topic RE: UPDATED! Microsoft Graph API for SharePoint in Digital Exchange

UPDATED! Microsoft Graph API for SharePoint

ewilson — Mon, 12 Jul 2021 17:26:00 GMT

The Microsoft Graph API connector for SharePoint was recently updated to include actions for uploading/downloading files. You can find the latest .bprelease file here.

Some things to be aware of:

The Upload File action of this connector is limited to files less than 4MB in size. There is an additional connector, making its way through the tech/marketing review process, that implements support for the Upload Session feature of Graph. That connector will support uploading files greater than 4MB through chunking. We expect that connector to be published on the DX later this week, possibly early next week.
While the main connector includes support for downloading files, there is a limitation within the Web API feature of Blue Prism that impacts downloading binary files. As a result, only text files will be successfully downloaded. To address this, you can use the connector to collect the metadata of a file on SharePoint. That metadata will include a direct download URL for the specific file. You can then use the HTTP VBO to download the file using that URL.

Cheers,

------------------------------
Eric Wilson
Director, Partner Integrations for Digital Exchange
Blue Prism
------------------------------

RE: UPDATED! Microsoft Graph API for SharePoint

seeannloh — Fri, 22 Oct 2021 04:39:00 GMT

Hi Eric,

I have question on MS Graph SharePoint API. We need to grant admin consent for ReadWrite to API permission in the app we registered in Azure AD to use the Download FIle action. But, this ReadWrite permission is too powerful because it will have the ReadWrite access to entire SharePoint sites based on my understanding.

Is there a way to limit ReadWrite access to only certain SharePoint sites we wish?

Thanks

------------------------------
SeeAnn Loh
Senior Programmer
Jabil
Asia/Kuala_Lumpur
------------------------------

RE: UPDATED! Microsoft Graph API for SharePoint

ewilson — Fri, 22 Oct 2021 14:25:00 GMT

Hi @seeannloh,

There are two permission types within MS Graph: Delegated Permissions and Application Permissions. Delegated permissions are where you're granted access to work on behalf of a specified user. Application permissions are when you operates essentially as a service account. If you want to limit what the digital worker can do I'd say you want to try using Delegated Permissions and grant the user account of the Digital Worker ReadWrite on just the necessary sites.

There's more information available here.

Cheers,

------------------------------
Eric Wilson
Director, Integrations and Enablement
Blue Prism Digital Exchange
------------------------------

RE: UPDATED! Microsoft Graph API for SharePoint

seeannloh — Fri, 22 Oct 2021 17:16:00 GMT

Hi Eric,

Thanks. If I use Delegated Permission to Files.ReadWrite and Sites.ReadWrite, will it still have full access to all SharePoint sites or I can limit with only certain sites?

Regards

------------------------------
SeeAnn Loh
Senior Programmer
Jabil
Asia/Kuala_Lumpur
------------------------------

RE: UPDATED! Microsoft Graph API for SharePoint

ewilson — Fri, 22 Oct 2021 17:23:00 GMT

Hi @seeannloh,

As I mentioned, the delegated permissions option only provides the digital worker with whatever permissions are available to the supplied user credentials. So if you have a user account called "John Doe" and that account can only perform read/write on site A then the digital worker will only be able to perform read/write actions on site A.

Cheers,

------------------------------
Eric Wilson
Director, Integrations and Enablement
Blue Prism Digital Exchange
------------------------------

RE: UPDATED! Microsoft Graph API for SharePoint

seeannloh — Fri, 22 Oct 2021 17:31:00 GMT

Hi Eric,

So I assume there is a configuration when register an app in Azure AD for site A to have ReadWrite access only for user John Doe? Something like base URL?

Thanks

------------------------------
SeeAnn Loh
Senior Programmer
Jabil
Asia/Kuala_Lumpur
------------------------------

RE: UPDATED! Microsoft Graph API for SharePoint

ewilson — Fri, 22 Oct 2021 18:09:00 GMT

You'll grant Site.ReadWrite in AD, but the actual user permission is controlled in the SharePoint site administration I believe.

Cheers,

------------------------------
Eric Wilson
Director, Integrations and Enablement
Blue Prism Digital Exchange
------------------------------

RE: UPDATED! Microsoft Graph API for SharePoint

seeannloh — Sat, 30 Oct 2021 09:58:00 GMT

Hi Eric,

Thanks. I'm able to execute the Download File action from MS Graph SharePoint API. However, how do I download the file?
I tried to find the Location header from Response based on microsoft doc but it is not there. Please advice.

I attached the screenshot of the Response Headers for Content-Type and Content-Disposition for your reference.

------------------------------
SeeAnn Loh
Senior Programmer
Jabil
Asia/Kuala_Lumpur
------------------------------

RE: UPDATED! Microsoft Graph API for SharePoint

ewilson — Sat, 30 Oct 2021 18:09:00 GMT

@seeannloh,

What's the value of the HTTP Status Code? Is it 302 or 200? I'm wondering if the underlying BP logic is automatically following the 302 redirect to try and download the file. If so, that could explain why you're not seeing the Location header. The problem with that is the Web API service feature of BP doesn't support properly handling binary downloads.

