search

osTicket / osTicket-plugins

Core plugins for osTicket (v1.8+)
GNU General Public License v2.0
149 stars 162 forks source link

auth-oauth2: Resource Owner Email Mismatch #254

Closed protich closed 1 year ago

protich commented 1 year ago

When authorizing an email account to obtain a token - some providers, like Office365, allow for global admins to authorize on behalf of the accounts they manage. This is possible when OAuth2 plugin is NOT in strict mode (default: false) - however , on-authorization, the returned resource owner email is set to the authorizing admin email / account which in turn causes account / resource mismatch when the token is used onbehalf of resource owner.

This PR changes the plugin so that on mismatch and with strict mode set to false - the email address being authorized is set as the resource owner.

MarcBanyard commented 1 year ago

There is an additional fix for the Microsoft 365 Shared Mailboxes in Pull Request #261 which resolves the issue some users have been reporting on the forums when it comes to being able to send emails from Shared Mailboxes.

Emails MUST be sent from a licenced Microsoft 365 User Mailbox, simply setting a password for a Shared mailbox is a breach of their licencing, so the above Pull Request ensures the tenant remains compliant.