I used this SharePoint OAuth Article from Microsoft to get the authorization code grant flow working with a SharePoint site. The idea is to get the access token dynamically from an external app (and not from within an Add-in installed within SharePoint) - something which the article also declares as being possible to achieve.
In some scenarios, an add-in can request permission to access SharePoint resources on the fly; that is, an add-in can request permission to access SharePoint resources dynamically at runtime, instead of at add-in installation time. This type of add-in doesn't have to be launched from, or even installed on, SharePoint. For example, it could be a native device add-in, an add-in that is launched from any website, or an Office Add-in launched from an Office application that wants to access resources on SharePoint on the fly.
The token will then be used a bearer to create a ClientContext and consume the Sharepoint CSOM Library (Client Object Model).
The Authorization code grant flow requires a Client ID, Client Secret and Redirect URI - this Register SharePoint Add-ins link contains information on how to register an Add-In and supposedly get these settings. Initially, I had missed this link and assumed SharePoint would work similar to most other services, i.e. requiring an App Registration within the Azure Active Directory (of course within the same organisation as SharePoint Online). So I created an App Registration in Azure AD, and lo and behold, when running the solution from Visual studio, thereby having a URL that looks like this - https://localhost:44307/SPHandler, I got the access token and the ClientContext also worked as expected with the rest of the CSOM methods.
Yet when I hosted the solution and gave it a DNS name - https://domain.com/SPHandler, the process gets as far as allowing you to insert your Azure AD credentials but then redirects into this error.
Then I did some more digging and found the "Register SharePoint Add-ins" link. It seems that the Azure AD App Registration is never actually mentioned in the documentation. I followed the instructions and created the registration within the "AppRegNew.aspx" page. This gave me a ClientID and ClientSecret, I could register 1 domain and 1 redirect URI, as well as set the XML permissions for the app.
However, in this case, the authorization code is not received and instead this error is popping up within the response from the server-side.
https://localhost:44307/SPHandler?error=server_error&error_description=The remote server returned an error: (500) Internal Server Error.&state=4W9HXEH1KRZA&IsDlg=1}
- The ultimate question - what is the proper way to register an App for SharePoint OAuth with Azure AD Users?
- Why did I actually get further when "mistakenly" trying to use an Azure AD App Registration (at least it worked in localhost!) than when trying with an app registered in "AppRegNew.aspx" ?
- And finally - is there any place within SharePoint Online where I can see more information regarding the internal server error?