O365 Integration
would like to understand if the Office 365 integration for Email accounts in Pega can be set up in a way to support delegated permissions https://docs.microsoft.com/en-us/graph/auth/auth-concepts
Pegasystems Inc.
IN
Hello @JeevanM,
Thanks for asking the question.
Yes, you could setup the authentication on the pega email account to use "Delegeated-Permisssions" when connecting to Office 365 mailboxes.
The “Delegated Permissions” are generally used by apps that have a signed-in user present or want to impersonate the signed-in user when making calls to Office 365. I believe the pega email accounts you create are service accounts and there is usually no user interaction possible. So you need to be able to impersonate the signed-in user to connect to the Office 365 mailboxes for sending/receiving emails. You could achieve this by using the OAuth2.0 "Password Credentials" grant that pega already supports for Microsoft Graph standard when connecting to Office 365 mailboxes.
Please refer to this link for more details on how to configure OAuth2.0 authentication for sending/receiving emails using Microsoft Graph standard.
Thank You.
Intel
US
@nvkap Hi Prasad,
Appreciate the reply, what we are looking to do is impersonate the signed-in user. Coming to the password credentials / password grant for Oauth , doesn't OAuth best practices prohibit using that type of grant? . (https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics-13)
Nevertheless if you can share any setup document that covers this use case, would appreciate it, Also does Pega support using Client Credentials to accomplish the same( delegation)?
We have referred the documentation and were able to get the straightforward case completed but not the delegation use case.
I also had a follow up question .
Does Pega support Oauth based authentication for IMAP and SMTP . As far as I know today in 8.5 it is not an option.
Pegasystems Inc.
IN
Hello @JeevanM Thanks for the follow up questions.
Here are my answers to your questions.
As outlined in the document, Pega does support "Client Credentials" grant for connecting to Office 365 mailboxes using Microsoft Graph.But as per the OAuth2 standard this grant type doesn't involve singed user.
Assuming that you have registered the app with Microsoft Azure and you have the client id and secret available with you all you need is to configure OAuth2.0 authentication to use "Password Credentials" grant. Please refer to this document that explains in detail how you can configure OAuth2.0 authentication with "Password Credentials" grant.
Regd. OAuth2 IMAP & SMTP support for Office 365 mailboxes - We currently don't have OAuth based authentication support for IMAP or SMTP to connect to Office 365 mailboxes. Infact, most of the organizations are moving away from IMAP/POP3 infavour of more secured standards such as Microsoft Graph for Office 365. Microsoft also recommends using Graph standard for connecting to Office 365 mailboxes for sending or receiving emails. This is one of the reasons why we have enabled native support for using Microsoft Graph API for sending or receiving emails.
I hope this helps.
Thanks