End of support for Basic Authentication access to Exchange Online API’s for Office 365 customers

[jrawoot]

Hello pgr,
my crm version is 7.11.10 . Is this compatible for this? and where can I get "ExternalOAuthConnection " module package?

[likhobory]

I guess this functionality will be available in version 7.13.

SuiteCRM Roadmap - SuiteCRM; The future of SuiteCRM

[jrawoot]

Hello pgr,
I have update code as per given and trying to authenticate. but i’m getting some packages issue. Can you please confirm if I can add those package in 7.11.10?

[pgr]

SuiteCRM 7.13.0 Beta Release

SuiteCRM 7.13.0 beta is now available to download The release has focused on the changes needed to implement a new solution due to the deprecation of Basic Authentication in Exchange online by Microsoft, as well as improving the current email configuration options. For any feedback regarding this release, please feel free to comment below. Please note, this is a pre-release and is NOT recommended for Production use. We will aim to have the Production release available later this week. Check …

[rxrider]

Using this new imap package for syncing emails … Add OAuth connection to Inbound emails by clemente-raposo · Pull Request #9839 · salesagility/SuiteCRM · GitHub

Im facing the issue on imap_search (oauth- imap2handler) only when we pass criteria like “SINCE” with date,

Below are the logs

Tue Dec 13 04:37:13 2022 [32576][INFO] INBOUNDEMAIL-CACHE: setting timestamp query [ UPDATE inbound_email_cache_ts SET ie_timestamp = 1670935033 WHERE id = 'XXXXX_INBOX' ]
Tue Dec 13 04:37:13 2022 [32576][INFO] [EMAIL] Performing IMAP search using criteria [SINCE "Tue, 13 Dec 2022 04:24:38 -0800" UNDELETED] on mailbox [INBOX] for user
Tue Dec 13 04:37:13 2022 [32576][INFO] INBOUNDEMAIL: Cache path is cache/modules/Emails/XXXXX/folders/SearchData.php
Tue Dec 13 04:37:13 2022 [32576][FATAL] An Imap error detected: "IMAP search error"
Tue Dec 13 04:37:13 2022 [32576][INFO] INBOUNDEMAIL: no results for mailbox [ INBOX ]

Anyone facing the same issue?

[g.martin]

SuiteCRM 7.13 Released

[image] SuiteCRM 7.13 is now available to download. The SuiteCRM 7.13 release includes a number of improvements to the email configuration options, but particularly the introduction of support for XOAuth2 Authentication, due to Microsoft’s decision to deprecate support for Basic Authentication in Exchange online. We have also included 2 new Logic Hooks, designed to simplify the ability to override and extend access to specific areas of the CRM as well as a number of Pull Requests, which have …

[mrrosenthal]

Thank you for working on this. Will this work with 2 factor authorization into microsoft exchange emails or it will only work with exchange but not with 2factor setup on the account.

[jrawoot]

Hello Team,
@pgr
my suitecrm version was 7.11.10 and i have upgraded to 7.11.23. and after implemented given package in instance getting below error. Any Idea what is missing?

Tue Dec 20 12:35:19 2022 [9240][1][FATAL] An Imap error detected: "IMAP open error: Can not authenticate to IMAP server: A0001 NO AUTHENTICATE failed."
Tue Dec 20 12:35:19 2022 [9240][1][FATAL] An Imap error detected: "IMAP open error | debug data"
Tue Dec 20 12:35:19 2022 [9240][1][FATAL] An Imap error detected: "ImapHandler:open: {outlook.office365.com:993\/imap\/ssl}"
Tue Dec 20 12:35:19 2022 [9240][1][FATAL] An Imap error detected: "ImapHandler:open: test.inbound@itechsolution0006.onmicrosoft.com"
Tue Dec 20 12:35:19 2022 [9240][1][FATAL] An Imap error detected: "ImapHandler:open: password is empty: no"
Tue Dec 20 12:35:19 2022 [9240][1][FATAL] An Imap error detected: "ImapHandler:open: 512"
Tue Dec 20 12:35:19 2022 [9240][1][FATAL] An Imap error detected: "IMAP open error | debug data end "
Tue Dec 20 12:35:19 2022 [9240][1][FATAL] ImapHandler trying to use a non valid resource stream.

