SharePoint OData Connector 25.1
SharePoint OData Connector Help

# Configure OAuth Authentication

To retrieve information from SharePoint Online, the connector uses both the SharePoint OData/REST API and the Microsoft Graph API. The SharePoint API supports basic authentication with a user name and password, and OAuth authentication. The Microsoft Graph API requires OAuth authentication.

OpenText recommends that you configure the connector to authenticate using OAuth, because this can be used to access endpoints in both APIs, and prevents you having to configure authentication for each API separately.

To configure OAuth authentication, use one of the following procedures.

- Set up an OAuth Service Application. OpenText recommends this approach.
- Process Data from a Single User.

For more information about creating applications and using OAuth, refer to the Microsoft documentation.

## Set up an OAuth Service Application

To set up an OAuth Service Application

1. Go to the Microsoft Azure Portal.

2. Click New registration.

   1. Type a name for the new application.

   2. Specify a redirect URL. The "type" of the redirect URL should be "Web".

      - To use the NiFi Ingest connector, the redirect URL must match the URL shown in the advanced configuration dialog of the NiFi processor.
      - To use the standard connector, the redirect URL must match the value of the `RedirectUrl` parameter in the OAuth tool configuration file, `oauth_tool.cfg`. The default value is `http://localhost:7878/oauth`.

3. Click Certificates and Secrets and upload a certificate to use to authenticate the connector. You can use a self-signed certificate.

   To generate a self-signed certificate using OpenSSL

   The following commands demonstrate how to use OpenSSL version 3.0 to generate a self-signed certificate. The output file `certificate.cer` is the file to upload to Azure. The file `certificate.pfx` is a PKCS#12 file that includes the private key. You will need this file in a later step, to use the OAuth configuration tool that is supplied with the connector.

       openssl req -x509 -days 365 -newkey rsa:2048 -keyout certificate.pem -out certificate.pem

       openssl pkcs12 -export -in certificate.pem -out certificate.pfx

       openssl x509 -outform der -in certificate.pem -out certificate.cer

4. Click API Permissions > Add a permission.

   The Request API permissions dialog box opens.

5. Click SharePoint, followed by Application permissions and select the following permissions.

   SharePoint API Permissions | Required For
   --- | ---
   Select one of the following permissions based on the connector actions that you want to use. Sites.Read.All Sites.ReadWrite.All Sites.Manage.All Sites.FullControl.All |
   Sites.FullControl.All | Mapped Security
   User.Read.All/UserReadWrite.All | Mapped Security

6. Click Add a permission, followed by Microsoft Graph, followed by Application permissions and select the following permissions.

   Graph API Permissions | Required For
   --- | ---
   Sites.Read.All/Sites.ReadWrite.All |
   Directory.Read.All | Mapped Security
   User.Read.All | Mapped Security

7. Run the OAuth configuration tool that is supplied with the connector.

   - To configure the NiFi Ingest connector

     1. In the NiFi web interface, right-click the processor and click Configure.
     2. Click ADVANCED, and complete the guided setup wizard. Then configure OAuth using the OAUTH SETUP > SERVICE ACCOUNT tab.

   - To configure the standard connector

     1. Open the folder where you installed the connector.
     2. Open the OAuth tool configuration file, `oauth_tool.cfg`, in a text editor.

     3. In the `[Default]` section, set any SSL or proxy settings that are required to access the repository:

        `SSLMethod` | The version of SSL/TLS to use.
        `ProxyHost` | The host name or IP address of the proxy server to use.
        `ProxyPort` | The port of the proxy server to use.

        For example:

            SSLMethod=NEGOTIATE
            ProxyHost=10.0.0.1
            ProxyPort=8080

     4. In the `[OAuthTool_ServiceApp]` section, set the following parameters:

        `AdminConsentUrl` | Replace the placeholder `{TenantId}` with your Microsoft 365 Tenant, for example `mydomain.onmicrosoft.com`.
        `TokenUrl` | Replace the placeholder `{TenantId}` with your Microsoft 365 Tenant, for example `mydomain.onmicrosoft.com`.
        `AppKey` | The application key of the application you created to represent the connector.
        `CustomValue0` | The path to the `.pfx` file that contains the certificate and private key to use to authenticate the connector.
        `CustomValue1` | The password for the private key.

