OAuth 2.0 for SharePoint Files

Configure Designer Cloud Powered by Trifacta Enterprise Edition to integrate with your SharePoint Files deployment using OAuth 2.0 to authenticate.

Prerequisites

OAuth 2.0 is supported for SharePoint Files Online, which is available on Microsoft Azure.
OAuth 2.0 authentication must be enabled in Designer Cloud Powered by Trifacta Enterprise Edition. For more information, see Enable OAuth 2.0 Authentication.

Create OAuth 2.0 Client App in Azure

In the Azure console, you must create the client app.

Steps:

Login to Azure: https://portal.azure.com/#home
Select Azure Active Directory > App Registrations > New registration.

Specify the following fields:

Field	Description
Name	The name of the app.
Supported Account Types	Select either: `Single tenant` `Multi tenant`
Redirect URI	Specify the URL in the following format, depending your project or workspace login: `https://<Login_URL>/oauth2/callback` Example: https://clouddataprep.com/oauth2/callback

Field

Description

Name

The name of the app.

Supported Account Types

Select either:

Single tenant
Multi tenant

Redirect URI

Specify the URL in the following format, depending your project or workspace login:

https://<Login_URL>/oauth2/callback

Example:

https://clouddataprep.com/oauth2/callback

To create the new registration, click Register.
Overview tab:
Note
Copy the value for the Application (client) Id. This value must be applied in Designer Cloud Powered by Trifacta Enterprise Edition.

Branding tab: (optional) Specify the following fields:

Field	Description
Name	The name of the app should match the value you specified previously.
Logo	Upload a preferred logo for the app.
Homepage URL	Set this value to the following: https://trifacta.com
Terms of Service URL	Set this value to the following: https://www.trifacta.com/terms-conditions/
Privacy Policy	Set this value to the following: https://www.trifacta.com/privacy-policy/
Publisher Domain	Set this value to the following: trifacta.com
MPN ID	If you are a Microsoft Partner, you can specify your MPN ID.

Certificates & Secrets tab: To create a new client secret:
1. Select New client secret.
2. Set the Expires option to Never.
3. Select Add.
  Note
  Copy the Value field. This value is the client secret and must be applied in Designer Cloud Powered by Trifacta Enterprise Edition.
API Permissions tab:
1. Select Add a permission.
2. Select Microsoft Graph.
3. Select Delegated Permissions.
4. Use the search bar to search for Sites and then select the appropriate permissions. These are the recommended permissions:
  1. Site.Read.All: Ensures that all users can ingest all the files they have access to.
  2. Sites.ReadWrite.All: Allows users to write to folders and files that they have access to. This includes folders they own as well as folders shared with them.
  Note
  These recommendations are only to ensure the best user experience for your users on Designer Cloud Powered by Trifacta Enterprise Edition. Use your organization’s access policies to guide your permission selection.
  Alternatively, you can create separate OAuth Apps for read-only and read/write access:
  - Read-Only Access (Use Sites.Read.All)
  - Read/Write Access (Use Sites.ReadWrite.All)
  You can then create two separate connections for Sharepoint Files on Designer Cloud Powered by Trifacta Enterprise Edition. Then grant access to the appropriate connections for the respective users.
Save your changes.

Create OAuth 2.0 Client for SharePoint Files

After the SharePoint Files client app is created, you must create an OAuth 2.0 client in Designer Cloud Powered by Trifacta Enterprise Edition, which is used to integrate with the OAuth 2.0 Client app that you created in Azure.

Steps:

Log in to Designer Cloud Powered by Trifacta Enterprise Edition as a workspace administrator.
In the lefthand menu, select User menu > Admin console > OAuth 2.0 Clients.
In the OAuth 2.0 Clients page, click Register OAuth 2.0.0 Client.

Specify the fields for the new client:

Field	Description
Type	`sharepoint files`
Name	Enter a name for the client.
Client ID	Paste the value of the Application (client) Id that was generated when you created the client app in Azure.
Client Secret	Paste the value of the client secret that was generated when you created the client app in Azure.
Authorization URL	Single tenant: https://login.microsoftonline.com/<tenant_identifier>/oauth2/v2.0/authorize Multi-tenant: https://login.microsoftonline.com/common/oauth2/v2.0/authorize
Token URL	Single tenant: https://login.microsoftonline.com/<tenant_identifier>/oauth2/v2.0/token Multi-tenant: https://login.microsoftonline.com/common/oauth2/v2.0/token
Scopes	Set the scopes to the following values: `https://graph.microsoft.com/.default` `offline_access` Important Individual scopes must be separated by a space.
Access Token Expires In	Set this value to the following: `3599999`.
Refresh Token Expires In	Set this value to the following: `7775999999`.

To save your OAuth 2.0 client, click Save.

For more information, see Create OAuth2 Client.

Create SharePoint Files Connection

After you have created the two OAuth 2.0 client references, you can create a connection to your SharePoint Files data.

Note

You must create a separate connection for each OAuth 2.0 client that is available in n Designer Cloud Powered by Trifacta Enterprise Edition.

For more information, see Microsoft SharePoint Files Connections.

Troubleshoot Access Issues

In the above steps, you created an OAuth app in the Azure portal. However, unless individual users or user groups are entitled to access and use this app, they might not be able to use it with connections created in Designer Cloud Powered by Trifacta Enterprise Edition. Use these steps to add users to the app:

On the Azure Portal, go to Enterprise Application.
Search for the OAuth application you created.
Under the OAuth application, follow options a OR b:
1. Select Users and groups from the left navigation panel and then add the appropriate users and user groups.
2. Select Properties from the left navigation panel and then set Assignment required? to No. This gives access to users without needing explicit assignment to the app.

In this section: