Certificate-based Authentication in SharePoint Online O365 connector

The SharePoint Online O365 connector registers as an Azure AD An identity and access management solution from Microsoft that helps organizations secure and manage identities for hybrid and multicloud environments. application with certificate authentication.

Application Permissions

The Azure application must be granted the following SharePoint API permission (see the topic below):

  • “Full control of all site collections”

The Azure application must be granted the following Graph API permissions:

  • Read all hidden memberships:
    • Member.Read.Hidden
  • Read all groups:
    • Group.Read.All
  • Read directory data:
    • Directory.Read.All
  • Read all users' full profiles:
    • User.Read.All

Certificate Requirements

For the following topics you need the signed certificate in PFX and CER formats (created here) as well as the password for the PFX certificate.

Register the Azure Application

  1. Go to https://portal.azure.com/ and login with Azure Global Admin user credentials.

  2. Click Azure Active Directory An identity and access management solution from Microsoft that helps organizations secure and manage identities for hybrid and multicloud environments. and click on the desired directory.

  3. From the menu select App Registrations.



  4. Click New registration to register a new app.



  5. Name: Enter a name for your app.

  6. Application type: Select Web app/API app.



  7. Redirect URI:
    1. Enter a URI of your choosing.
    2. (The URI is not used in the SharePoint Online Authorization mechanism)

  8. Click Register at the bottom of the page.

  9. Within the app, go to API Permissions.



  10. Under API Permissions >  Add a permission > Sharepoint.



  11. Select the following permissions for the app depending on the Authentication mechanism used:
    1. Application permissions> "Sites.FullControl.All"

  12. Click the Add Permissions button at the bottom of the screen.
  13. Back in the "Configured permissions" menu, select the Sites.FullControlAll permission and click the Grant admin consent.. button to grant the selected permissions (requires admin rights).



  14. Repeat this process (Steps 9 through 13)for each of the followingMicrosoft GraphAPIs - Application permissions:


  15. Open the Azure app you created in the previous steps, above.
    Under "Manage" click Certificates and secrets

  16. Add your newly created certificate.


    There are multiple methods that can be used to create a certificate.
    BA Insight recommends the following instructions to create a certificate:How to Create a Self-Signed Certificate.

    If you use another program, such as IIS, when you export the certificate, ensure you do not mark the key as exportable:

    Also, when exporting your certificate using IIS, note that it MUST BE Base-64 encoded:
     

Install the PFX Certificate on the Server Where the Connector Is Installed

  1. Run the Microsoft Management Console (MMC) as an Administrator.

  2. Add the Certificates Snap-in.

  3. Expand the tree to the Trusted Root Certification Authority.


  4. Use the Actions menu to import your PFX certificate.
Important: The user account running the SharePoint Online Connector application pool, must have read access to the Trusted Root Certificate store on the local machine.
This user account cannot be Network Service Local account used by the service control manager. Not recognized by the security subsystem, so you cannot specify its name in a call to the LookupAccountName function. Has minimum privileges on the local computer and acts as the computer on the network..

How to Determine the Certificate Distinguished Name

  1. Run the Microsoft Management Console (MMC) as an Administrator.

  2. Add the Certificates Snap-in.

  3. Locate the certificate in the Trusted Root Certification Authority and double-click the certificate name.

  4. From the pop-up window select theDetailstab.

  5. Locate the “Subject” field and click on it.

  6. Identify in the text box below all the distinguished name components.

  7. Build the distinguished name based on all the components separated by comma and space characters.
    For example: CN=Jeff Smith, OU=Sales, DC=Fabrikam, DC=COM

    If you copy your certificate details, as shown below, you must ensure you use syntaxwithout a spaceor your certificate will not work.

    CORRECT SYNTAX Example: "CN=Jeff Smith"
    INCORRECT SYNTAX Example: "CN = Jeff Smith"