OAuth settings
Use the following fields to configure the OAuth settings for your mailbox. User name and Protocol fields are populated from the Mailbox settings window.
-
If the computer on which KC Plug-In is installed is running under a proxy, configure the
Proxy settings.
Note When using MS Graph with Resource Owner Password Credentials grant type, configure these in the Message Connector Configuration tool.
Field name Description Proxy server address IP address or host name of the local proxy server. If this field is empty, local proxy server will not be considered to contact the OAuth authorization server. For Microsoft Exchange Online, this is Microsoft Azure Active Directory.
User name User name of the proxy server.
Password Password to connect to the proxy server.
-
Configure the following OAuth settings.
Setting Description Authorization server Select the required OAuth authorization server.
For MS Graph, authorization server is always MICROSOFT.
Manage Click this to add, edit or delete authorization servers using the Manage authorization servers window. Grant type Select the required grant type:
-
Resource Owner Password Credentials: This option is only available for MS Graph.
-
Authorization Code: This is available for IMAP, POP3 and MS Graph.
-
Client Credentials: This is available for MS Graph.
Authorization endpoint URL The URL to get an authorization code from the authorization server.
When you select an authorization server, this field is populated from the authorization server settings configured using the Manage authorization servers screen. You can also modify the populated value.
This is not required when Grant type is Client Credentials.
Token endpoint URL The URL to get the OAuth tokens, such as, access token, its expiry time.
When you select an authorization server, this field is populated from the authorization server settings configured using the Manage authorization servers screen. You can also modify the populated value.
Scopes Scopes are the access permissions to access specific resources. For example read access to user’s mailbox, read/write access to user’s mailbox.
When you select an authorization server, this field is populated from the authorization server settings configured using the Manage authorization servers screen. You can also modify the populated value.
Tenant ID Enter the directory/tenant ID which is generated while creating the tenant in Microsoft Azure Active Directory. Client ID or Application ID Enter the Client ID or Application ID which is generated after registering the application in Microsoft Azure Active Directory. Client secret Enter the secret string which is generated in the Certificates and secrets section of your application in Microsoft Azure Active Directory. KC Plug-In uses this secret string to prove its identity at the Azure application level when requesting a token. Redirect URI Enter the redirect URI configured in your Azure Active Directory of your application. The redirect URI specified here must be the one selected in your application in Microsoft Azure Active Directory. You can also specify a custom URI created in Microsoft Azure Active Directory application.
Note-
This field is applicable only for Authorization code grant.
-
If you want to provide Redirect URI created for Web platform inside Azure portal, then it is mandatory to provide Client Secret.
-
If you want to provide Redirect URI created for Mobile/Desktop platform inside Azure portal, then Client Secret must be left blank.
Authorize Click this button to send all the configured input values to the OAuth authorization server and receive the respective OAuth tokens from it.
Note the following
-
Resource Owner Password Credentials: This option is not available.
- Authorization code: Clicking the Authorize button displays a custom browser pop-up for specifying the mailbox user credentials. On a successful validation, server returns the respective OAuth tokens. A successful login message is displayed.
-
Client Credentials: Clicking the Authorize button sends all the configured input values to the OAuth authorization server. On a successful validation, server returns the respective OAuth tokens. A successful login message is displayed.
-
Following table summarizes the grant types and their respective configuration.
| Client Credentials grant | Authorization Code grant | Resource Owner Password Credentials grant | |
|---|---|---|---|
| MS Graph | Supported | Supported | Supported |
| IMAP over OAuth | Not Supported | Supported | Not Supported |
| POP3 over OAuth | Not supported | Supported | Not Supported |
| Authorization endpoint URL | NA | Mandatory | NA |
| Token endpoint URL | Mandatory | Mandatory | NA |
| Scopes value in Configure OAuth screen | Mandatory | Mandatory | NA |
| Configuration of API permissions in Azure portal | Mandatory | Mandatory | Mandatory |
| Tenant ID | Mandatory | Mandatory | Optional |
| Client ID | Mandatory | Mandatory | Mandatory |
| Client Secret | Mandatory | Optional (based on Redirect URI Platform) | Optional
If Default client type is set to YES, then do not specify the Client secret. Else, Client secret is mandatory. See Configure Default client type in Azure. |
| Redirect URI | NA | Mandatory | NA |
| Username | Mandatory | Mandatory | Mandatory |
| Password value in KC Plug-In | NA | NA | Mandatory |
| Mailbox password change impact | NA | Authorize again in KC Plug-In | Update new password in KC Plug-In |
| Login using a popup window | NA | Mandatory | NA |
| Authorization level | Application level | User level | User level |
| Proxy | Supported | Supported | Supported |
| Polling shared mailboxes | Supported | Supported | Supported |
| Federation Security | Supported only with MS Graph protocol. | Supported with MS Graph, IMAP and POP3 protocols. | Not Supported |