Cheers,

------------------------------
Eric Wilson
Director, Integrations and Enablement
Blue Prism Digital Exchange
------------------------------

RE: UPDATED! Microsoft Graph API for SharePoint

sachintaneja — Tue, 09 Nov 2021 10:15:00 GMT

Hi Eric

I am using Delegated Permissions in application registration
I am using Connector for Microsoft Graph API - Authentication
for generating token specifically action > Get Delegated Access Token
I am getting below error
"AADSTS50126: Error validating credentials due to invalid username or password"
Though the credentials are fine

I have gone through some links and it appears the issue is with federation being present and no redirection in HTTP call makes the call throw a generic error of invalid creds as it is unable to validate the creds

AADSTS50126: Error validating credentials due to invalid username or password - Microsoft Q&A
'AADSTS50126' "invalid_grant" Error validating credentials due to invalid username or password - Microsoft Q&A

However using python as in below link with the same application registration ( delegated permission ..same user), the token can be perfectly generated and used .
GitHub - jsnm-repo/Python-OneDriveAPI-FileUpload: Automating reports upload to OneDrive

Do you have a similar MSAL version for generating token that can work in Blueprism

------------------------------
sachin taneja
Senior
EY
Asia/Kolkata
------------------------------

RE: UPDATED! Microsoft Graph API for SharePoint

ewilson — Tue, 09 Nov 2021 12:52:00 GMT

Hi @sachintaneja,

So your environment is using federated auth services? Unfortunately, we do not have an asset at the moment that wraps MSAL, but we can look into creating one. In the meantime we'll need to investigate this redirect issue a bit more. The authentication VBO uses the Utility - HTTP VBO to perform all of the network requests, and that VBO supports redirects by default as it's using the .NET HttpWebRequest client under the wraps.

Do you have Fiddler installed by chance? Just wondering if you could perform a capture of the request and see what the redirect actually looks like? I assume it's just a HTTP response in the 300 range (ex. 301 or 302).

Cheers,

------------------------------
Eric Wilson
Director, Integrations and Enablement
Blue Prism Digital Exchange
------------------------------

RE: UPDATED! Microsoft Graph API for SharePoint

AP.Philippa — Tue, 09 Nov 2021 14:05:00 GMT

Hi @ewilson,

We currently are also experiencing the same error and have logged a ticket for this with Microsoft.

In our situation the majority of our accounts are unable to obtain a token (same AADSTS50126 error), however we also do have some AD accounts that are able to obtain a token (for all: username & password are correct + same Azure tenant).

Do you have any ideas on why we may see differences per AD accounts?

Thanks in advance!

------------------------------
Arthur Philippa
RPA Developer
Port of Rotterdam
Europe/Amsterdam
------------------------------

RE: UPDATED! Microsoft Graph API for SharePoint

ewilson — Tue, 09 Nov 2021 15:03:00 GMT

Hi @AP.Philippa,

If you take a look at the link below you'll see an answer to the question that might help you. From what I understand the accounts, in your environment, that work may have been synchronized through Selective Password Hash Sync.

https://docs.microsoft.com/en-us/answers/questions/385629/aadsts50126-error-validating-credentials-due-to-in-1.html

Cheers,

------------------------------
Eric Wilson
Director, Integrations and Enablement
Blue Prism Digital Exchange
------------------------------

RE: UPDATED! Microsoft Graph API for SharePoint

kgupta — Thu, 28 Apr 2022 14:02:00 GMT

Hello Eric,

Do we have a new MS Graph API Connector that supports file upload larger than 4 MB? I still the one on DX with 4 MB limit.

Thanks,

------------------------------
Kapil Gupta
------------------------------

RE: UPDATED! Microsoft Graph API for SharePoint

ewilson — Thu, 28 Apr 2022 14:08:00 GMT

@kgupta,

The 4MB limit is imposed by the Graph API on the File Upload endpoint. If you have a file larger than 4 MB that you need to upload, you need to use the Microsoft Graph API - SharePoint Upload Sessions object.

https://digitalexchange.blueprism.com/dx/entry/3439/solution/microsoft-graph-api---sharepoint-upload-sessions

Cheers,

------------------------------
Eric Wilson
Director, Integrations and Enablement
Blue Prism Digital Exchange
------------------------------

RE: UPDATED! Microsoft Graph API for SharePoint

SandeepSatish — Tue, 25 Apr 2023 16:21:00 GMT

Hi Eric ,
I am planning to use Microsoft Graph API Sharepoint object. To start with, for all the actions within the object to work is there a list of Azure app permissions that blueprism can share ? Since the tool capability is defined, it would be good to have the capability to permission mapping, it will help for faster set up.

------------------------------
Sandeep Satish
Asia/Kolkata
------------------------------

RE: UPDATED! Microsoft Graph API for SharePoint

ewilson — Tue, 25 Apr 2023 16:29:00 GMT

Hello @SandeepSatish

This is really an organizational specific sort of thing. Different people need different permissions based on their specific use cases. The best approach is to review the available Graph permissions documented by Microsoft at the following link:

https://learn.microsoft.com/en-us/graph/permissions-reference

For SharePoint, you'll be primarily interested in Sites permissions, but you should also pay attention to Files permissions especially if you're looking at working with files on SharePoint.

Cheers,

------------------------------
Eric Wilson
Director, Integrations and Enablement
Blue Prism Digital Exchange
------------------------------