OAuth2 error

[zerszenyi]

Hi,

This topic has been touched lots of times, but it still lacks a clear list of requirements.

Followed https://www.znuny.org/en/blog/modern-au ... -microsoft to the letter, read other posts in this forum and tried their suggested solutions. yet I am still unable to fetch email. The logs show "2 bad user is authenticated but not connected", which means that:
1. I have successfully obtained a token
2. I have successfully authenticated
3. Have no rights to access the mailbox

My setup:
- Dedicated, fully licensed mailbox (NOT a shared mailbox with delegated access)
- Security Baseline disabled
- No Conditional Access Policies
- MFA is disabled on the mailbox
- IMAP access is allowed org-wide
- IMAP access is enabled on the mailbox
- Steps in above blog followed to the letter

Please provide a working and verified configuration with *all* moving parts.
Thank you.

[root]

Hi,

Does the user who obtains the initial token in the UI is the mailbox user or someone else? This user is the who requires access to the mailbox.

- Roy

[zerszenyi]

Hi Roy,

Thank you for the quick reply, that was the issue indeed.

Three problems though:

1. It is a nicely written blog, however it is incomplete without the detail you've just given me. From what I can see there are lots of admins on this forum frustrated by OAuth2 problems. It only takes one additional line in the blog to streamline the setup, taking the guesswork out of the whole process, saving their time, and yours too because there will be fewer admins asking the same questions time and again. A note should also be made about disabling MFA on the mailbox, Security Baseline constraints (no longer relevant but worth mentioning), Conditional Access Policies that may regulate access, and enabling IMAP org-wide as well as on the mailbox. The same should be added to the documentation as well at https://doc.znuny.org/znuny_lts/admin/a ... index.html

2. If I use the wrong account to get the token, how do I delete the wrong token and force authentication with the correct account?

3. I wanted to delete and re-create from scratch my OAuth2 token configuration. There seems to be no option to delete it. Once created, you're stuck with it. It can be edited, but how about deleting it?

Re point 1, I am thinking of something like this:

OAuth2 - Missing Step in Blog.png

... and in the documentation also:

OAuth2 - Missing Clarification in Documentation.png

Thanks again and have a great day

[root]

Hi,

Let me answer one by one:

1.) This is not related to Znuny, it is related to OAuth2 and Microsoft. Do not expect us to cover documentation that is part of the OAuth2 provider (MS). I'll put it on the list to but can't make a promise.

2. & 3.) As long as the token is used (see mailboxes_ you can't delete the token. But you can created a new token with the same settings just another name.

- Roy