ODBC Driver for Microsoft SharePoint

Build 23.0.8839

macOS DSN Configuration

This section shows how to set up ODBC connectivity and configure DSNs on macOS.

Minimum macOS Version

The CData ODBC Driver for Microsoft SharePoint driver requires macOS Sierra (10.12) or above.

Licensing the Driver

In a terminal, run the following commands to license the driver. To activate a trial, omit the <key> input. 

cd "/Applications/CData ODBC Driver for Microsoft SharePoint/bin"
sudo ./install-license.sh <key>

You'll be prompted for a name and password. These refer to your name and your machine's password.

Connecting to Microsoft SharePoint

Regardless of whether you will connect online or on-premesis, what architecture will be used, and which Lists and Documents will be accessed, connecting to Microsoft SharePoint requires exactly two things:
  • Set the URL connection property.
  • Set the appropriate authentication properties for your working environment.

Setting URL:

Microsoft SharePoint works with all Lists and Documents in the global Microsoft Sharepoint site, or all Lists and Documents at individual sites.

To work with all Lists and Documents in the global Microsoft Sharepoint site, set the URL connection property to your Site Collection URL. For example: 

https://teams.contoso.com

To work with all Lists and Documents at an individual site, set the URL connection property to your individual site URL. For example: 

 https://teams.contoso.com/TeamA

The following sections describe how to set the appropriate authentication properties for your working environment. For information about how to create a custom OAuth application (required for use with AzureAD in a Web application; optional for AzureAD access via a Desktop application or a Headless Server), see Creating a Custom OAuth Application.

Microsoft SharePoint Online

Set SharePointEdition to "SharePoint Online" and set the User and Password to the credentials you use to log onto SharePoint, for example, the credentials to your Microsoft Online Services account.

Microsoft SharePoint online supports a number of cloud-based architectures, each of which supports a different set of authentication schemes:

  • AzureAD
  • Single sign-on (SSO) via the ADFS, Okta, OneLogin, or PingFederate SSO identity provider
  • Azure MSI
  • Azure Password
  • OAuthJWT
  • SharePointOAuth

If the user account domain is different from the domain configured with the identity provider, set SSODomain to the latter. This property may be required for any SSO.

AzureAD

Azure Active Directory (AzureAD) is a connection type that leverages OAuth to authenticate. OAuth requires the authenticating user to interact with Microsoft SharePoint using an internet browser. The driver facilitates this in several ways as described below. Set your AuthScheme to AzureAD. The AzureAD flows described below assume that you have done so.

Your organization may require Admin Consent when authorizing a new AzureAD application for your Azure Tenant. In all AzureAD flows, any initial installation and use of an AzureAD application requires that an administrator approve the application for their Azure Tenant. For details, see Creating a Custom OAuth Application.

Desktop Applications
CData provides an embedded OAuth application that simplifies OAuth desktop authentication. Alternatively, you can create a custom AzureAD application. See Creating a Custom OAuth Application for information about creating custom applications and reasons for doing so.

For authentication, the only difference between the two methods is that you must set two additional connection properties when using custom AzureAD applications.

After setting the following connection properties, you are ready to connect:

  • Custom applications only:
    • OAuthClientId: The client Id in your application settings.
    • OAuthClientSecret: The client secret in your application settings.

When you connect the driver opens the OAuth endpoint in your default browser. Log in and grant permissions to the application.

Headless Machines

To configure the driver to use OAuth with a user account on a headless machine, you must authenticate on another device that has an internet browser.

  1. Choose one of these two options:

    • Option 1: Obtain the OAuthVerifier value as described in "Obtain and Exchange a Verifier Code" below.
    • Option 2: Install the driver on another machine and transfer the OAuth authentication values after you authenticate through the usual browser-based flow, as described in "Transfer OAuth Settings" below.

  2. Now configure the driver to automatically refresh the access token from the headless machine.

Option 1: Obtain and Exchange a Verifier Code

To obtain a verifier code, you must authenticate at the OAuth authorization URL.

