# Configure OAuth Authentication

To retrieve information from SharePoint Online, the connector uses both the SharePoint OData/REST API and the Microsoft Graph API. The SharePoint API supports basic authentication with a user name and password, and OAuth authentication. The Microsoft Graph API requires OAuth authentication.

Micro Focus recommends that you create a certificate-authenticated "App Only" OAuth application to represent the connector, because this can be used to access endpoints in both APIs, and prevents you having to configure authentication for each API separately.

You can create an OAuth application through the Azure portal. More information and full instructions are available in the Microsoft documentation.

To create an OAuth application to represent the connector

1. Go to the Azure portal > Azure Active Directory > App Registrations.

2. Create an OAuth application:

   1. Click New Registration.
   2. Type a name for your OAuth application.
   3. In the Supported Account Types area, choose to create a "Multi-tenant" application that can be used by accounts in any organizational directory.
   4. In the Redirect URI area, enter the URI `http://localhost:7878/oauth`. This is the default URL that the Micro Focus OAuth configuration tool listens on. The "type" of the redirect URI should be "Web".

   5. Click Register.

      The application is created.

3. Make a note of the tenant ID and application (client) ID, which are displayed in the Overview tab, because you will need to provide these to the Micro Focus OAuth configuration tool.
4. Click Certificates & secrets and upload a certificate to use to authenticate the connector. You can use a self-signed certificate.

5. Click API permissions and grant the relevant permissions.

   Actions that read data (synchronize, collect, and view) require the following permissions:

   - Microsoft Graph > Application Permissions

     - Directory.Read.All
     - User.Read.All
     - Sites.Read.All

   - SharePoint > Application Permissions

     - User.Read.All
     - Sites.Read.All

   Actions that modify data (such as insert or update) require read-write permissions.

6. Click Grant admin consent for <directory>. This allows the connector to retrieve data associated with all users, without those users having to give their consent individually.

After creating the application, you can use the Micro Focus OAuth configuration tool to obtain the tokens that the connector needs to make API requests.

To obtain OAuth tokens

1. Open the folder where you installed the connector.
2. Open the file `oauth_tool.cfg` in a text editor.

3. In the `[Default]` section, specify any SSL or proxy settings required to access the Microsoft APIs:

   `SSLMethod` | The version of SSL/TLS to use.
   `ProxyHost` | The host name or IP address of the proxy server to use.
   `ProxyPort` | The port of the proxy server to use.

4. In the `[OAuthTool_ServiceApp]` section, set the following parameters:

   `AdminConsentUrl` | Replace the `<TenantId>` placeholder with the value you obtained in the previous procedure.
   `TokenUrl` | Replace the `<TenantId>` placeholder with the value you obtained in the previous procedure.
   `CustomValue0` | Specify the path of your authentication certificate / private key.
   `CustomValue1` | Specify the password for your authentication certificate / private key.
   `AppKey` | The application key (client ID) you obtained when you created the application to represent the connector.

5. Save and close the file.

6. Open a command-line window and run the following command:

       oauth_tool.exe oauth_tool.cfg OAuthTool_ServiceApp

   Your default web browser opens to the Microsoft web site.

7. Authorize the application to access the API.

   Microsoft provides the OAuth tokens, and the OAuth configuration tool creates a file named `oauth.cfg`. This contains the tokens that the connector requires to authenticate.

8. Include the OAuth tokens in each of your fetch tasks. For example, you can modify the connector configuration file as follows:

       [MyTask1] < "oauth.cfg" [OAUTH]

   For more information about including parameters from another file, see Include an External Configuration File. The OAuth tool also prints the parameters it has set to the command-line window so that you can set these directly in the connector's configuration file if you prefer.

_FT_HTML5_bannerTitle.htm