NEW - 30.09.2023

A new, more generic way to access any API from the same place where you logged in with OpenIdConnect: OpenIdConnect access_token and refresh_token

Older information below

Background: https://learn.microsoft.com/en-us/graph/auth-v2-user

Office365 contains the GraphAPI used to access SharePoint documents, calendars, emails, etc.

What you need to do on the Azure side of this (also called the Tennant by Microsoft) is to do an App_Registration. Do this at: https://Portal.Azure.com.

From here, you will need:

• Client id, a guid string - put this in SysSingleton.Office365ClientId
• Tennant id, a guid string - put this in SysSingleton.Office365TennantId
• Client secret, SysSingleton.Office365ClientSecret

You must also set up the redirect endpoints that will be allowed for this solution (where Azure will go and be allowed to go in our app once it has authenticated the user).

On Azure, give the EXACT SAME value (case sensitive) as you put in SysSingleton.Office365Redirect. - this value MUST point to <your systems url>/Account/AzureAdAuthorize

The Account/AzureAdAuthorize is a new controller action that assumes you have the above Office365 values in SysSingleton. It sends a post request to "https://login.microsoftonline.com/" + tennantid + "/oauth2/v2.0/token" and gets the accesstoken and the refreshtoken. These tokens are then written to CurrentUser - SysUser.Office365AccessToken and SysUser.Office365RefreshToken.

You will also need to grant your app-registration access to particular interfaces in Office365 (allowed to see an email or not, allowed to see SharePoint lists or not).

Once you are ready to "log on" or authorize, you must say what scope THIS particular session should see: the scope looks like this; it's a space-delimited string:

offline_access User.Read Sites.Read.All

Another example: User.Read Directory.AccessAsUser.All Sites.Read.All

Put this value in SysSingleton.Office365Scope.

offline_access MUST be part of the scope to have Azure return the refreshtoken. If no refreshtoken is available, we cannot ask for new accesstokens.

We can now formulate the request for (1) a code (which lives for a very short time). We will then use this code to get (2) an access token (which lives for an hour) and (3) a refresh token (which lives for a very long time - often until revoked).

'https://login.microsoftonline.com/'+SysSingleton.oclSingleton.Office365TennantId+'/oauth2/v2.0/authorize?
client_id='+SysSingleton.oclSingleton.Office365ClientId+'
&response_type=code
&redirect_uri='+SysSingleton.oclSingleton.UrlEncode( SysSingleton.oclSingleton.Office365Redirect,false)+'
&response_mode=query
&scope='+SysSingleton.oclSingleton.UrlEncode( SysSingleton.oclSingleton.Office365Scope,false)+'
&state='+SysSingleton.oclSingleton.UrlEncode('http://localhost:5020/App#/AzureAuthorize/$null$',false)

(The authentication must be done through a link sent from the browser since it will navigate to the provider for pwd, etc. On return, we get the accesstoken and refreshtoken (if the offline_acces scope is used). Later, when we have the refreshtoken, we can silently ask for a new accesstoken that we can use with the API.)

Note the last query parameter: state. This is just round-tripped for us. We use it to know where to redirect once we have the accesstoken.

You can use the Tagged value DataIsLink and have the above URL in a ViewModel column, or use the selfVM.NavigateURL in an action.

Once you have the accesstoken, you can try a GraphAPI call like this:

SysSingleton.oclSingleton.CurrentUser.Office365RefreshAccessToken;
vResult:=selfVM.RestGet('https://graph.microsoft.com/v1.0/me','Bearer',SysSingleton.oclSingleton.CurrentUser.Office365AccessToken,'')