Skip to main content

ARIS Technical Help

Enable OAuth via Microsoft® Entra ID
Register ARIS document storage application with Microsoft® Entra ID

For details on the renaming of Microsoft® Azure AD to Microsoft® Entra ID please refer to the article New name for Microsoft® Azure Active Directory.

We use the Microsoft® Azure portal to register an application to be used as the Microsoft® Entra ID mechanism which will make use of Microsoft® Graph APIs.

Prerequisite

  • ARIS is installed and running.

  • A license is required for the Microsoft® SharePoint: ARIS Connect server Extension pack DMS Adapter MS SharePoint TEN 1000.xml.

Procedure. Procedure

  1. Navigate to https://portal.azure.com/#home.

    Entra ID

  2. Click App registrations.

    New registration

  3. Click Create New registration.

    New application

  4. Provide a name for the Microsoft® SharePoint application.

  5. Click Register.

  6. When the application is registered, copy the client credential details to a text file and save the text file.

Get the client ID and the client secret for ARIS document storage in Microsoft® Entra ID

Prerequisite

  • ARIS is installed and running.

  • A license is required for the Microsoft® SharePoint: ARIS Connect server Extension pack DMS Adapter MS SharePoint TEN 1000.xml.

Procedure. Procedure

  1. Open the App registrations page for your Microsoft® SharePoint application in Microsoft® Entra ID.

    Get client ID and client secret

  2. Navigate to Certificates & secrets to generate the client secret.

    Generate client secret

  3. Click Add New client secret. The Add a client secret panel opens.

    Add client secret

  4. Click Add. The name of the application is provided and the client secret is generated.

    Add client secret

  5. Copy the client secret and save it in a text file.

The client secret is necessary to generate the access token.

Grant permissions in Microsoft® Entra ID

Prerequisite

  • ARIS is installed and running.

  • A license is required for the Microsoft® SharePoint: ARIS Connect server Extension pack DMS Adapter MS SharePoint TEN 1000.xml.

Procedure. Procedure
Grant permissions

  1. Provide the following permissions for accessing the Microsoft® SharePoint data.

  2. Click Add Add a permission.

    Microsoft® Graph

    The panel is displayed.

  3. Under Microsoft® APIs section, select Microsoft Graph.

  4. Select Application Permissions. The panel is displayed.

    API permission 2

    Grant at least Read permission. Search for the permission Sites.Selected.

    Sites selected

  5. Click Grant admin consent and click Yes.

    Next you need to create another application registration to grant the minimum permission to the required site collection only.

  6. Create a new application registration by following the same steps as above up to permission assignment.

  7. Search for the permission Sites.FullControl.All.

    API permission 2

  8. After completing the required steps, follow the procedure below to grant permission to the site collection from Admin. Grant Sites.FullControl.All.

  9. Click Grant admin consent and click Yes.

    Grand site full control
Assign permission via Microsoft® Graph API

You need to generate an access token for accessing Microsoft® Graph API.

Prerequisite

  • ARIS is installed and running.

  • A license is required for the Microsoft® SharePoint: ARIS Connect server Extension pack DMS Adapter MS SharePoint TEN 1000.xml.

Procedure. Procedure

  1. Invoke Microsoft® Graph API.

  2. To generate an access token, go to postman REST client.

  3. Invoke the login endpoint to get the access token. The login endpoint is of the following structure:

    POST https://login.microsoftonline.com/<tenantId>/oauth2/v2.0/token

    You find the tenant ID on the application registration page.

    Tenant ID

  4. In the headers, provide the content type as application/x-www-form-urlencoded

  5. In the Body section, select the x-www-form-urlencoded section, and fill in the following details

    • client_id - Generated in the Admin Application Registration page.

    • client_secret - Generated in the Admin Application Registration page

    • scope - https://graph.microsoft.com/.default

    • grant_type - client_credentials

  6. Once you have entered these details, click the endpoint to generate the access token.

    Generate access token

  7. Use the above token marked as accessToken and invoke the Permission API.

  8. Add the authorization header as bearer "eyz..." in all the requests.

    Add authorization header

  9. In the Permission API, assign permissions to the required site collections:

    https://graph.microsoft.com/v1.0/sites/{{site-id}}/permissions

  10. To get the site ID, invoke sites/API.

  11. Get All Sites.

    https://graph.microsoft.com/v1.0/sites/

  12. From the above API, you get the list of available site collections, and you can copy the site collection ID that meets your requirements.

    Permission endpoint

  13. When you have the site ID, invoke the assign permission endpoint.

    For the application property you need to provide the client ID of the Sharepoint Application Registration (registered with the permission Sites.Selected).

    Assign Site Permission 

    https://graph.microsoft.com/v1.0/sites/{{site-id}}/permissions

    Payload 

    {
"roles": [
"read"
],
"grantedToIdentities": [
{
"application": {
"id": "0d4eb394-f7c3-4904-a920-8f9cdb30d904",
"displayName": "sharepoint"
}
}
]
}

    If the invocation was successful, you receive the following response:

    Site permissions
Grant maximum level of full control permissions

This step does not require an additional application registration.

Prerequisite

  • ARIS is installed and running.

  • A license is required for the Microsoft® SharePoint: ARIS Connect server Extension pack DMS Adapter MS SharePoint TEN 1000.xml.

Procedure. Procedure

  1. Search for the following permissions:

    • Files.ReadWrite.All

    • Sites.ReadWrite.All

  2. Click Grant admin consent for (...) and click Yes.

    Grant admin consent

When the Microsoft® Azure application was registered and the permissions were granted, you can configure the Microsoft® Sharepoint adapter in ARIS document storage.

Configure Microsoft® Entra ID in ARIS document storage

Prerequisite

  • ARIS is installed and running.

  • A license is required for the Microsoft® SharePoint: ARIS Connect server Extension pack DMS Adapter MS SharePoint TEN 1000.xml.

Procedure. Procedure

  1. Open ARIS and log in with your user name and password.

  2. Click Application launcher Application launcher > Administration Administration. Configuration Configuration is displayed.

  3. Click the arrow next to Document management system.

  4. Click General settings.

  5. Click Edit Edit.

  6. Enable Use third-party document management system.

  7. Optional: If you want to use more than one third-party document management system, enable Support for multiple document management systems.

  8. Click Save Save.

  9. Click New/Add Add. The Add document management system server dialog opens.

    Configure MS Entra ID in ARIS

  10. Enter the required details such as the client ID and client secret which were generated as part of the application registration steps in Microsoft® Azure.

  11. Click Save.

    If everything is configured correctly, the following is displayed.

  12. Click Test connection Test connection.

    MS Entra ID configured