How to get SSL/TLS digital signature certificate of sharepoint site hosted on Azure Cloud

Question

How to get SSL/TLS digital signature certificate of sharepoint site hosted on Azure Cloud

Anonymous

Hello,

I am developing a SAP application and I wanted to access the files stored in SharePoint site via Microsoft Graph APIs. When I am trying to get the access token first, I am getting the error as no trust relationship is maintained in SAP to access the SharePoint URL.

This means and MS SharePoint SSL/TLS certificate is not in the certificate list of the SAP, so I need to export the SharePoint SSL/TLS signing certificate and import it into SAP.

Can you please suggest how to get the certificate required here from Sharepoint/Office 365 hosted on Azure Cloud?

Thanks,
Mainak

Ryan Hill 30,281 Reputation points Microsoft Employee Moderator

2022-07-11T22:28:56.723+00:00

What error are you getting @Anonymous ? How are you calling the Graph API? Why not just use the SDK? Is your SAP application using an app registration?
Anonymous

2022-07-12T05:47:17.963+00:00
Hi @Ryan Hill ,

When I am sending the HTTP post to the URL https://accounts.accesscontrol.windows.net/{TenantID}/tokens/OAuth/2 to get access token, I am getting the error as shown in image below.

I am developing the application in ABAP programming language and no SDK is available for that.

Yes, I registered my SAP application first to the MS SharePoint Site using the following URLs.

App Registration : https://{TenantName}/teams/{SiteName}/_layouts/15/appregnew.aspx
App Permission : https://{TenantName}/teams/{SiteName}}/_layouts/15/appinv.aspx
Get Authorization Code: https://{TenantName}.sharepoint.com/sites/{SiteName}/_layouts/15/OAuthAuthorize.aspx?
client_id={ClientID}
&scope=Web.Manage
&response_type=code
&redirect_uri={RedirectURI}

The above steps were done outside SAP and at the SharePoint end. Now next step was to get the access token and I am getting the above error during that time.

Thanks,
Mainak

Ryan Hill 30,281 Microsoft Employee Moderator

Are you obtaining the token through method indicated on https://learn.microsoft.com/en-us/sharepoint/dev/solution-guidance/security-apponly-azureacs?

   using Microsoft.SharePoint.Client;  
   using System;  
     
   namespace AzureACSAuth  
   {  
       class Program  
       {  
           static void Main(string[] args)  
           {  
               string siteUrl = "https://contoso.sharepoint.com/sites/demo";  
     
               //Get the realm for the URL  
               string realm = TokenHelper.GetRealmFromTargetUrl(new Uri(siteUrl));  
     
               //Get the access token for the URL.    
               string accessToken = TokenHelper.GetAppOnlyAccessToken(TokenHelper.SharePointPrincipal, new Uri(siteUrl).Authority, realm).AccessToken;  
     
               //Create a client context object based on the retrieved access token  
               using (ClientContext cc = TokenHelper.GetClientContextWithAccessToken(siteUrl, accessToken))  
               {  
                   cc.Load(cc.Web, p => p.Title);  
                   cc.ExecuteQuery();  
                   Console.WriteLine(cc.Web.Title);  
               }  
           }  
       }  
   }

I'm not a SharePoint dev but having to retrieve SSL cert to access Graph is very unfamiliar to me, something I've never heard of. That's what the bearer token is for.

Anonymous

2022-07-18T12:48:58.3+00:00
@Tong Zhang_MSFT

Many thanks for providing more details to this. When I checked the reference URLs, I had the following questions

Currently as per the steps mentioned in https://learn.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app
if I register an app in Microsoft AD, it seems the scope will be for all the SharePoint site. But instead, I would like the external application to have access to a particular site. How this can be achieved here? In Azure Access Control it would have been possible as per https://learn.microsoft.com/en-us/sharepoint/dev/solution-guidance/security-apponly-azureacs

The below URL asking about adding certificate for an external application. But will it be required to add the SharePoint site certificate to the external application. Actually in SAP, in order to access an external provider the SSL trust certificate needs to be setup.

https://help.sap.com/doc/saphelp_nw75/7.5.5/en-US/2e/5104fd87ff452b9acb247bd02b9f9e/frameset.htm
https://learn.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app

1 answer

Your answer

Ryan Hill 30,281 Reputation points Microsoft Employee Moderator

2022-07-11T22:28:56.723+00:00

What error are you getting @Anonymous ? How are you calling the Graph API? Why not just use the SDK? Is your SAP application using an app registration?
Anonymous

2022-07-12T05:47:17.963+00:00

Hi @Ryan Hill ,

When I am sending the HTTP post to the URL https://accounts.accesscontrol.windows.net/{TenantID}/tokens/OAuth/2 to get access token, I am getting the error as shown in image below.

