Authenticate external user on SPO site to access REST API

Question

I'm currently developing a new product for the company I work for and so far I'm using an App Registration with application permissions with SharePoint REST API access, and this works great but requires admin consent, which not every company really likes to give. Especially since there is no way to only give permissions to a specific site collection. But this is a different rant entirely.

I've been looking for other ways to consume the SPO REST API and came across the STS login endpoint which is explained here. This however only works with either users from the same tenant or requires sharing access to external users to be enabled on the root site, and returns a 403 if it's not enabled. Again, something that requires admin interaction, etc...

I've noticed however that logging in to the specific site my external user has access to within the browser does set the FedAuth- and rtfa-cookies. Querying the SPO REST API from the browser or Postman with these cookies works fine. I tried finding out how the login process works in the browser through the dev tools and network traffic, but unfortunately this isn't something I could figure out.

My question is then, 'Is it possible to obtain these cookies programmatically without enabling sharing for external users on the root site?'

Additionally I would like to add that not requiring admin/IT-department interaction is important for us since this would be a big obstacle to simply quickly test our product. So options like 'requesting the customer to create new user with access to the required sites' or 'just have them consent to the App Registration application permissions' are not options we can use.

I have also tried the .NET Framework Microsoft.SharePointOnline.CSOM NuGet-package with 'SharePointOnlineCredentials(username, pwd)' within a context, which also doesn't work and returns a 403.

Another option that wouldn't work for us is one of the currently supported login methods using oauth with microsoft identity, like the OBO-flow, since this would require the user to log in again every few weeks/months (max 90 days) until which the product would just stop working for them. Another drawback here is the requirement of the tenant id for most login attempts which, again, would be a barrier for entry.

Answer 1

There's another way you can enable consuming and modifying SharePoint data. You can use Power Automate (https://flow.microsoft.com) to create a flow with an HTTP trigger and then the first action is to make an HTTP call to SharePoint. The flow then makes the call to SharePoint using the credentials of the author of the flow. This creates a URL that your third-party app can make a call to and it will have access to your SharePoint data.