     5. Open a command-line window and run the following command:

        `oauth_tool.exe oauth_tool.cfg OAuthTool_ServiceApp`

        A web browser opens, asking you to log in and grant admin consent.

     6. Log in and grant admin consent.

        The web page displays a message stating that the OAuth details have been successfully stored, and the OAuth tool creates the files `oauth.cfg` and `oauth2_sites.bin`. When you configure the connector, import the parameters from `oauth.cfg` into your task configuration. For more information about including parameters from another file, see Include an External Configuration File.

## Process Data from a Single User

To process data from a single user

1. Go to the Microsoft Azure Portal.

2. Click New registration.

   1. Type a name for the new application.

   2. Specify a redirect URL. The "type" of the redirect URL should be "Web".

      - To use the NiFi Ingest connector, the redirect URL must match the URL shown in the advanced configuration dialog of the NiFi processor.
      - To use the standard connector, the redirect URL must match the value of the `RedirectUrl` parameter in the OAuth tool configuration file, `oauth_tool.cfg`. The default value is `http://localhost:7878/oauth`.
3. Click Certificates and Secrets and create a new client secret.

4. Click API Permissions > Add a permission.

   The Request API permissions dialog box opens.

5. Click SharePoint, followed by Delegated permissions and select the following permissions.

   SharePoint API Permissions | Required For
   --- | ---
   Select one of the following permissions based on the connector actions that you want to use. AllSites.Read.All AllSites.ReadWrite.All AllSites.Manage.All AllSites.FullControl.All |
   User.ReadBasic.All | Mapped Security
   offline_access |

6. Click Add a permission, followed by Microsoft Graph, followed by Delegated permissions and select the following permissions.

   Graph API Permissions | Required For
   --- | ---
   Sites.Read.All/Sites.ReadWrite.All |
   Directory.Read.All | Mapped Security
   User.Read.All | Mapped Security
   User.Read |

7. Run the OAuth configuration tool that is supplied with the connector.

   - To configure the NiFi Ingest connector

     1. In the NiFi web interface, right-click the processor and click Configure.
     2. Click ADVANCED, and complete the guided setup wizard. Then configure OAuth using the OAUTH SETUP > SINGLE USER tab.

   - To configure the standard connector

     1. Open the folder where you installed the connector.
     2. Open the OAuth tool configuration file, `oauth_tool.cfg`, in a text editor.

     3. In the `[Default]` section, set any SSL or proxy settings that are required to access the repository:

        `SSLMethod` | The version of SSL/TLS to use.
        `ProxyHost` | The host name or IP address of the proxy server to use.
        `ProxyPort` | The port of the proxy server to use.

        For example:

            SSLMethod=NEGOTIATE
            ProxyHost=10.0.0.1
            ProxyPort=8080

     4. In the `[OAuthTool]` section, set the following parameters:

        `AuthorizeUrl` | Replace the placeholder `{TenantId}` with your Microsoft 365 Tenant, for example `mydomain.onmicrosoft.com`.
        `TokenUrl` | Replace the placeholder `{TenantId}` with your Microsoft 365 Tenant, for example `mydomain.onmicrosoft.com`.
        `RefreshUrl` | Replace the placeholder `{TenantId}` with your Microsoft 365 Tenant, for example `mydomain.onmicrosoft.com`.
        `AppKey` | The application key of the application you created to represent the connector.
        `AppSecret` | The client secret you obtained in step 3.

     5. Open a command-line window and run the following command:

        `oauth_tool.exe oauth_tool.cfg OAuthTool`

        A web browser opens, asking you to log in and grant consent.

     6. Log in and grant consent.

        The web page displays a message stating that the OAuth details have been successfully stored, and the OAuth tool creates the files `oauth.cfg` and `oauth2_sites.bin`. When you configure the connector, import the parameters from `oauth.cfg` into your task configuration. For more information about including parameters from another file, see Include an External Configuration File.

Copyright 2024 Open Text
Version 25.1 | Last updated January 2025

Send documentation feedback

Close

Send documentation feedback

To send feedback using your default email client, open an email window.

Otherwise, send your feedback and the information below to MFI-swpdl.idoldocsfeedback@opentext.com.

We appreciate your feedback!

Product: Knowledge Discovery SharePoint OData Connector 25.1

Topic Title: Configure OAuth Authentication