Sharepoint API Headless Obtaining Access Tokens

问题

I am coding an integration that has to call Sharepoint-online API's. My integration is not a webapp and has to work without a user present.

As I understand it I need two setup steps: 1. User has to log in to Azure and set up an application and obtain a client ID. 2. I have to call a service with client ID and username and password I will then obtain an Access Token, Refresh Token and ID Token

Once the two setup steps are complete I then can call the service using the access token, but sometimes this will expire and I need to use the refresh token to get a new one.

Step 2 seems odd to me. Why isn't there a user interface where a user can log in and obtain the Access Refresh and ID tokens? Has someone built a utility website that just does this, or have I mis-understood something?

Thanks Robert

回答1:

The recommended OAuth flow for service and daemons apps is the Client Credential Flow (in that flow, there no refresh tokens involved; a client ID and a client secret is used to obtain an access token which eventually expires and then you need to get a new access token using the same client ID and secret). In the case of SharePoint Online, you have 2 options for this scenario:

SharePoint Online + Azure Access Control Service (ACS) integration. Details here. In short, you create a service principal (add in only policy) for instance at the site collection level - follow the "Creating the AppPrincipal" section in the blog I linked for this. Then you need to assign the specific permissions your app will need, in the application manifest. See a sample for that in the "Giving the App Principal Permissions" sections - again, you should first define what permissions your app needs. Then, you can use the service principal from a console application:

Program.cs

            static void Main(string[] args)
        {
            Uri siteUri = new Uri("https://tenant.sharepoint.com/teams/test");
            //Get the realm for the URL
            string realm = TokenHelper.GetRealmFromTargetUrl(siteUri);

            //Get the access token for the URL.  
            //   Requires this app to be registered with the tenant
            string accessToken = TokenHelper.GetAppOnlyAccessToken(
                TokenHelper.SharePointPrincipal,
                siteUri.Authority, realm).AccessToken;

            HttpWebRequest endpointRequest =
(HttpWebRequest)HttpWebRequest.Create(
"https://tenant.sharepoint.com/teams/test/_api/web/lists/GetByTitle('Documents')/items");
            endpointRequest.Method = "GET";
            endpointRequest.Accept = "application/json;odata=verbose";

            endpointRequest.Headers.Add("Authorization", "Bearer " + accessToken);
            HttpWebResponse endpointResponse =
            (HttpWebResponse)endpointRequest.GetResponse();


        }
    }

app.config

<?xml version="1.0" encoding="utf-8" ?>
<configuration>
    <startup> 
        <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.5.2" />
    </startup>
  <appSettings>
    <add key="ClientId" value="65e674ca-3827-4134-852b-1196ff935e08"/>
    <add key="ClientSecret" value="xxxxxxx"/>
  </appSettings>
</configuration>

SharePoint Online + Azure Active Directory (AAD) integration. Details here. In that link you will find a sample code. The difference between the first approach is that in this one you are not using ACS but AAD. The permission that the app needs is defined in AAD - as of today, as far as I know, the application permissions that you can define in AAD are not as granular as the ones you can define via ACS - i.e. with ACS you can define an app at the site collection level, with AAD you can't the app will have tenant wide permissions (i.e. all site collections)

来源：https://stackoverflow.com/questions/44302399/sharepoint-api-headless-obtaining-access-tokens

标签

azure

sharepoint

oauth

sharepoint-online