Microsoft Graph API
Curious if anyone has been able to create a connection for the MS Graph API. I've set up a client access id and secret that I've been able to successfully use from PostMan to access Graph. At present, I've proven that I can use it to do simple things like send emails via Graph, and would like to incorporate that kind of functionality into some of my flows. I've been unsuccessful in setting up a connection in Celigo, though, and am looking for a little guidance.
0
Comments
Wanted to add some additional content here. I recently did some work with the Graph API and had to create an HTTP connection.
Here is a video of that process that includes
Additionally, here is a link to screenshots of the setup within integrator if you already have all the needed information from Azure.
Hi Wade Shelton,
I'd love to get you some guidance on this, but a few more details will help. Which type of connector are you configuring in integrator.io? (For example, we have app connectors for Microsoft Outlook, Microsoft Teams, etc. We also have universal connectors, such as the REST API connector.) Could you also let us know what error(s) you're receiving please?
Thanks,
Kate -
I've tried the REST and HTTPs connector. I don't *think* the application specific connectors (teams, outlook, etc...) would be of much benefit here.
The Graph API uses bearer token authentication, where the token is retrieved by authenticating against a tenant-specific URL. Here's an example of what the C# for authenticating looks like, as generated by PostMan:
The API returns the bearer token, as expected, via the JSON body:
In Postman, I can then use that Bearer to authenticate to the Graph API and send a message like so:
I've tested the above in Postman, and it does successfully trigger an email to all recipients with a plain text file attachment containing "Hello World!"
What I can't figure out is the following:
Either way - just curious if anyone else has tried this yet. But... I might suggest to Celigo that this could be a really nice feature to enable in-flow notifications...
Thanks, Kate. I'm still working with it. I found an article on a competitor's site showing a Graph integration, so I'm trying to draw parallels to Celigo.
Hi Wade Shelton,
odata.type] - should be sent in the above format in the Import field mapping to send the data accurately.
connection/oauth2callback ) should be added in the corresponding OAuth app.
I can see that you're using Send user's mail operation.
Here are a few things you can try:
1 . Connecting via Microsoft Outlook Mail connector:
In the Microsoft Outlook Mail connector import, we have - Send user's mail operation under Message resource. We have a hosted OAuth app for Microsoft Outlook Mail and you just need to select the appropriate scopes and Save & Authorize using your Outlook mail account. Once you create a connection, you can create an import with Message resource and select Send user's mail operation, and provide mappings in the following format: message.attachments[*].[@
2. Connecting via generic HTTP adaptor:
Additionally, you can also connect via HTTP adaptor, if you want to use your own OAuth app credentials. To Create an HTTP connection for Microsoft Graph via OAuth 2.0, populate the fields in the following way:
Replace tenantId with your Azure tenant ID. And Scopes are delimited with space.
Note: To create a successful connection, integrator IO callback URI(https://integrator.io/
Feel free to reach out in case of any further queries!
Thank you!
Hi Wade,
For Azure, I would recommend to kindly try our Azure Active Directory Connector.
https://docs.celigo.com/hc/en-us/articles/360038618172-Set-up-a-connection-to-Azure-Active-Directory
Srilekha -
The Outlook Mail connector has the same issues as the AAD connector. It doesn't appear to allow for registered application connections (i.e - OAUTH authentication of an application using a client ID/secret, instead of a username/password). If it did, I'd love to use it for this purpose. Interesting that it doesn't, since the base URI in the connector does show that it's using graph.microsoft.com.
I posted screenshots before, but here are updated ones of the HTTP connector setup.
I have verified that the client ID and secret that I'm using work by using Postman. One thing to note - the error message I'm receiving says that the method isn't supported. I'm unable to chose the method/Verb on the HTTP connector (POST, GET, PUT, etc...). Per MS Documentation (https://docs.microsoft.com/en-us/graph/auth-v2-user) they suggest using POST. Can you confirm what the HTTP Connector is using?
Thanks for the details, Wade Shelton!
For Microsoft Outlook Mail Connector, we do have a hosted OAuth application in the backend. So that users don't have to worry about creating an OAuth application and maintaining it. Connectors are more user-friendly and I would recommend you to give it a try.
Concerning the HTTP connection part, can you please check what you're giving in the How to test this connection sub tab? The ping method should be "GET" just to ping and get your connection working. POST method will be applied from the backend while hitting the "Access Token URL".
Let me know if you face any further issues.
Thanks!
Srilekha -
That's good to know about the connectors, but how does authentication occur? Is it user-specific? In other words, if I set it up under a user account, and that user account is disabled, does my flow stop working? That's one of the reasons I was pursuing the HTTP route with client ids, so if your OAUTH is somehow negotiating client id creation in the background, I may consider it.
