OAuth Authentication and Authorization to REST API from a Node.js Javascript program

Question

I have a Javascript that retrieves the UserCollection from a Site and does some other things from the REST API. This script runs in my own Node.js server.

Currently, I use HTTP Basic Authentication in the script to login to the SharePoint site and then retrieve my data.

To avoid storing username/password in the script, I looked at using OAuth in the script. If I understand correctly, I have to authorize the script to access the REST API by supplying it the Access Token.

Is my approach correct? If yes, how can I obtain the access token (and by extension, the refresh token)?

It seems like most of the tutorials talk about accessing an App that requires authorization, but in my case it is my script.

Answer 1

This was the exact problem I was facing. This is an old question but my answer might be helpful to someone else coming here.

It is possible to do OAuth from Node.js or any other web-app. Here are the step by step instructions in my blog -

https://medium.com/@yash_agarwal2/performing-oauth-and-rest-calls-with-sharepoint-online-without-creating-an-add-in-677e15c8d6ab#.6pf4wp83b

High Level overview -

1) Get client id and secret by registering yourself here - https://sellerdashboard.microsoft.com/Registration

2) Get Access Token, Refresh Token by following steps here -

https://msdn.microsoft.com/en-us/library/office/jj687470.aspx

Answer 2

You shouldn't pass SharePoint credentials directly.

Instead, what you can do is, define credentials for accessing REST API. The credentials can be used to fetch tokens which should be expired after sometime. And with this token you can call other REST methods to access data from your SharePoint.

If the token is not valid, you can declined the request saying unauthorized request.

Answer 3

For those who are still looking for the answer - consider sp-request nodejs module.

It allows you to perform OAuth client credentials grant (in different terminilogy it's also called addin-only permissions or application only permissions).

For low-trust apps it uses AzureACS in order to obtain an access token, for high-trust apps (server 2 server auth) it uses certificate for access token generation.