[ckangwei]

You can try to go with v7.13
We are also testing with 7.13 now and seems to works fine.

[jrawoot]

Hi ckangwei,
while creating personal inbound if I try to select monitoring folder it is showing login or password incorrect. for basic auth it is working fine. but not for Oauth.

Wed Dec 21 17:53:51 2022 [8568][1][FATAL] Using imap handler class: ImapHandler
Wed Dec 21 18:38:54 2022 [6224][1][FATAL] Using imap handler class: Imap2Handler
Wed Dec 21 18:38:54 2022 [6224][1][FATAL] OAuthAuthorizationService::hasConnectionTokenExpired | Access token has expired
Wed Dec 21 18:38:56 2022 [6224][1][FATAL] An Imap error detected: "IMAP open error: Can not authenticate to IMAP server: A0001 NO AUTHENTICATE failed."
Wed Dec 21 18:38:56 2022 [6224][1][FATAL] An Imap error detected: "IMAP open error | debug data"
Wed Dec 21 18:38:56 2022 [6224][1][FATAL] An Imap error detected: "ImapHandler:open: {outlook.office365.com:993\/service=imap\/ssl\/tls\/validate-cert\/secure}INBOX"
Wed Dec 21 18:38:56 2022 [6224][1][FATAL] An Imap error detected: "ImapHandler:open: test.inbound@itechsolution0006.onmicrosoft.com"
Wed Dec 21 18:38:56 2022 [6224][1][FATAL] An Imap error detected: "ImapHandler:open: password is empty: no"
Wed Dec 21 18:38:56 2022 [6224][1][FATAL] An Imap error detected: "ImapHandler:open: 512"
Wed Dec 21 18:38:56 2022 [6224][1][FATAL] An Imap error detected: "IMAP open error | debug data end "
Wed Dec 21 18:38:56 2022 [6224][1][FATAL] ImapHandler trying to use a non valid resource stream.

[ckangwei]

I am guessing you are trying to configure for multiple inbound mailbox?

We are facing similar problem and below are actions we taken to resolve this

1. Make sure the correct Client ID & Secret is set correctly
2. Make sure the scope had been configured (offline_access, IMAP.AccessAsUser.All, User.Read)
3. Authorize URL = https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize
4. Token URL = https://login.microsoftonline.com/organizations/oauth2/v2.0/token
5. Click on Authenticate button in External Oauth Connection’s record detailview to authorize the token generation for certain user

Our issue is that we had authenticate for User A, and then User B. But somehow CRM cached the token for User A so when we configure the inbound email for User A, we get to see the folder list without issue. But when we try to configure Inbound Email for User B, we get the unknown error with empty folder.

Our solution is that we have to logout the User A in outlook interface before we can configure for User B.

Hope the above helps.

[mrrosenthal]

Does anyone know how to get this to work with shared mail boxes from exchange? Apparently direct login of a shared mailbox is against their policy. They suggest EWS or Graph API. Any thoughts on whether those options would work with 7.13

[mrrosenthal]

were you able to make progress wit hteh 2 step authentication and the latest update

[ambitsoftware]

