My Asp.Net web application is sending email on behalf on the logged user using Office 365 Mail API (Microsoft.Office365.OutlookServices client lib).
How can I include the user's signature (defined in Office 365 user account) inside the body of the email ?
The signature is a feature which belongs Outlook online. The Office 365 REST API only provide the mail service. However you can set the message content contains the signature in the app as you want.
For example, here is an example that use the Html format to set the message content contains the signature:
{
"subject":"Test signature",
"body":{"contentType":"html","content":"<html><head></head><body><div>Your Message content</div><div>Your signature</div></body></html>"},
"toRecipients":[{"emailAddress":{"name":"user1","address":"user1#tenant.onmicrosoft.com"}}]
}
Related
I'm using the Microsoft Office 365 REST API to read calendar items from Office 365 and Outlook.com accounts.
It work's well.
Now, I need to read the same from Office 365 Deutschland accounts. That doesn't work.
I already found out the following:
Use another endpoint for login
International: https://login.microsoftonline.com/common/oauth2/v2.0/authorize
Deutschland: https://login.microsoftonline.de/common/oauth2/authorize
Use another endpoint for the REST API
International: https://outlook.office.com/api/v2.0/me/calendar/events
Deutschland: https://outlook.office.de/api/v2.0/me/calendar/events
Need another ClientID/ClientSecret
International: https://apps.dev.microsoft.com
Deutschland: https://portal.microsoftazure.de
Use different oauth2 scope
International: offline_access https://outlook.office.com/Calendars.Read
Deutschland: offline_access openid https://outlook.office.de/Calendars.Read
With all that, I can get an OAuth2 access token. But when I call
https://outlook.office.de/api/v2.0/me
or
https://outlook.office.de/api/v2.0/me/calendarview?startDateTime=2018-01-01T01:00:00&endDateTime=2018-10-31T23:00:00
with that token, I only get the following error:
Request Headers:
cache-control:"no-cache"
postman-token:"b765d2d1-9ffc-4016-8216-38678af4f245"
authorization:"Bearer AQA*** snip for security***gAA"
user-agent:"PostmanRuntime/7.1.5"
accept:"*/*"
host:"outlook.office.de"
cookie:"ClientId=DFDA316304974E36A43D11CF7BB6D8A3; OIDC=1; OpenIdConnect.nonce.v3.y7kDkk7dHuGjDZ9PZ_xiLj0CjfuLbQt629j5MuTcNp8=636667242602536754.c00ff4a6-e523-4dff-b1ce-24d1d024ce67"
accept-encoding:"gzip, deflate"
Response Headers:
server:"Microsoft-IIS/10.0"
request-id:"e59f5e5e-0980-4914-9087-064270bdd233"
x-calculatedfetarget:"LEJPR01CU002.internal.outlook.com"
x-backendhttpstatus:
0:"401"
1:"401"
x-feproxyinfo:"LEJPR01CA0057.DEUPRD01.PROD.OUTLOOK.DE"
x-calculatedbetarget:"FRXPR01MB0456.DEUPRD01.PROD.OUTLOOK.DE"
x-rum-validated:"1"
x-ms-diagnostics:"2000010;reason="ErrorCode: 'PP_E_RPS_INVALIDCONFIG'. Message: 'Invalid configuration. Check event log for actions.%0d%0a Internal error: Config directory does not exist; config directory must exist and be an absolute path:C:\Program Files\Microsoft Passport RPS\LiveIdConfig.'";error_category="invalid_msa_ticket""
x-besku:"Gen8"
x-diaginfo:"FRXPR01MB0456"
x-beserver:"FRXPR01MB0456"
x-feserver:
0:"LEJPR01CA0057"
1:"FRAPR01CA0084"
x-powered-by:"ASP.NET"
www-authenticate:"Bearer client_id="00000002-0000-0ff1-ce00-000000000000", trusted_issuers="00000001-0003-0000-c000-000000000000#*,00000002-0000-0ff1-ce00-100000000002#84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa", token_types="app_asserted_user_v1 service_asserted_app_v1", authorization_uri="https://login.microsoftonline.de/common/oauth2/authorize", error="invalid_token",Basic Realm="",Basic Realm="",Basic Realm="""
date:"Mon, 09 Jul 2018 09:46:28 GMT"
content-length:"0"
Response Body:
What am I doing wrong?
