<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle18
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">We’re new to IM and midPoint (version 3.7; 12/18/2017 build) and having some trouble getting started with setting up a Office 365 / Active Directory resource …<o:p></o:p></p>
<p class="MsoNormal"> Our end goal is to be able to provision and maintain (name/password/deactivate) email accounts from midPoint (which will import from an upstream HRIS resource).<o:p></o:p></p>
<p class="MsoNormal"> We have a sandbox environment for o365 with Azure AD and Exchange; We only recently moved to this environment, so new to that as well.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><b>Can anyone provide an example or guidance for using Connect-AzureAD, New-AzureADApplication, New-AzureADServicePrincipal, New-AzureADApplicationKeyCredential for the prerequisites of a o365 resource?<o:p></o:p></b></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Currently we’re stuck on a connection/auth error:<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in">org.identityconnectors.framework.common.exceptions.ConnectorException(Error on get to /tenantDetails?api-version=2013-11-08. Error code: 401 Received the following response {"odata.error":{"code":"Authentication_MissingOrMalformed","message":{"lang":"en","value":"Access
Token missing or malformed."},"date":"2018-02-08T20:33:34","requestId":"24fbe0f4-81d7-4acd-ad52-85c2e9f1cba9","values":null}})<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in"><o:p> </o:p></p>
<p class="MsoNormal">Resource configuration is below, and I’m using the “Office365Connector 1.2.0.0-SNAPSHOT” connector from a pre-compiled .jar I found in the list archives:<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in">ConnId org.identityconnectors.office365.Office365Connector v1.2.0.0-SNAPSHOT<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in"><a href="http://lists.evolveum.com/pipermail/midpoint/2016-June/001995.html">http://lists.evolveum.com/pipermail/midpoint/2016-June/001995.html</a><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The docs refer to older (Connect-MsolService, New-MsolServicePrincipal, Get-MsolServicePrincipal, Add-MsolRoleMember) powershell commands, and not sure how they translate to the newer set of commands for setting up a resource.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Identity Connectors -> “Office 365 / Azure Active Directory Connector”<o:p></o:p></p>
<p class="MsoNormal"> <a href="https://wiki.evolveum.com/pages/viewpage.action?pageId=15433824">
https://wiki.evolveum.com/pages/viewpage.action?pageId=15433824</a><o:p></o:p></p>
<p class="MsoNormal">Resources -> “Office 365 / Azure Active Directory”<o:p></o:p></p>
<p class="MsoNormal"> <a href="https://wiki.evolveum.com/pages/viewpage.action?pageId=15433819">
https://wiki.evolveum.com/pages/viewpage.action?pageId=15433819</a><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> <connectorConfiguration xmlns:icfc="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/connector-schema-3"><o:p></o:p></p>
<p class="MsoNormal"> <icfc:configurationProperties xmlns:gen527="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/bundle/org.forgerock.openicf.connectors.office365-connector/org.identityconnectors.office365.Office365Connector"><o:p></o:p></p>
<p class="MsoNormal"> <gen527:apiEndPoint>graph.windows.net</gen527:apiEndPoint><o:p></o:p></p>
<p class="MsoNormal"> <gen527:tenancy>lab4o365.com</gen527:tenancy><o:p></o:p></p>
<p class="MsoNormal"> <gen527:symetricKey><o:p></o:p></p>
<p class="MsoNormal"> <t:encryptedData><o:p></o:p></p>
<p class="MsoNormal"> <t:encryptionMethod><o:p></o:p></p>
<p class="MsoNormal"> <t:algorithm>http://www.w3.org/2001/04/xmlenc#aes128-cbc</t:algorithm><o:p></o:p></p>
<p class="MsoNormal"> </t:encryptionMethod><o:p></o:p></p>
<p class="MsoNormal"> <t:keyInfo><o:p></o:p></p>
<p class="MsoNormal"> <t:keyName>xxxxxxxxxxxx</t:keyName><o:p></o:p></p>
<p class="MsoNormal"> </t:keyInfo><o:p></o:p></p>
<p class="MsoNormal"> <t:cipherData><o:p></o:p></p>
<p class="MsoNormal"> <t:cipherValue>xxxxxxxxxxxxxxxxxxxx</t:cipherValue><o:p></o:p></p>
<p class="MsoNormal"> </t:cipherData><o:p></o:p></p>
<p class="MsoNormal"> </t:encryptedData><o:p></o:p></p>
<p class="MsoNormal"> </gen527:symetricKey><o:p></o:p></p>
<p class="MsoNormal"> <gen527:authURL>https://accounts.accesscontrol.windows.net/tokens/OAuth/2</gen527:authURL><o:p></o:p></p>
<p class="MsoNormal"> <gen527:principalID>99933698-16ee-4cbd-8eaa-cfbcb476b662</gen527:principalID><o:p></o:p></p>
<p class="MsoNormal"> <gen527:resourceID>00000002-0000-0000-c000-000000000000</gen527:resourceID><o:p></o:p></p>
<p class="MsoNormal"> <gen527:acsPrincipalID>00000001-0000-0000-c000-000000000000</gen527:acsPrincipalID><o:p></o:p></p>
<p class="MsoNormal"> <gen527:immutableIDEncodeMechanism>straight-base64</gen527:immutableIDEncodeMechanism><o:p></o:p></p>
<p class="MsoNormal"> </icfc:configurationProperties><o:p></o:p></p>
<p class="MsoNormal"> </connectorConfiguration><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt">David Westbrook<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt">Sr Application Developer<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt">Catapult Learning, LLC<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>