I am developing the application in ABAP programming language and no SDK is available for that.

Yes, I registered my SAP application first to the MS SharePoint Site using the following URLs.

App Registration : https://{TenantName}/teams/{SiteName}/_layouts/15/appregnew.aspx
App Permission : https://{TenantName}/teams/{SiteName}}/_layouts/15/appinv.aspx
Get Authorization Code: https://{TenantName}.sharepoint.com/sites/{SiteName}/_layouts/15/OAuthAuthorize.aspx?
client_id={ClientID}
&scope=Web.Manage
&response_type=code
&redirect_uri={RedirectURI}

The above steps were done outside SAP and at the SharePoint end. Now next step was to get the access token and I am getting the above error during that time.

Thanks,
Mainak
Ryan Hill 30,281 Reputation points Microsoft Employee Moderator

2022-07-12T18:54:01.323+00:00

Are you obtaining the token through method indicated on https://learn.microsoft.com/en-us/sharepoint/dev/solution-guidance/security-apponly-azureacs?

using Microsoft.SharePoint.Client; using System; namespace AzureACSAuth { class Program { static void Main(string[] args) { string siteUrl = "https://contoso.sharepoint.com/sites/demo"; //Get the realm for the URL string realm = TokenHelper.GetRealmFromTargetUrl(new Uri(siteUrl)); //Get the access token for the URL. string accessToken = TokenHelper.GetAppOnlyAccessToken(TokenHelper.SharePointPrincipal, new Uri(siteUrl).Authority, realm).AccessToken; //Create a client context object based on the retrieved access token using (ClientContext cc = TokenHelper.GetClientContextWithAccessToken(siteUrl, accessToken)) { cc.Load(cc.Web, p => p.Title); cc.ExecuteQuery(); Console.WriteLine(cc.Web.Title); } } } }

I'm not a SharePoint dev but having to retrieve SSL cert to access Graph is very unfamiliar to me, something I've never heard of. That's what the bearer token is for.
Anonymous

2022-07-18T12:48:58.3+00:00

@Tong Zhang_MSFT

Many thanks for providing more details to this. When I checked the reference URLs, I had the following questions

Currently as per the steps mentioned in https://learn.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app
if I register an app in Microsoft AD, it seems the scope will be for all the SharePoint site. But instead, I would like the external application to have access to a particular site. How this can be achieved here? In Azure Access Control it would have been possible as per https://learn.microsoft.com/en-us/sharepoint/dev/solution-guidance/security-apponly-azureacs

The below URL asking about adding certificate for an external application. But will it be required to add the SharePoint site certificate to the external application. Actually in SAP, in order to access an external provider the SSL trust certificate needs to be setup.

https://help.sap.com/doc/saphelp_nw75/7.5.5/en-US/2e/5104fd87ff452b9acb247bd02b9f9e/frameset.htm
https://learn.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app

Answer 1

Hi @Anonymous ,

As far as I know, if you want to get access token for Graph API, you should post to the URL https://login.microsoftonline.com/{TenantID}/oauth2/token , please re-retrieve the access token and check if the problem exists .Hope it can help you. Thanks for your understanding.

More information for reference:
https://dzone.com/articles/getting-access-token-for-microsoft-graph-using-oau
https://jd-bots.com/2021/04/19/how-to-get-azure-access-token-using-postman-for-microsoft-graph-api/

Note: Microsoft is providing this information as a convenience to you. The sites are not controlled by Microsoft. Microsoft cannot make any representations regarding the quality, safety, or suitability of any software or information found there. Please make sure that you completely understand the risk before retrieving any suggestions from the above link.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Tong Zhang_MSFT 9,251 Reputation points

2022-07-21T08:31:26.173+00:00

Hi @Anonymous ,

According to your description , the first question ,since this issue is about azure active directory, I suggest you create a new Azure AD case in the following forum, more professional will help you.

Forum: azure-active-directory

The second question, according to my research ,this question is about SAP, due to our limitation for SAP technology, I suggest you can consult SAP support, more professional will help you.

Thanks for your understanding.

Share via

How to get SSL/TLS digital signature certificate of sharepoint site hosted on Azure Cloud

1 answer

Your answer