Applications defined in Azure AD are allowed to make app-only calls by sharing a certificate with Azure AD. Azure AD will get the public key certificate and the app will get the private key certificate. Although a trusted certificate should be used for production deployments, makecert/self-signed certificates are fine for testing/debugging (similar to local web debugging with https). Here are the steps to generate a self-signed certificate with makecert.exe and exporting it for use with Azure AD.

Part 1: Generate a Self-signed Certificate

  1. Open Visual Studio Tools Command Prompt.

    Note: for Windows 10 you may have to download the Windows 10 SDK to get the makecert application.

  2. Run makecert.exe with the following syntax:

    makecert -r -pe -n "CN=SearchTechnologies SPOnline Cert" -b 10/15/2016 -e 10/15/2018 -ss my -len 2048
  3. Run mmc.exe
  4. Go to File → Add/Remove Snap In
  5. Add Certificates → My User Account
  6. Locate the certificate from step 2 in the Personal certificate store
  7. Right-click and select All tasks >> Export
  8. Complete the Certificate Export Wizard twice: once with the private key (specify a password and save as .pfx) and once without the private key (save as .cer)

Part 2: Create the Azure AD Application

  1. Log into the Azure Management Portal for your Office 365 tenant.
  2. Go to the Azure Active Directory tab and select App Registrations.
  3. Select "New Registration".
  4. On "Supported account types" select "Accounts in this organizational directory only ".
  5. On "Redirect URI" select Web.
  6. Enter a Sign-on URL (the value of this doesn’t really matter other than being unique) and click "Register".
  7. Look for your new application on the Registered Applications list and click it.
  8. Go to API Permissions and click on "Add a permission".
  9. On the "Select an API" section, add the "SharePoint" application
  10. Select "Application Permissions" and check the following permissions:
    1. TermStore.Read.All: Read Managed Metadata.
    2. Sites.FullControl.All: Have Full Control of all Site Collections.
    3. Sites.Read.All: Read Items in all Site Collections.
  11. Click on "Add permissions".
  12. After saving you have to click "Grant admin consent" to apply the changes.
On the Configure section you'll also see the Application ID. Copy and save this ID, you are going to need it when configuring the connector.

Part 3: Configure certificate public key for App

  1. Go to "Certificates and secrets".
  2. Click on "Upload certificate".
  3. Select the certificate created on Part 1.
  4. Add the certificate.

Part 4: Generate Private Key

You may need to download OpenSSL for Windows to follow these steps.

  1. Extract pem key

    openssl pkcs12 -nocerts -in <PFX Path> -out <PEM Path>

  2. Convert extracted pem key to der format

    openssl pkcs8 -topk8 -inform PEM -outform DER -in <PEM Path> -out <DER Path> -nocrypt
  • No labels