I am not sure if any document is available for the configurations.
we have followed below SugarCRM guide to register the app in Azure, only one issue we observed while app registration, when we use redirect URL from SuiteCRM (siteurl + /index.php?entryPoint=setExternalOAuthToken) in app registration it shows us error string not allowed.
We have then used redirect URL from SugarCRM guide and created rewrite rule in SuiteCRM web.config.
https://support.sugarcrm.com/Knowledge_Base/Connectors_Integrations/Integrating_With_Microsoft_for_Admins/
After this we added OAuth provider (personal) with correct details.
we are also able to get Expires In, Access Token, Refresh Token values in OAuth connection (personal).
on the last step when we try to configure personal inbound email we are getting login password incorrect error in OAuth, whereas basic authentication working fine,
below In SuiteCRM logs
Thu Dec 22 11:47:20 2022 [6204][1][FATAL] Using imap handler class: Imap2Handler
Thu Dec 22 11:47:22 2022 [6204][1][FATAL] An Imap error detected: “IMAP open error: Can not authenticate to IMAP server: A0001 NO AUTHENTICATE failed.”
Thu Dec 22 11:47:22 2022 [6204][1][FATAL] An Imap error detected: “IMAP open error | debug data”
Thu Dec 22 11:47:22 2022 [6204][1][FATAL] An Imap error detected: “ImapHandler:open: {outlook.office365.com:993/service=imap/ssl/tls/validate-cert/secure}INBOX”
Thu Dec 22 11:47:22 2022 [6204][1][FATAL] An Imap error detected: “ImapHandler:open: inbound@ourdomain.onmicrosoft.com”
Thu Dec 22 11:47:22 2022 [6204][1][FATAL] An Imap error detected: “ImapHandler:open: password is empty: no”
Thu Dec 22 11:47:22 2022 [6204][1][FATAL] An Imap error detected: “ImapHandler:open: 512”
Thu Dec 22 11:47:22 2022 [6204][1][FATAL] An Imap error detected: "IMAP open error | debug data end "
Thu Dec 22 11:47:22 2022 [6204][1][FATAL] ImapHandler trying to use a non valid resource stream.
Thu Dec 22 11:47:22 2022 [6204][1][FATAL] An Imap error detected: “IMAP open error:Can not authenticate to IMAP server: A0001 NO AUTHENTICATE failed.”
Thu Dec 22 11:47:22 2022 [6204][1][FATAL] ImapHandler trying to use a non valid resource stream.

below is in PHP Logs
[22-Dec-2022 11:47:23 Asia/Kolkata] PHP Warning: imap2_open(): Couldn’t open stream {outlook.office365.com:993/service=imap/ssl/tls/validate-cert/secure}INBOX in C:\inetpub\wwwroot\suitecrm7130\include\Imap\Imap2Handler.php on line 289. Source code in C:\inetpub\wwwroot\suitecrm7130\vendor\javanile\php-imap2\src\Connection.php on line 81
[22-Dec-2022 11:47:23 Asia/Kolkata] PHP Notice: Undefined index: foldersList in C:\inetpub\wwwroot\suitecrm7130\modules\InboundEmail\ShowInboundFoldersList.php on line 146
[22-Dec-2022 11:47:23 Asia/Kolkata] PHP Notice: Undefined variable: requestMailBox in C:\inetpub\wwwroot\suitecrm7130\modules\InboundEmail\ShowInboundFoldersList.php on line 248
[22-Dec-2022 11:47:23 Asia/Kolkata] PHP Warning: implode(): Invalid arguments passed in C:\inetpub\wwwroot\suitecrm7130\modules\InboundEmail\ShowInboundFoldersList.php on line 248

can you please help us by providing steps to resolve this.
@jrawoot @g.martin @pgr

[ambitsoftware]

Can somebody please share the steps to register app in Azure for SuiteCRM with Redirect URL and also steps to configure OAuth provider, OAuth Connection and OAuth inbound mailbox in SuiteCRM.
We suspect that we are missing something here.

[Retaliator]

Did you find any solution for this?

[ghalib.m]

The fix that worked for me was changing the line of code in the library used (javanile) i.e
in the authenticate function at
vendor/javanile/php-imap2/src/Roundcube/ImapClient.php
Replace near line 783
$auth = base64_encode("user=$user\1auth=Bearer $pass\1\1")
With
$auth = $auth = base64_encode("user=" . $user . "\001auth=Bearer " . $pass . "\001\001")

Doing this, should probably resolve your authentication issue as well.

[pgr]

@ghalib.m

$auth = $auth = base64_encode("user=" . $user . "\001auth=Bearer " . $pass . "\001\001")

To me, that seems equivalent to this simpler version:

$auth = base64_encode("user=$user\001auth=Bearer $pass\001\001")

Am I wrong?

[ckangwei]

Not sure if this help but we have to set the scope in the exact order as below for it to work.

1. offline_access
2. https:// outlook.office.com /IMAP.AccessAsUser.All
3. User.Read
4. User.Read.All

I do not know why but if we changes the order then the auth will fail. And we included the User.Read.All in the scope as well though it was not mentioned in the guide.

And do not ask me why IMAP.AccessAsUser is a full url. I do not know. Somehow we need to set in such a way for imap to work in our case.

Hope this helps

[mrrosenthal]

Will all the issues that are occurring be fixed for version 8? When will version 8 get the microsoft xoauth2 update.