Cli-microsoft365: Add support for authentication using certificate

[waldekmastykarz]

Currently, the Office 365 CLI supports only interactive authentication using device code. To support non-interactive scenarios, such has CI/CD, it would be helpful if it was possible to authenticate using a certificate to support app-only scenarios. When connecting to an O365 service, user can choose which authentication method they want to use.

• [x] implement support for cert-based auth in all services
• [x] implement unit tests

[wictorwilen]

Any work/progress on this one?

[wictorwilen]

Progress is going on here now...

[waldekmastykarz]

💪 All yours

[waldekmastykarz]

Putting back as up for taking. @wictorwilen did some great work for start, but we need to have it implemented consistently for all services rather than just for SPO.

[JakeStanger]

Hi, could somebody explain where I can obtain/generate the relevant certificate file please? Thanks in advance.

[waldekmastykarz]

Which OS are you using @JakeStanger?

[JakeStanger]

Windows 10 on my workstation, CentOS on the build server.

[waldekmastykarz]

This should help you started with Windows: https://blogs.msdn.microsoft.com/richard_dizeregas_blog/2015/05/03/performing-app-only-operations-on-sharepoint-online-through-azure-ad/. Unfortunately, I'm not familiar with CentOS, so can't be of any help there.

[JakeStanger]

Thanks! I believe only the key generation should vary from platform to platform so I'll have a play around and perhaps update the docs if I get it working.

[phillipharding]

This might also help as it offers a way to keygen using an NPM package;

Scroll down to the section "1.1 Backtrack"
Azure Functions, JS and App-Only Updates to SharePoint Online

You can also use OpenSSL to generate signing keys for use with app-only authentication, I've got a bash script for this it you need it
AppOnlyCertificateGenerationWithOpenSSL.sh

[JakeStanger]

Sorry to bring this thread up again but it seems sensible to keep the issue here rather than a new thread. I've granted permissions to my app and installed the certificate, and I'm now getting this error:

Client is public so 'client_assertion' should not be presented.

The app is definitely a web app.

Also, for reference sake there's an official MS doc on this now: https://docs.microsoft.com/en-us/sharepoint/dev/solution-guidance/security-apponly-azuread

[VelinGeorgiev]

@JakeStanger , thanks for reporting that! I will reopen the issue and we will take a look asap.

[waldekmastykarz]

Actually, it would be better to have a separate issue with clear repro steps. @JakeStanger, could you please give us some more information that we can use to replicate the issue ourselves? I'll close this one to avoid confusion.