The tip on the PING method did the trick. My HTTP connector is now online. Thanks!
Srilekha -
I'm not sure if I follow.
I understand that the backend application is creating a client id and secret, but is that occurring on behalf of the authorizing user? OAUTH supports the creation of IDs and Secrets to authenticate either a user or an application. Normally, to authenticate an application, you have to register it, first (which I did in AAD).
When you ask if Celigo will be able to login or make API calls to the account if the user is disabled, that's why I'm trying to determine whether Outlook connector is creating OAUTH keys for the user, or for the application. If they're for the user, then I would assume the keys would be invalidated if the user is disabled(?). If so, then that's a reason to use the HTTP connector with the client id/secret associated with the registered application.
On the HTTP Connector authentication: I've enabled debugging on the HTTP connector. Here is the POST from Celigo:
Here is the error:
Here is the same message being sent to the same endpoint using the same ID/secret, but through Postman instead of Celigo. Here, I get a successful response (202 Accepted) and the email is sent.
Thanks for the details, Wade Shelton!
Reg the connector part: We don't create client IDs and secrets for each user login. We have fixed application details. As you said "Normally, to authenticate an application, you have to register it", we have registered the application in the Azure portal in the same way and added the client Id and secret as fixed values in the outlook connector. So, the client Id and the secret will be the same irrespective of the user login.
I hope that answers your question.
Coming to that HTTP Access denied error, are you using any additional scopes in the postman apart from the ones specified in the HTTP connection? It can be due to some missing scope.
Either way, If you're still not clear on the above queries, we can set up a call to discuss the same.
Thank you!
Srilekha -
OK. Thank you for clarifying. My concern was that, if the authorizing user account were disabled in Azure Active Directory, the connector would no longer function. If that's not the case, then I can look deeper.
There are two things that are interesting here, and why I was asking if the connection was specific to the authorizing user:
Hi Wade Shelton,
Can you please confirm if you're using this process in your postman? - https://docs.microsoft.com/en-us/graph/auth-v2-service
If yes, how are you performing - 3. Get admin consent step?
If no, could you please link us to the docs which you're following for establishing a connection via postman?
Also, what is the cookie parameter you're using while fetching the token?
We are basically trying to understand the difference between the postman and HTTP connection.
Thanks!
Srilekha -
I'm not explicitly performing the Get Admin Consent step inside of Postman.
I've set up an Azure Application Registration similarly to the information here. You have to be an Admin to do this (and, so, consent is provided). These aren't the articles I used to actually set this up, but they show the same process. The app registration in Azure Active Directory serves as a predefined container for permissions/scopes against the selected application (in this case Graph), and using a specified set of credentials (predefined secret/client_id).
https://jatindersingh81.medium.com/send-email-using-microsoft-graph-api-using-c-a838d128bb27.
https://docs.wpo365.com/article/108-sending-wordpress-emails-using-microsoft-graph
https://adamtheautomator.com/azure-send-email/#Using_Microsoft_Graph_API_to_Send_Azure_Email
At that point, all that is required is to obtain the bearer token for the request. I'm doing that in a PostMan pre-request script as follows. The variables "Auth_URL", "client_secret" and "client_id" are all set up as collection variables. The rest are set up as environment variables.
After obtaining the token, I'm just using it in the request:
The actual body of the request is as follows:
{
Hi Wade Shelton,
Thanks for the details!
From the link that you've provided(https://adamtheautomator.com/azure-send-email/#Using_Microsoft_Graph_API_to_Send_Azure_Email), I tried out one connection config. Can you please try out the below connection and test your flow?
Also, from one of the links I can see one scope parameter added (scope = "https://graph.microsoft.com/.default"), while fetching the access token. Are you using that in your postman configuration?
Here's one connection configuration as per the above link,
Let us know if you're able to integrate with this connection configuration.
Thanks for patiently working with us!
Srilekha
Apologies, but I had some issues that I had to work on last week.
I did try to set this up in .io, but as of yet, have not had a successful connection. I'm still working on troubleshooting, but will try to post screenshots later.
Hi Anuj kumar Maurya,
Are you using the same configuration as above? (i.e - Grant type - client_credentials)
Most of the time for OAuth 2.0 connections, the refresh mechanism is handled under the hood. We might need some further details to debug why it is failing. Please do share the connections details by hiding the sensitive info.
Thank you!
Wade Shelton I have a graph api connection working and here is my config. The marked out part of the url is your tenant id. You may need to provide additional scopes, but I used the app default and set offline_access. The offline_access scope I believe has to be there so we get refresh tokens.
Please sign in to leave a comment.