使用外接程序中的Outlook Online令牌对用户进行身份验证以在线进行Exchange

Question

Update

It seems that the UserIdentityToken is not usable for identifying the user to Exchange Online. That token can be use by a third-party service (ie a custom chat account) for a reliable way to identify the current user.

We can rely on the callback token if we want to retrieve something from Exchange Online but there is a 5 minutes time limit .

If we absolutely want to avoid this limit, the only other way that I found is to ask for their Office 365 credentials. Here is how I do it :

JS

// Send Basket Button | Send the basket to Sharepoint
$("#sendMails").click(function () {
    var mailsId = getMailIds();
    if (mailsId != null) saveMails(mailsId);
});

function saveMails(mailsId) {
    $.post(
        "/AJAX/SaveMails"
        {
            mailsId: JSON.stringify(mailsId),
            login: "mymail@onmicrosoft.com",
            password: "mypass",
        },
        function(result) {
            console.log("saveMails : ", result);
        },
        "text"
    );
}

C# ASP.NET MVC

[HttpPost]
public ActionResult SaveMails()
{
    // Office365 credentials
    var login = Request["login"];
    var password = Request["password"];

    // mailsID to retrieve from Exchange
    // IDs come from Office.context.mailbox.item.itemId
    var mailsID = JsonConvert.DeserializeObject<List<string>>(Request["mailsID"]);

    // Set credentials and EWS url for the Exchange connection
    var exService = new ExchangeService
    {
        // User's credentials
        Credentials = new WebCredentials(login, password),

        // Exchange Uri (always the same for Office365)
        Url = new Uri("https://outlook.office365.com/EWS/Exchange.asmx")
    }

    foreach(var mail in mailsID)
    {
         var itemId = new ItemId(mail);
         // Get mails from Exchange Online
         var email = EmailMessage.Bind(exService, itemId);

         // ... Do something with the mail
    }

    // ... Rest of the code
}

Now you can do what you need with your mails.

---

(Old post)

I struggle with this. I would like to retrieve a bunch of emails with my ASP.NET MVC Web Server from Outlook online without the limit of the item token that have a lifetime of only 5 minutes.

What I'm currently trying is :

• Getting the UserIdentityToken with Office.context.mailbox.getUserIdentityTokenAsync() method
• Send the token to my web server
• Instanciate the ExchangeService object with this token
• Try to get my mails

Obviously, it doesn't work. However, I tried to auth by entering the login and the password of my Office Account and here it does work.

I read elsewhere that we have to validate our token before trying to authenticate with it but it seems to only concern external app with an Azure AD? In my case, that's just an Outlook Online WEB add-in .

Well, here is my current code in my controller (that handle the authentication and that try to retrieve the mails from Exchange)

[HttpPost]
public ActionResult GetMails()
{
    // Token from getUserIdentityTokenAsync() as a string
    var token = Request["token"];

    // mailsID to retrieve from Exchange
    // IDs come from Office.context.mailbox.item.itemId
    var mailsID = JsonConvert.DeserializeObject<List<string>>(Request["mailsID"]);


    var exService = new ExchangeService
    {
        Url = new Uri("https://outlook.office365.com/EWS/Exchange.asmx"),
        Credentials = new OAuthCredentials(token),

        // WebCredentials works but I don't want the user to enter that
        // Credentials = new WebCredentials("mymail@onmicrosoft.com", "mypass");
    }

    foreach(var mail in mailsID)
    {
         var itemId = new ItemId(mail);
         // Try to get the mail from Exchange Online
         var email = EmailMessage.Bind(exService, itemId);

         // ... Rest of the code
    }

    // ... Rest of the method
}

Office.context.mailbox.item.itemId reference

My goal is to avoid the user to enter their Office Online credentials again, it would be weird and... Insecure, I think. What I am missing, so?

Thanks in advance.

Answer 1

The ID token get from Office.context.mailbox.getUserIdentityTokenAsync() can only use to identify and authenticate the add-in and user with a third-party system .

If you want to use the token get the item from Exchange through EWS, we need to use the token from getCallbackTokenAsync method. And here is sample for your reference:

function getMails2() {
    Office.context.mailbox.getCallbackTokenAsync(function (rs) {
        callMyWebService(rs.value, Office.context.mailbox.item.itemId)
    })
}

function callMyWebService(token, itemID) {
    var customer = { "token": token, "id": itemID };
    $.ajax({
        url: '../../api/Default',
        type: 'POST',
        data: JSON.stringify(customer),
        contentType: 'application/json;charset=utf-8'
    }).done(function (response) {
        if (!response.isError) {
            var names = "<h2>Attachments processed using " +
                          serviceRequest.service +
                          ": " +
                          response.attachmentsProcessed +
                          "</h2>";
            for (i = 0; i < response.attachmentNames.length; i++) {
                names += response.attachmentNames[i] + "<br />";
            }
            document.getElementById("names").innerHTML = names;
        } else {
            app.showNotification("Runtime error", response.message);
        }
    }).fail(function (status) {

    }).always(function () {
        $('.disable-while-sending').prop('disabled', false);
    })
};

Web API:

// POST api/<controller>
    public void Post([FromBody]Customer customer)
    {
        var token = customer.Token;

        // mailsID to retrieve from Exchange
        // IDs come from Office.context.mailbox.item.itemId
        // var mailsID = JsonConvert.DeserializeObject<List<string>>(customer.Id);



        var exService = new ExchangeService
        {
            Url = new Uri("https://outlook.office365.com/EWS/Exchange.asmx"),
            Credentials = new OAuthCredentials(token),

            // WebCredentials works but I don't want the user to enter that
            // Credentials = new WebCredentials("mymail@onmicrosoft.com", "mypass");
        };

        var itemId = new ItemId(customer.Id);
        // Try to get the mail from Exchange Online
        var email = EmailMessage.Bind(exService, itemId);
        string subject = email.Subject; 
        // ... Rest of the code

    }

public class Customer
{
    public string Token { get; set; }
    public string Id { get; set; }
}