gkowalski Where did you enable this? If it is the .htaccess which one or what directory does it go in? On the 365 side, which settings are needed? It would be helpful for some kind of documentation to be put together for how to do this, or if I can figure it out I would be happy to toss something together with a step-by-step.

Mitchell-GMIC

Are you trying to setup a personal email address or a business account one with a custom domain tenant? After fighting with MS for almost a month they finally told me that they do not allow OAuth2 support with personal emails unless you setup a custom domain and a new tenant reflecting that.

Cheers.

rjkunde I'm getting the same error also with IIS. I have the URL Rewrite module installed but no rules.

@ntozier

Any thoughts here? I know normal API requests work on IIS so any reason why new API urls (using same base url) wouldn't work?

Cheers.

I'm a new user to osTicket and huge thank you to those supporting it. I am having an error when trying to get a token with oauth2 plugin. I go through setting up the app registration in azure, copied the application id, registration token, granted permissions for the graph api's in KevinTheJedi's instructions (followed them to a T). The error i'm getting is "No input file specified" when requesting a token. I have apache2, rewrite engine on, allowoverride all etc. I am running the latest 17RC4 with the newest plugin for oath2. I even added the directives for rewrite engine on and allowoverride all in the global config. If you have any ideas please help - I've searched all over for fixes and have been working on it for quite a while.

jiggs
These settings have worked for me, if you still have an issue, you should open your own thread and post your server setup details

email Address Attribute part, you have different, based on your AD settings

Client Id: *
IdP Client / Application Identifier

Client Secret:
IdP Client Secret

Scopes: *
Comma or Space separated scopes depending on IdP requirements
offline_access https://outlook.office.com/IMAP.AccessAsUser.All https://outlook.office.com/POP.AccessAsUser.All https://outlook.office.com/SMTP.Send

Authorization Endpoint: *
Authorization URL
https://login.microsoftonline.com/common/oauth2/v2.0/authorize

Token Endpoint: *
Access Token URL
https://login.microsoftonline.com/common/oauth2/v2.0/token

Resource Details Endpoint: *
User Details URL
https://outlook.office.com/api/v2.0/me

Email Address Attribute: *
Please consult your provider docs for the correct attribute to use
emailAddress

Callback Endpoint: *
Redirect Uri
https://YourSupportTicketAddress.com/api/auth/oauth2

jiggs

You definitely don’t have URL Rewriting enabled properly. Please review Apache documentation on how to enable URL Rewriting. Once you make the change you must restart Apache.

Cheers.

@JeffAv No luck on my end yet. I'm going to try what @KevinTheJedi said and manually create the rules present in \osticket\api as rules in IIS. Please do let me know if you find a way around this.

rjkunde
Compare the default web.config file with your web.config file and ensure you have the following section in it under the <system.webServer> section

    <rewrite>
        <rules>
            <rule name="HTTP api" stopProcessing="true">
                <match url="^(.*/)?api/(.*)$" ignoreCase="true"/>
                <conditions>
                    <add input="{REQUEST_FILENAME}" matchType="IsFile"
                        ignoreCase="false" negate="true" />
                    <add input="{REQUEST_FILENAME}" matchType="IsDirectory"
                        ignoreCase="false" negate="true" />
                </conditions>
                <action type="Rewrite" url="{R:1}api/http.php/{R:2}"/>
            </rule>
            <rule name="Site pages" stopProcessing="true">
                <match url="^(.*/)?pages/(.*)$" ignoreCase="true"/>
                <conditions>
                    <add input="{REQUEST_FILENAME}" matchType="IsFile"
                        ignoreCase="false" negate="true" />
                    <add input="{REQUEST_FILENAME}" matchType="IsDirectory"
                        ignoreCase="false" negate="true" />
                </conditions>
                <action type="Rewrite" url="{R:1}pages/index.php/{R:2}"/>
            </rule>
            <rule name="Staff applications" stopProcessing="true">
                <match url="^(.*/)?scp/apps/(.*)$" ignoreCase="true"/>
                <conditions>
                    <add input="{REQUEST_FILENAME}" matchType="IsFile"
                        ignoreCase="false" negate="true" />
                    <add input="{REQUEST_FILENAME}" matchType="IsDirectory"
                        ignoreCase="false" negate="true" />
                </conditions>
                <action type="Rewrite" url="{R:1}scp/apps/dispatcher.php/{R:2}"/>
            </rule>
        </rules>
    </rewrite>

Hope that helps you.

rjkunde

You are having certificate issues (maybe self-signed cert or something). You need to follow the link in the error and look for possible resolutions.

Cheers.

The server has a valid Let's Encrypt cert. Verified w/ multiple browsers. Unclear why this error is happening. The links are to the libcurl docs, which state: The remote server's SSL certificate or SSH fingerprint was deemed not OK.

If I find anything I'll post more info.

Looks potentially related to not sending intermediate certs. Not sure if I have to set certificate paths in PHP, I thought ACME/Let's Encrypt handled it. Still looking.

Rebooted server, no change: invalid_client
Versions:
osTicket (v1.17-rc4)
Oauth2 Client 0.3
PHP 8.1.10
Windows Server 2019 Standard
IIS 10.0.17763.1

Not sure on phar or not, I didn't actually install the plugin, someone else did. I can confirm though.

rjkunde

You can follow this guide to make sure you did everything correctly:

• https://github.com/osTicket/docs/blob/3b6b623c026c15bb267e404a4afd72b19d29f035/OAuth2/Microsoft%20Authorization%20Guide.rst

Cheers.

Ah, the plugin is now on v0.6
Please update it and test again.

Thanks @mbanyard and @KevinTheJedi I'll try updating the client this afternoon and see what happens.