'll need to apply the patch above.

If not then it doesn't really make much sense. Since this is not a wide-spread issue and it's seemingly only happening to you, you'll just have to go through the authentication process and dump a bunch of stuff to see where the disconnect is.

Cheers.

mpev

What about this?
https://forum.osticket.com/d/105809-user-login-returns-to-the-login-page

KevinTheJedi

mpev

That could potentially help.

Cheers.

Ingo

I added the sleep(2) to both index.php and ticket.php but the issue is still the same.

This is how it looks like after the user succesfully authenticates to Entra ID:
I deleted all cached files multiple time, the only way i found to make it work again is deleting the user. The first login for a fresh user looks like this:
In Etra-ID all logins are successfull even those where the user is not loged in after redirection to osTicket:

KevinTheJedi

Ingo

Hmmm...post a screenshot of Admin Panel > Dashboard > Information for me.

Cheers.

Ingo

KevinTheJedi

Ingo

Did you ever apply the session patch I linked, restart your webserver and PHP-FPM, clear all cache/cookies/sessions, hard reload the browser, and retest?

Cheers.

Ingo

Are you refering to your first post ?

Have you tried this?

https://forum.osticket.com/d/107272-authentication-required-error/2
Cheers.

The post leads to a post where u say asked and answere multiple times. I dont see any reference to a session patch in there.
I restartet the webserver multiple times and cleared all cache/cockies/session i could find.

KevinTheJedi

Ingo

Click the referenced link within the referenced post. So in this comment I linked this, and so on and so forth until you get to the actual patch file.

Cheers.

Ingo

Just to make sure: This is how the class.ostsession.php looks like. That is the patched version right ? I have not changed anything on my own.

KevinTheJedi

Ingo

...if you read my comments through the links you are clicking you will see that I said REVERT that patch. So you are currently using the patched version but you need to REVERT that patch.

Cheers.

Ingo

Sorry, it was a bit confusing becaus u askes if I applied the session patch.
I reverted the change, rebootet and cleared cache but the issue is still the same.

KevinTheJedi

Ingo

Hmm, then I'm not really sure. You'll have to go through the whole authentication process in the code and add debug statements in the pipeline to see where it's failing. You can also check the database to see if there are any duplicate records, etc.

Cheers.