What does PP_E_RPS_INVALIDCONFIG mean?
Where can I create the directory C:\Program Files\Microsoft Passport RPS\LiveIdConfig?
The problem was the token. It was visually fine, but inside it was not.
With Office 365 Deutschland, you have to use the Azure Active Directory authentication endpoint V1.0 (no version number in the endpoint url means V1.0). For International, you should use the V2.0 endpoint.
The V2 enpoint wants the resource hint in the scope: https://outlook.office.com/Calendars.Read.
The V1 endpoint ignores the scope (and the resource hint in it) and wants an additional OAuth2 uri parameter called resource. The errors did't pointed me in the right direction.
But it was documented (badly) at this point.
resource
recommended
The App ID URI of the target web API (secured resource).
To find the App ID URI, in the Azure Portal, click Azure Active Directory,
click Application registrations, open the application's Settings page, then click Properties.
It may also be an external resource like https://graph.microsoft.com.
This is required in one of either the authorization or token requests.
To ensure fewer authentication prompts place it in the authorization request to ensure
consent is received from the user.
I think it should say required with V1.0.
Here my working authorization endpoint call:
https://login.microsoftonline.de/common/oauth2/authorize?response_type=code&client_id=c9000000-0000-0000-0000-000000000007&redirect_uri=http://localhost:11184/&state=1P3S9RvgQyfd3xLXmbhPcYD12aNHYkBF&scope=offline_access%20Calendars.Read&resource=https://outlook.office.de
By the way: If you use the resource parameter with the V2.0 endpoint, it gives you the error:
https://login.microsoftonline.com/common/oauth2/v2.0/authorize?response_type=code&client_id=6262047e-0000-0000-0000-000000000007&redirect_uri=http://localhost:11184/&state=2pSIj7o7dJJ0bGIv0p1ZfRjK6DV2duwM&scope=offline_access%20https://outlook.office.com/Calendars.Read&resource=https://outlook.office.com
AADSTS90100: The 'resource' request parameter is not supported.
I've set up something called the Data Export Service for Dynamics 365 so that it replicates into an Azure SQL database. This is working as expected.
I'm trying to find a way to be proactively notified if this service encounters any errors. There does not appear to be a native way to do this through the setup in CRM itself, but they do provide an API. The Swagger page outlining all methods can be found here.
I'm trying to call the GetProfilesByOrganizationId method using Postman:
https://discovery.crmreplication.azure.net/crm/exporter/profiles?organizationId=4ef7XXXX-XXXX-XXXX-XXXX-XXXXXX8a98f&status=true
I'm having issues with authentication and always receive the following error:
"Message": "Received unauthenticated requestRequest Url https://discovery.crmreplication.azure.net/crm/exporter/profiles?organizationId=4ef7XXXX-XXXX-XXXX-XXXX-XXXXXX8a98f&status=true"
I have registered an application in Azure that has permission to access Dynamics 365 on behalf of the authenticated user which in this case is me, the administrator.
I have set the Type to OAuth 2.0 on the Authorization tab of Postman. I have requested an Access Token using the Grant Type of Authorization Code against the above application successfully. This has added a header to the request:
Key: Authorization
Value: Bearer BIGLONGACCESSTOKEN
Despite this header being present I still get the error mentioned above.
The API documentation implies the authentication is OAuth2 Implicit Grant Flow (click on any red exclamation mark in the documentation) but I can't get this to work in Postman. When I try to request a token with this method I get the error:
unsupported_response_type
... in the Postman console.
Any ideas how to authenticate (with Implicit Grant?) against this API in Postman?
(I'd accept C# examples if they're more appropriate, but I'd be surprised if Postman can't show me what I need)
It looks like the code sample shown by Microsoft can work if updated with newer methods and with some extra configuration in Azure that's not documented.
