Basic Authentication Retirement for legacy protocols in Exchange Online: Page 5

Basic Authentication Retirement for legacy protocols in Exchange Online

Fin3

jerer
What kind of microsoft account are u using? Microsoft or Exchange online?

jerer

Exchange online. Here's my App Registration settings in Azure:

And settings in osticket:

Just a note that in the current release setting the scopes via UI does not work, also the hard coded email attribute needs to be fixed in the code: https://github.com/protich/osTicket-plugins/tree/plugins/auth-oauth2

patricksmithosticket

yes a microsoft exchange online account

edgarnadal

KevinTheJedi Hi Kevin,

I think you can create a trial o365 trial account and you will have a Azure AD in the mean time.

Also you can creaate a developer account:
https://developer.microsoft.com/en-us/microsoft-365/dev-program

Fin3

jerer
Very thank you for your input.
I've imported and compiled your modification to the attr_username and attr_email inside the last commit of Mr. Protich but the result it's always "invalid_client". I've also setted my application to allow users from all tenants (previously was only mine, but auth was working too) but without luck (same error).
Now i'm preparing a machine to debug php and try to understand what's going on down there.

Thank you and tc

patricksmithosticket

Hi Jerer,

Thanks for your advice. I have created exactly the same app in azure but it keeps returning the message "No input file specified." when saving the oAuth2 configuration.

I only use the OAuth2 app from the osticket site. I tried to replace it with the one from github only the last step doesn't work... php -dphar.readonly=0 make.php build <plugin-folder>

jerer

patricksmithosticket

I think your issue is related to the .htaccess in the api folder not working, Are you using Apache? If so do you have AllowOverride and the rewrite module enabled? https://stackoverflow.com/a/22526144

If you are using IIS/Nginx the URL rewrites needs to be configured differently (although at least Nginx isn't officially supported).

Anyway, since the plugin has couple issues with might be just better to wait for updated version. But if you want to test the fixes I posted above, you can install the plugin without building it.

patricksmithosticket

Thank you Jerer.

We use Apache. In the htaccess file I see a rewrite function but no AllowOverride.

I downloaded the github version. In which folder should I put the files?

jerer

patricksmithosticket

The "AllowOverride all" needs to be configured in Apache config, not in the .htaccess file. I think you should start a new thread if you still have issues with the redirect URI.

You put the files in "/include/plugins/" folder. From there you can install them directly without building (tho you still have to run php make.php hydrate).

Fin3
Not sure what is causing invalid_client error in your case, one way I could replicate this is having the redirect URI incorrect in Azure. Make sure it doesn't have any trailing /'s in Azure, it has to match exactly what is configured in osTicket.

Fin3

jerer
I suppose that return uri is ok, i've tried with /osticket/ as per your installation and it return on a 404 page, so i removed it and still go to invelid_client.
I've quite finished to build up a develop machine, i'll let you know!

Thank you

patricksmithosticket

Thank you Jerer, I have installed the plugin, but still have issues with the redirect URL. Is the conclusion correct that the Azure app and the data in the OAuth2 configuration are correct, but that the feedback to OSticket (on the redirect URL) goes wrong?

I will open a new thread for issues with the redirect URL

KevinTheJedi

patricksmithosticket

This issue is definitely related to AllowOverride module in Apache. You need to go to your sites-available file for the osTicket site or the main httpd.conf and change the AllowOverride module to All.

Cheers.

KevinTheJedi

@jerer

Yes, I was able to confirm we need to use outlook scope URLs, the v2.0 Resource Owner Endpoint, but the attribute is in fact mail. You just need to go to the User in Azure AD, edit the User, and add their email to the Contact Information Form Email Address field. They really need to get their stuff together man. I guess this is what they mean by Microsoft Hell.

Cheers.

patricksmithosticket

Thank you Kevin. Do i have to change the AllowOverride none to AllowOverride All in the /etc/apache2/apache2.conf file?

<Directory /var/www/>
Options Indexes FollowSymLinks
AllowOverride All
Require all granted
</Directory>

KevinTheJedi

patricksmithosticket

Yes, make sure you restart Apache afterwards.

Cheers.

KevinTheJedi

@jerer

Were you able to successfully test fetching? My account is still not migrated so I cannot test IMAP/POP nor SMTP yet (unless I make a new trial account).

Cheers.

jerer

KevinTheJedi

Yes fetching works using IMAP. Also SMTP works with oauth. Edit: POP works too.

About the mail attribute, I have the email set also in the Contact Information form but the API doesn't still return "mail" property at all. I wonder if this is a Personal vs Exchange thing or something. Also there is no "mail" property in https://outlook.office.com/api/v2.0/$metadata

patricksmithosticket

done but unfortunately get the same message when saving the OAuth2 configuration.

~# nano /etc/apache2/apache2.conf
:~# service apache2 restart

Or do I also have to adjust this on the site-available location of this specific site?

KevinTheJedi

patricksmithosticket

As I mentioned earlier:

You need to go to your sites-available file for the osTicket site or the main httpd.conf and change the AllowOverride module to All.

Which means you should do this in your sites-available and if you don't have that then the main config.

Cheers.

patricksmithosticket

ok clear, adjusted in the main and at site level but unfortunately I keep getting the same message back.

KevinTheJedi

jerer

Very strange as when I dumped the attributes I get from v2.0 user endpoint I got all the correct attributes as expected mail, givenname, and surname.

Cheers.

« Previous Page Next Page »