office-jsazure-ad-graph-apioutlook-web-addinsoffice-js-helpers

Outlook web add-in calling Microsoft Graph


I'm following office-js-helpers to enable SSO login, and then use the access token to call Graph API.

But, Authentication will open the login windows in a new tab even I have added in manifest.xml

<AppDomain>https://login.windows.net</AppDomain>
<AppDomain>https://login.microsoftonline.com</AppDomain>

Current Result.
enter image description here

Edit:
For SSO login, should it be redirected in the Outlook add-in instead of open a new Web Browser window?

Here is the demo project OutlookOneDriveGraphAddIn.

I want to enable graph api in my Outlook web addin, graph api will need login process, I want to be able request access token in my web addin.

If there is anything unclear, please let me know.


Solution

  • There are 2 questions here.

    Question #1: For SSO login, should it be redirected in the Outlook add-in instead of open a new Web Browser window?

    It should not be redirected in the Office add-in, for the very simple reason that this is against OAuth. With OAuth authentication, you'll have to show user the URL - otherwise you can spoof a UI which looks similar to Microsoft login in your add-in and steal people's credentials. Obviously this is not secure. So instead, when you call the getAccessTokenAsync it should pop-up a dialog, if the user is not signed in. Signing in is handled by Microsoft, which afterwards, the token becomes available through the same method getAccessTokenAsync.

    Question #2: How do I get the access token from my add-in?

    Refer to the documentation here: https://learn.microsoft.com/en-us/office/dev/add-ins/develop/sso-in-office-add-ins#add-client-side-code

    Office.context.auth.getAccessTokenAsync(function (result) {
        if (result.status === "succeeded") {
            // Use this token to call Web API
            var ssoToken = result.value;
            ...
        } else {
            if (result.error.code === 13003) {
                // SSO is not supported for domain user accounts, only
                // work or school (Office 365) or Microsoft Account IDs.
            } else {
                // Handle error
            }
        }
    });