Follow the steps below to authenticate from the machine with an internet browser and obtain the OAuthVerifier connection property.

  1. Choose one of these options:

    • If you are using the Embedded OAuth Application click Microsoft SharePoint OAuth endpoint to open the endpoint in your browser.
    • If you are using a custom OAuth application, create the Authorization URL by setting the following properties:
      • InitiateOAuth: OFF.
      • OAuthClientId: The client Id assigned when you registered your application.
      • OAuthClientSecret: The client secret assigned when you registered your application.
      Now call the GetOAuthAuthorizationURL stored procedure with the appropriate CallbackURL. Open the URL returned by the stored procedure in a browser.

  2. Log in and grant permissions to the driver. You are redirected to the callback URL, which contains the verifier code.
  3. Save the value of the verifier code. Later you will set this in the OAuthVerifier connection property.
Next, you must exchange the OAuth verifier code for OAuth refresh and access tokens. Set the following properties:

On the headless machine, set the following connection properties to obtain the OAuth authentication values:

  • InitiateOAuth: REFRESH.
  • OAuthVerifier: The verifier code.
  • OAuthSettingsLocation: The location of the file where the driver saves the OAuth token values that persist across connections.
  • Custom applications only:
    • OAuthClientId: The client Id in your custom OAuth application settings.
    • OAuthClientSecret: The client secret in the custom OAuth application settings.

After the OAuth settings file is generated, you must re-set the following properties to connect:

  • InitiateOAuth: REFRESH.
  • OAuthSettingsLocation: The location containing the encrypted OAuth authentication values. Make sure this location grants read and write permissions to the driver to enable the automatic refreshing of the access token.
  • Custom applications only:
    • OAuthClientId: The client Id assigned when you registered your application.
    • OAuthClientSecret: The client secret assigned when you registered your application.

Option 2: Transfer OAuth Settings

Prior to connecting on a headless machine, you must create and install a connection with the driver on a device that supports an internet browser. Set the connection properties as described in "Desktop Applications" above.

After completing the instructions in "Desktop Applications", the resulting authentication values are encrypted and written to the location specified by OAuthSettingsLocation. The default filename is OAuthSettings.txt.

Once you have successfully tested the connection, copy the OAuth settings file to your headless machine.

On the headless machine, set the following connection properties to connect to data:

  • InitiateOAuth: REFRESH.
  • OAuthSettingsLocation: The location of your OAuth settings file. Make sure this location gives read and write permissions to the driver to enable the automatic refreshing of the access token.
  • Custom applications only:
    • OAuthClientId: The client Id assigned when you registered your application.
    • OAuthClientSecret: The client secret assigned when you registered your application.

Single Sign-On Identity Providers

ADFS

Set the AuthScheme to ADFS. You must set the following connection properties:

  • User: The ADFS user.
  • Password: The user's ADFS password.
  • SSODomain (optional): The domain configured with the ADFS identity provider.
Example connection string: 
AuthScheme=ADFS;User=ADFSUserName;Password=ADFSPassword;URL='http://sharepointserver/mysite';
Okta

Set the AuthScheme to Okta. The following connection properties are used to connect to Okta:

  • User: The Okta user.
  • Password: The user's Okta password.
  • SSODomain (optional): The domain configured with the OKTA identity provider.

Example connection string: 

AuthScheme=Okta;User=oktaUserName;Password=oktaPassword;URL='http://sharepointserver/mysite';
OneLogin

Set the AuthScheme to OneLogin. The following connection properties are used to connect to OneLogin:

  • User: The OneLogin user.
  • Password: The user's OneLogin password.
  • SSODomain (optional): The domain configured with the OneLogin identity provider.

Example connection string: 

AuthScheme=OneLogin;User=OneLoginUserName;Password=OneLoginPassword;URL='http://sharepointserver/mysite';
PingFederate

Set the AuthScheme to PingFederate. The following connection properties are used to connect to PingFederate:

  • User: The PingFederate user.
  • Password: PingFederate password for the user.
  • SSODomain (optional): The domain configured with the PingFederate identity provider.

