Skip to content

CreateApp-DeviceCode.md

Latest commit

 

History

History
60 lines (39 loc) · 3.14 KB

CreateApp-DeviceCode.md

File metadata and controls

60 lines (39 loc) · 3.14 KB
Raw

Creating an App for Office365 access for your STARFACE with User Delegated Rights (Devicecode)

Creating the app

In order for the Moduleblocks to work on your O365 Platform, you need to supply it with a Tenant-ID, a Client-ID

For this you need to login your Azure Portal (https://portal.azure.com) And switch over to the Azure-Active-Directory ⇒ App registrations

There you create a new registration create_app

Once the App is created you need to save the Application (client) ID and the Directory (tenant) ID for later use.

app_info

Setting API-Permissions

Even tough we have valid credentials for our STARFACE PBX we still won't be able to access the Platform without giving proper permissions.

For this change to the tab "API permissions" inside of the STARFACE_App There you can add all kind of permissions, depending on what you want to access from the STARFACE

Important! You can only use Delegated Permissions

Once the permissions are added, admin-consent has to be given by an administrator admin-consent

Now with the Permissions set we can actually use the Moduleblocks

Authenticating an Office365 in STARFACE

Creating a DeviceCode Request

Due to the restrictions with the STARFACE Webinterface the only OAuth2 way to authenticate a user is using a DeviceCode. The user has to open the page https://microsoft.com/devicelogin and enter a code which gets generated by the CreateCodeFlow Moduleblock.

create_codeflow

The Message needs to get shown to the users, this can be done for example by using the log, or sending an e-mail. **Important! Do not exit the Module. Go straight into the Create O365 Provider (DeviceCode) otherwise you'll loose the DeviceCodeFlowProvider, and it won't work **

example_block_codeflow

o365provider_devicecode

In the meantime the User has to Log in to Office365

deviceauth_start deviceauth_part2 deviceauth_finish

If the User sucessfully logs in and accepts the terms, the provider will automatically continue with the Modulescript.

Caching Tokens

By default the Token for delegated Userpermissions run out within an hour in order to avoid this, a refresh token is required. The token also is lost, once the module is done, and needs a new token for the next run.

Refresh Tokens can be acquired, by adding the permission "offline_access" to the app (just like in setting app-permissions) Once this is done, all we need to do is to create an instance of the library.

If you have an instance of the library running, the integrated TokenCache Manager will automatically take care of the following:

  • Stores Tokens from the DeviceCodeflow as long as they're still valid. They will also survive a reboot
  • Auto-Refreshes Token 1 Minute before they expire