Azure configuration
By installing the Data Export service (and assuming it's all working) you'll have a new Enterprise Application listed in Azure AD as Crm Exporter.
To take advantage of this application and authenticate with the Data Export API you must configure an app of your own.
Go to the App registrations tab in Azure AD and add a new application registration.
Give it a name and set the Application type to Native. The redirect URI doesn't typically matter as long as it's valid.
Click the Manifest button to edit the manifest, change the property oauth2AllowImplicitFlow to true and save the changes.
The only other important configuration is Required permissions which should be set as below:
Windows Azure Active Directory
Delegated permissions
Sign in and read user profile
Data Export Service for Microsoft Dynamics 365 (Crm Exporter)
Delegated permissions
Have access to Data Export Service for Microsoft Dynamics 365 API
You will then need to click Grant Permissions.
C# changes
The updated method looks like this:
using Microsoft.IdentityModel.Clients.ActiveDirectory;
string clientId = "11cfXXXX-XXXX-XXXX-XXXX-XXXXXXXXd020";
string user = "my.username#domain.com";
string password = "PASSWORD";
var authParam= await AuthenticationParameters.CreateFromResourceUrlAsync(
new Uri("https://discovery.crmreplication.azure.net/crm/exporter/aad/challenge")
);
var context = new AuthenticationContext(authParam.Authority, false);
var credentials = new UserPasswordCredential(user, password);
var token = await context.AcquireTokenAsync(authParam.Resource, clientId, credentials).AccessToken;
You can now query the Data Export API by providing the token as a header:
Authorization : Bearer eJ0y........Hgzk
curl -X GET --header 'Accept: application/json' 'https://discovery.crmreplication.azure.net/crm/exporter/profiles?organizationId=MyOrgId&status=true'
Cut my life into pieces, this is my last resort.
Seriously, I can't find this info anywhere! I thought Graph supported Outlook.com. I saw this question which referenced the Outlook Api vs the Graph Api, but how do I authorize an Outlook.com account for this?
I'm sending the user to https://login.microsoftonline.com/common/oauth2/authorize with the parameters:
response_type = code
client_id = <my client id>
redirect_uri = <my redirect_uri>
state = <csrf>
resource = https://outlook.office.com/
to sign in. It takes them to the Office 365 sign in, and when you type #outlook.com, it tries to redirect you, only to go back to the 365 login page and do it all over.
I can authorize Office 365 just fine, but not Outlook.com. I can provide more info if needed, I just figure I'm hitting the wrong endpoint or something.
Currently we have two versions of the authentication endpoint. The version less endpoint (https://login.microsoftonline.com/common/oauth2/authorize) only supports work and school accounts (Office365) the v2.0 auth endpoint (https://login.microsoftonline.com/common/oauth2/v2.0/authorize) supports both work and school and personal accounts.
To use a personal account (hotmail.com, outlook.com, live.com) with Microsoft Graph, you start by registering you app in apps.dev.microsoft.com, then follow the instructions in this article:
https://azure.microsoft.com/en-us/documentation/articles/active-directory-v2-scopes/. Try that and let me know how it goes.
I want to login Sharepoint Online with Claim Based Authentication(Office 365 Authentication) from ios application.
I used the SOAP Method as the following.
<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope"
xmlns:a="http://www.w3.org/2005/08/addressing"
xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<s:Header>
<a:Action s:mustUnderstand="1">http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue</a:Action>
<a:ReplyTo>
<a:Address>http://www.w3.org/2005/08/addressing/anonymous</a:Address>
</a:ReplyTo>
<a:To s:mustUnderstand="1">https://login.microsoftonline.com/extSTS.srf</a:To>
<o:Security s:mustUnderstand="1"
xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
<o:UsernameToken>
<o:Username>$username</o:Username>
<o:Password>$password</o:Password>
</o:UsernameToken>
</o:Security>
</s:Header>
<s:Body>
<t:RequestSecurityToken xmlns:t="http://schemas.xmlsoap.org/ws/2005/02/trust">
<wsp:AppliesTo xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy">
<a:EndpointReference>
<a:Address>$endpoint</a:Address>
</a:EndpointReference>
</wsp:AppliesTo>
<t:KeyType>http://schemas.xmlsoap.org/ws/2005/05/identity/NoProofKey</t:KeyType>
<t:RequestType>http://schemas.xmlsoap.org/ws/2005/02/trust/Issue</t:RequestType>
<t:TokenType>urn:oasis:names:tc:SAML:1.0:assertion</t:TokenType>
</t:RequestSecurityToken>
</s:Body>
</s:Envelope>
At Endpoint Address,will need to set sharepoint root site URL.
