Basic Authentication Retirement for legacy protocols in Exchange Online: Page 12

Basic Authentication Retirement for legacy protocols in Exchange Online

CPC

I'm having a similar issue, no matter how many times i send the app over for admin consent and approve it as an admin I will be asked to consent (even with the oauth plugin modification I followed in my previous post).

The one difference you can make however is you only need to give Application Administrator permissions to the account, not full global admin. This is enough to allow them to email account to admin consent the app themselves.

KevinTheJedi

CPC

Look at my response here:

https://forum.osticket.com/d/101298-oauth2-microsoft-not-working/104

Cheers.

rjkunde

KevinTheJedi It seems that the old Oauth plugin (0.3) was holding on to the data for the email account somehow (probably in the database). We removed and recreated each email account in osTicket and finally, the window was populated correctly. We still aren't up and running yet, but we're down to "invalid_client". Now leaning towards some sort of misconfiguration in Azure / our osticket instance.

osflake

Hi,

I was very big problem to activate oauth2 with microsoft. But I have additional problem - I use shared mialboxes (before oauth2 I used this shared mialboxex, but now I cannot use it).

Do You have any solutions (via powershell) to add access for aplication using this shared mailboxes?

KevinTheJedi

osflake

Not at this time no. You can customize the code but out of the box this is not possible. We do hope to add this support in the future.

Cheers.

RBGE

osflake I'm using shared mailboxes too, and had no issues setting this up following the documentation. The key thing is you need to sign in as this shared mailbox directly, not as a delegate (it also helps to temporarily allow users to grant consent to apps, as it'll be the shared mailbox accounts doing this, not your administrator account).

KevinTheJedi

RBGE

Interesting, I must be thinking of aliases. I figured shared mailboxes don't have their own login but seems I was wrong in that assumption.

Cheers.

osflake

RBGE
I logged in using shared mailboxes. i cannot login to shared mialboxes via outlook owa. Few days ago I logged in but today not. I try to find solutions by powershell (custom roles for shared mailboxes)

osflake

KevinTheJedi
You can log in to shared mailboxes using password but you have to set SMTP rules via powershell

KevinTheJedi

osflake

Interesting. Good to know.

Cheers.

hermesdelenfent

Hi,
I use de configuration for OAuth2 in Outgoing SMTP and it works, but when i press "Save Changes" I get the error "Unable to connect via TLS" there is any idea that why I have recived this error?

regards

KevinTheJedi

hermesdelenfent

As it states it’s unable to connect via TLS. This can be due to many reasons so you’ll need to check your logs on your server for anything related. I would also check to ensure you have OpenSSL installed and updated on the server.

Cheers.

dclausing

mbanyard, Thank you for the snippet. I migrated over from Apache on Ubuntu to Windows Server with IIS 10 and was pulling my hair out trying to get oAuth2 working, additionally, I had delete my original email profile and create a new one. Once I added the snipped to my web.config and created the new profile, the oAuth2 worked without error. Thank you all for the fantastic work you do and to the support community! My config is using Google Email in a Google for Workspace Environment for anyone that was curious.

vomnycliff

huntmknox

Hi Huntmknox, did you ever get your NGINX configuration to work with Oauth2 authentication. I have the same issue you mentioned on 9/16/22 where I see the token in the address bar but the page shows up with "Not Found."

ntozier

vomnycliff

A not found in the browser at that point usually means that you do not have rewrite enabled on your webserver.

Gruffly5780

Hi All,

I am running the new 1.17 OSTicket fresh install on Debian 11 and I have Microsoft 365 for my support@ email used with customers to create tickets.

I have the settings in oauth2 all setup and been working on it for days each change I make produces an error similar to ones others posted on here. See my screenshots for my current settings but im looking to see if anyone can tell me if I have something wrong? Im new to all this and just want to get it working...

KevinTheJedi

Gruffly5780

You have the wrong scopes. You should keep the scopes and Resource Details Endpoint default. Follow our documentation to a “T”:

https://docs.osticket.com/en/latest/OAuth2/Microsoft%20Authorization%20Guide.html

Cheers.

Gruffly5780

KevinTheJedi
Thank you I missed this document entirely; I'll report back when I make the changes.

Gruffly5780

Okay so I've got everything lined up to the very detail on that document between the azure and oauth2 settings in my os ticket I am getting a new error -

On the support email settings I am requiring to select a protocol and the other settings so I do so like this and hit save is when I get that AUTHENTICATE Failed -

But when I check config and view the token it looks like everything should be fine -

I need to setup the email fetching and SMTP next so I can get emails to tickets then reply to them on the same support email. I feel this is the last error stopping me. Any suggestions?

Also the SMTP settings I just tried has an error as well -

KevinTheJedi

Gruffly5780

You will need to ensure IMAP is enabled for that address. Then you will need to post a screenshot of your email config censoring any sensitive info.

Cheers.

Gruffly5780

KevinTheJedi
So I logged into the support email using Outlook Webapp at https://outlook.office365.com in a separate browser and went into "Settings" and found this to already be turned on -

I believe this should also mean imap is on?

I also just found in the Microsoft 365 admin port for the user the allowed apps for Support@ and I found all of this already eenabled:

Sorry for the multiple edits I found these login errors for the support@ email user in the admin portal which I find confusing from AAD portal the admin consent and "delegated" was followed and at somepoint in setting this up it allowed me on the Microsoft sign in redirect after clicking submit to Consent the app as the user successfully -

« Previous Page Next Page »