Example connection string: 

AuthScheme=PingFederate;User=PingFederateUserName;Password=PingFederatePassword;URL='http://sharepointserver/mysite';

Azure MSI

If you are running Microsoft SharePoint on an Azure VM, you can leverage Azure Managed Service Identity (MSI) credentials to connect:

  • AuthScheme: AzureMSI.

The MSI credentials are automatically obtained for authentication.

Azure Password

To connect using your Azure dredentials directly, specify the following connection properties:
  • AuthScheme: AzurePassword
  • User: The user account used to connect to Azure
  • Password: The password used to connect to Azure
  • AzureTenant: Directory (tenant) ID, found on the Overview page of the OAuth application used to authenticate to Microsoft SharePoint on Azure.

OAuthJWT Certificate

Set the AuthScheme to OAUTHJWT. The following connection properties are used to connect to Microsoft SharePoint:

  • AzureTenant: The tenant you wish to connect to.
  • OAuthJWTCert: The JWT certificate store.
  • OAuthJWTCertType: The type of key store containing the JWT certificate.
  • OAuthJWTIssuer: The OAuth client Id.
  • OAuthJWTCertPassword: The password associated with the JWT certificate. Set this is your certificate type requires a password.

SharePointOAuth

Set the AuthScheme to SharePointOAuth. The following connection properties are used to connect to SharePointOAuth:

  • Schema: REST.
  • InitiateOAuth: GETANDREFRESH.
  • OAuthClientId: The application's identity/Client Id.
  • OAuthClientSecret: The application's Client Secret.

Example connection string: 

SharePointEdition='SharepointOnline';URL=https://rssbuscrm.sharepoint.com;Schema=REST;AuthScheme=SharepointOAuth;InitiateOAuth=GETANDREFRESH;OAuthClientId=11111111-1111-1111-1111-111111111111;OAuthClientSecret=1111111111111/11111111111111/11111111111111=;
This AuthScheme works with the custom OAuth application. To generate credentials from a custom OAuth application, see Creating a Custom OAuth Application.

Microsoft SharePoint On-Premises

Microsoft SharePoint On-Premises supports a number of premise-based architectures:

  • Windows (NTLM)
  • Kerberos
  • ADFS
  • Anonymous Access

Set SharePointEdition to "SharePoint On-Premises" to use the following authentication types.

Windows (NTLM)

This is the most common authentication type. As such, the driver is preconfigured to use NTLM as the default; simply set the Windows User and Password to connect.

Kerberos

Set the AuthScheme to NEGOTIATE, and then set the following Kerberos connection properties:

  • KerberosKDC: The host name or IP Address of your Kerberos KDC machine.
  • KerberosSPN: The service and host of the Microsoft SharePoint Kerberos Principal. This is the value prior to the '@' symbol (for instance, MyService/MyHost) of the principal value (for instance, MyService/MyHost@EXAMPLE.COM).

For details on how to authenticate with Kerberos, see Using Kerberos.

ADFS

Set the AuthScheme to ADFS, and then set the following connection properties:

  • User: The ADFS user.
  • Password: ADFS password for the user.
  • SSOLoginURL: The WS-trust endpoint of the ADFS server.
You also need the to set SSOProperties to authenticate to ADFS. Specify the value of the RelyingParty parameter; it is located on the ADFS server for Sharepoint. Example connection string: 
AuthScheme=ADFS;User=ADFSUserName;Password=ADFSPassword;SSOLoginURL='https://<authority>/adfs/services/trust/2005/usernamemixed';SSO Properties ='RelyingParty=urn:sharepoint:sp2016;';

Anonymous Access

Set the AuthScheme to NONE along with the URL.

Uninstalling the Driver

The easiest way to uninstall the driver is to open a terminal and run the included uninstall.sh script, located in the installation directory. For example: 

cd "/Applications/CData ODBC Driver for Microsoft SharePoint"
sudo ./uninstall.sh

Note: The script needs to be run from the installation directory.

Copyright (c) 2024 CData Software, Inc. - All rights reserved.
Build 23.0.8839