The problem is that when the login user cannot authenticate to root site
but can authenticate to site collection only, this user cannot login to
office 365.
How can I work around for this?
If the other way to login method with Office 365 authentication(claim based authentication),
please advice me.
You may want to checkout the iOS SDK for the Office 365 APIs. Here is a link to a sample application on GitHub that shows how to authenticate to Office 365 and get the access token. Once you have a valid token, you can make a REST call to SharePoint Online passing the token in Authorization Bearer header.
https://github.com/OfficeDev/Office-365-SDK-for-iOS
My end goal is to be able to retrieve place details from Google's API.
I need to do this as a Service Account, since this is kicked off as a background task on my server. Service Accounts require you to exchange a JWT (JSON Web Token) for an access_token. I finally got that working and am receiving an access_token. Phew.
Now however, I don't know what to do with this access_token.
The Place Details API says that the key parameter is required, but I don't have a key. Just an access_token. Using that value for key or changing the name of the paramater to access_token is not working.
Ultimately I need to be able to hit a URL like so:
https://maps.googleapis.com/maps/api/place/details/json?reference={MY_REFERENCE}&sensor=false&key={MY_ACCESS_TOKEN}
How do I use my Access Token to make a request to the Google Place Detail APIs?
Update 1
Still no success, but I thought I'd post the details of my request in case there's something wrong with what I'm submitting to Google.
I'm using the JWT Ruby library, and here are the values of my claim set:
{
:iss => "54821520045-c8k5dhrjmiotbi9ni0salgf0f4iq5669#developer.gserviceaccount.com",
:scope => "https://www.googleapis.com/auth/places",
:aud => "https://accounts.google.com/o/oauth2/token",
:exp => (Time.now + 3600),
:iat => Time.now.to_i
}
Looks sane to me.
Create the service account and its credentials
You need to create a service account and its credentials. During this procedure you need to gather three items that will be used later for the Google Apps domain-wide delegation of authority and in your code to authorize with your service account. These three items are your service account:
• Client ID.
• Private key file.
• Email address.
In order to do this, you first need a working Google APIs Console project with the Google Calendar API enabled. Follow these steps:
Go to the Google APIs Console.
Open your existing project or create a new project.
Go to the Service section.
Enable the Calendar API (and potentially other APIs you need access to).
You can now create the service account and its credentials. Follow these steps:
Go to the API Access section.
Create a client ID by clicking Create an OAuth 2.0 client ID...
Enter a product name, specify an optional logo and click Next.
Select Service account when asked for your Application type and click Create client ID.
At this point you will be presented with a dialog allowing you to download the Private Key as a file (see image below). Make sure to download and keep that file securely, as there will be no way to download it again from the APIs Console.
After downloading the file and closing the dialog, you will be able to get the service account's email address and client ID.
You should now have gathered your service account's Private Key file, Client ID and email address. You are ready to delegate domain-wide authority to your service account.
Delegate domain-wide authority to your service account
The service account that you created now needs to be granted access to the Google Apps domain’s user data that you want to access. The following tasks have to be performed by an administrator of the Google Apps domain:
Go to your Google Apps domain’s control panel. The URL should look like: www.google.com/a/cpanel/mydomain.com
Go to Advanced tools... > Manage third party OAuth Client access.
In the Client name field enter the service account's Client ID.
In the One or More API Scopes field enter the list of scopes that your application should be granted access to (see image below). For example if you need domain-wide access to the Google Calendar API enter: www.googleapis.com/auth/calendar.readonly
Click the Authorize button.
