[Microsoft Teams] Rewrite connector to use application-only permissions - #4257
Draft
Jan-Kazlouski-elastic wants to merge 5 commits into
Draft
[Microsoft Teams] Rewrite connector to use application-only permissions#4257Jan-Kazlouski-elastic wants to merge 5 commits into
Jan-Kazlouski-elastic wants to merge 5 commits into
Conversation
…ns (#4145) Replace the dual delegated + username/password auth model with application-only authentication (client secret or certificate), mirroring SharePoint Online. - Extract shared Microsoft Graph auth + HTTP layer into connectors/sources/shared/microsoft/graph.py, reused by SharePoint Online and Teams. - Adopt the least-privilege WhereInstalled/RSC permission model; per-resource message/member calls skip teams/chats where the app is not installed. - Trim synced entities to Teams, Channels (+ messages/replies/attachments), TeamMembers, and Chats (+ messages/attachments); drop calendars, tabs and meeting recordings. - Add Document Level Security based on team/chat membership, creating identities only for users that participate in Teams. - Ship a Teams app manifest template and setup docs for RSC installation. - Rewrite unit tests and the functional-test fixture accordingly. Co-authored-by: Cursor <cursoragent@cursor.com>
…lity Fix large-tenant get_docs stall via concurrent enumeration, refuse silent index wipe on total permission failure, index attachment-only messages, and surface skipped resources at end of sync. Co-authored-by: Cursor <cursoragent@cursor.com>
Make resource enumeration failure-safe: unexpected (non-permission) errors are recorded and re-raised from get_docs instead of stranding the consumer, with ENUMERATION_FINISHED always emitted in a finally. Process channels inline within team_producer to remove the nested fetchers scheduling that could deadlock the bounded task pool on large tenants, and always emit each producer's end signal via finally. Also add a return annotation to the recursive get_channel_drive_children to satisfy the type checker. Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #4145
Rewrites the Microsoft Teams connector to authenticate with application-only credentials (client secret or certificate) using a least-privilege permission model, and removes the legacy dual (delegated + username/password) authentication that is unsuitable for a headless connector.
Because Microsoft only exposes read access to Teams messages through either broad
*.All"protected" permissions or the narrower resource-specific consent (RSC) /WhereInstalledpermissions, the connector uses the latter: its Entra app is packaged as a Teams app and installed into the teams/chats to sync. Shared Microsoft Graph auth/HTTP plumbing was extracted intoconnectors/sources/shared/microsoft/graph.pyand is now reused by both the Teams and SharePoint Online connectors.What changed
Auth & permissions
GraphAPIToken) or certificate (EntraAPIToken); legacy username/password/delegated auth removed.WhereInstalled), including the unavoidableTeam.ReadBasic.All/Channel.ReadBasic.Alldiscovery permissions and the attachment-onlyFiles.Read.All.Correctness & robustness
get_docsrestructured to schedule a single enumeration orchestrator and consume the queue concurrently, fixing a stall/deadlock on large tenants (previously all producers were enumerated before draining, exhausting theMemQueue/MAX_CONCURRENCY).PermissionsMissing, preventing a silent wipe of previously indexed content. A genuinely empty tenant still completes normally."body": nullso it can no longer raiseAttributeError.get_access_controltoleratesPermissionsMissingduring enumeration (warn + continue), matchingget_docs.incremental_sync_enabledset toFalse(there is no incremental crawl path; the flag was misleading).Observability
Config validation
validate_configraises a clearConfigurableFieldValueErrorwhen the selected auth method is missing its credentials, instead of surfacing a low-level token error.Checklists
Pre-Review Checklist
config.yml.example)Changes Requiring Extra Attention
Related Pull Requests
Release Note
Rewrote the Microsoft Teams connector to use application-only authentication (client secret or certificate) with a least-privilege permission model, replacing the previous username/password + delegated authentication.
Made with Cursor