0

we want to access SharePoint context using Client ID, Client Secret, SharePoint site URL. Existing system we have Client ID, Client Secret, SharePoint site URL, Certificate, Cert Password. But we want to avoid using certification and get SharePoint Context. Is there any other option available to get context using Client ID, Client Secret, SP site URL ? Also, don't want to Register Add-In using the AppRegNew.

1 Answer 1

1

To make calls to SharePoint using the Client Object Model in an app secured by Azure Active Directory, you need to authenticate using a Client ID and a certificate rather than a Client ID and a Client Secret. This is a security restriction enforced by the Client Object Model, there is no way around it.

enter image description here

This restriction is not enforced by Microsoft Graph. You can make calls to SharePoint using Microsoft Graph in an app secured by Azure Active Directory using a Client ID and Client Secret to authenticate. I believe the same is true of the SharePoint REST API, but I'm not 100% sure off top of my head.

enter image description here

You should avoid the use of AppRegNew since it registers the app with Azure Access Control Services (ACS) and not Azure Active Directory. AppRegNew should only be used when building Provider-hosted Add-ins.

2
  • Thanks for quick response Rob. Also I would like to know, is there any specific reason to use certificate when we have client ID client secret ?
    – Srini K
    Feb 22, 2022 at 8:56
  • 1
    From levelup.gitconnected.com/…: A [client] secret is like a plain text password. In a token request, the client transmits the [client] secret without any disguise. Anyone with knowledge of the client id and the [client] secret can impersonate the client. On the other hand, when using a certificate, the client does not transmit the certificate. Rather, the client uses the certificate’s private key to sign the request. Azure AD validates the signature using the public key of the certificate. Feb 22, 2022 at 11:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.