Your service account now has domain-wide access to the Google Calendar API for all the users of your domain, and potentially the other APIs you’ve listed in the example above.
Below is a description that uses a service account to access calendar data in PHP
The general process for service account access to user calendars is a follows:
• Create the Google client
• Set the client application name
• If you already have an Access token then check to see if it is expired
• If the Access token is expired then set the JWT assertion credentials and get a new token
• Set the client id
• Create a new calendar service object based on the Google client
• Retrieve the calendar events
Note: You must save the Access token and only refresh it when it is about to expire otherwise you will receive an error that you have exceeded the limit for the number of access tokens in a time period for a user.
Explanation of Google PHP Client library functions used:
The client object has access to many parameters and methods all of the following are accessed through the client object:
Create a new client object:
$client = new Google_Client();
Set the client application name:
$client->setApplicationName(“My Calendar App”);
Set the client access token if you already have one saved:
$client->setAccessToken($myAccessToken);
Check to see if the Access token has expired, there is a 30 second buffer, so this will return true if the token is set to expire in 30 seconds or less. The lifetime of an Access token is one hour. The Access token is actually a JSON object which contains the time of creation, it’s lifetime in seconds, and the token itself. Therefore no call is made to Google as the token has all of the information locally to determine when it will expire.
$client->isAccessTokenExpired();
If the token has expired or you have never retrieved a token then you will need to set the assertion credentials in order to get an Access token:
$client->setAssertionCredentials(new Google_AssertionCredentials(SERVICE_ACCOUNT_NAME,array(CALENDAR_SCOPE), $key,'notasecret','http://oauth.net/grant_type/jwt/1.0/bearer',$email_add));
Where:
SERVICE_ACCOUNT_NAME is the the service account email address setup earlier.
For example:’abcd1234567890#developer.gserviceaccount.com’
CALENDAR_SCOPE is the scope setup in the Google admin interface.
For example: ‘https://www.googleapis.com/auth/calendar.readonly’
$key is the content of the key file downloaded when you created the project in Google apps console.
$email_add is the Google email address of the user for whom you want to retrieve calendar data.
Set the client id:
$client-setClientId(SERVICE_CLIENT_ID);
Where:
SERVICE_CLIENT_ID is the service account client ID setup earlier.
For example: ‘abcd123456780.apps.googleusercontent.com’
Create a new calendar service object:
$cal = new Google_CalendarService($client);
Several options can be set for calendar retrieval I set a few of them in the code below, they are defined in the api document.
$optEvents = array('timeMax' => $TimeMax, 'timeMin' => $TimeMin, 'orderBy' => 'startTime', 'singleEvents' => 'True');
Get the list of calendar events and pass the above options to the call:
$calEvents = $cal->events->listEvents('primary', $optEvents);
Loop through the returned event list, the list is paged so we need to fetch pages until the list is exhausted:
foreach ($calEvents->getItems() as $event) {
// get event data
$Summary = $event->getSummary();
$description = $event->getDescription();
$pageToken = $calEvents->getNextPageToken();
if ($pageToken) { // if we got a token the fetch the next page of events.
$optParams = array('pageToken' => $pageToken);
$calEvents = $cal->events->listEvents('primary', $optParams);
} else {
break;
}
}
Get the Access token:
$myAccessToken=$client->getAccessToken();
Save the access token to your permanent store for the next time.
The language isn't important php, ruby, .net, java the process is the same. The api's console shows the Places API as supporting service accounts so it should be possible to access it.
As far as using the token please have a look at https://code.google.com/p/google-api-ruby-client/ code as the usage is clearly defined in the code repository. Doesn't make any difference if the access token is for a service account or a single user the process for using the token is the same. See the section titled "Calling a Google API" in the following link: https://developers.google.com/accounts/docs/OAuth2InstalledApp
The access token is sent in the http authorization header along with the request.For a calendar request it would look something like the following:
GET /calendar/v3/calendars/primary HTTP/1.1
Host: www.googleapis.com
Content-length: 0
Authorization: OAuth ya29.AHES6ZTY56eJ0LLHz3U7wc-AgoKz0CXg6OSU7wQA