Add login with Azure AD app certificate and Sites.Selected #48
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR adds an additional preset and login mechanism: Azure AD app registrations with certificate authentication.
If there are any change requests in terms of wording for this PR or suggestions how to better deal with the private key in the parameters (especially regarding spaces/newlines), happy to incorporate them. The
client_secret
can unfortunately not be used.I've added the
msal
library to do the authentication, but it could be done manually usingPyJWT[crypto]
andcryptography
.Reason
Microsoft is by default deactivating the ability to add new Site App registrations or change those permissions by mid of September (see MC660075).
While it can be turned on again, our Sharepoint Admins won't do this.
To access specific sites only, one can create an App Registration in Azure AD and grant the Sharepoint
Sites.Selected
permission. While this was orignally only available to Graph APIs, it is now possible to use these permissions with the original Sharepoint REST API (as used by this plugin) as well.More information and how to grant permission can be found in the announcement blog post and this detailled blog post.