Archibus Extension for Microsoft Exchange

Configure the Archibus Extension for Microsoft Exchange for Use with OAuth2

This topic applies to using the Archibus Extension for Microsoft Exchange with OAuth2 for both the Maintenance and Reservations applications and modules.

To use Oauth2, the Web Central application needs to be registered in Azure AD.

Since impersonation rights are granted directly to the application via Azure AD, this setup does not rely on a service account.

If required, impersonation rights can be restricted to a specific set of mailboxes using an Application Access Policy.

Properties in reservations.properties

Properties are defined in the \WEB-INF\config\context\applications\reservations.properties file to support of OAuth2. Each property is described inline below.

Both exchange.password and exchange.userName are not used with OAuth2 and should remain empty.

############################### # Parameters for using OAuth2 # ############################### # Toggle to enable/disable OAuth2 (true/false) exchange.oauth.enabled=true # # URL of the token issuer. This should be specific to your tenant. # E.g. https://login.microsoftonline.com/pr...microsoft.com/ # exchange.oauth.authority= # # URL of the resource to request access to. This is the Exchange Online base URL, typically https://outlook.office365.com/. # exchange.oauth.resource=https://outlook.office365.com/ # # Web Central application client id. This id is generated on Azure AD upon registration of the app. # Hexadecimal code format: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx. E.g. 16c48234-e360-4fe6-8614-23cc1a9fa0ee. # exchange.oauth.clientId= # # Properties of the keystore containing the key and certificate to authenticate with. # 1. KeyStore location (e.g. C:/oauth/keystore.jks) exchange.oauth.keyStorePath= # 2. KeyStore password exchange.oauth.keyStorePassword= # 3. Alias of the certificate and private key (JKS default alias is 1) exchange.oauth.keyAlias=1 # 4. Password for retrieving the private key from the keystore exchange.oauth.keyPassword= # # Margin for renewal of the access token in seconds. # Reservations WFRs will request a new token before contacting Exchange if the current token expires # in fewer seconds. The Office 365 access token expires after 1 hour by default, so a margin of 300 # seconds triggers renewal after 55 minutes. # exchange.oauth.renewalMargin=300

Properties in bldgops-exchange.properties

Properties are defined in the \WEB-INF\config\context\applications\bldgops-exchange.properties file to support of OAuth2. Each property is described inline below.

Both exchange.password and exchange.userName are not used with OAuth2 and should remain empty.

########################################################## # Parameters for using OAuth2 to connect with Office 365 # ########################################################## # Toggle to enable/disable OAuth2 (true/false) bldgops.exchange.oauth.enabled=true # # URL of the token issuer. This should be specific to your tenant. # E.g. https://login.microsoftonline.com/tg...microsoft.com/ # bldgops.exchange.oauth.authority=https://login.microsoftonline.com/63...0-0eaf117a5db7 # # URL of the resource to request access to. This is the Exchange Online base URL, typically https://outlook.office365.com/. # bldgops.exchange.oauth.resource=https://outlook.office365.com/ # # Web Central application client id. This id is generated on Azure AD upon registration of the app. # Hexadecimal code format: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx. E.g. 16c48234-e360-4fe6-8614-23cc1a9fa0ee. # bldgops.exchange.oauth.clientId=066d1416-10ee-406f-9588-bb311008a62c # # Properties of the keystore containing the key and certificate to authenticate with. # 1. KeyStore location (e.g. C:/oauth/keystore.jks) bldgops.exchange.oauth.keyStorePath=C:/oauth/keystore.jks # 2. KeyStore password bldgops.exchange.oauth.keyStorePassword=webc2514 # 3. Alias of the certificate and private key (JKS default alias is 1) bldgops.exchange.oauth.keyAlias=1 # 4. Password for retrieving the private key from the keystore bldgops.exchange.oauth.keyPassword=webc2514 # # Margin for renewal of the access token in seconds. # Reservations WFRs will request a new token before contacting Exchange if the current token expires # in fewer seconds. The Office 365 access token expires after 1 hour by default, so a margin of 300 # seconds triggers renewal after 55 minutes. # bldgops.exchange.oauth.renewalMargin=300

Using password encryption

It is recommended that you encrypt the passwords in the configuration file. See Encrypting Passwords in Configuration Files .