118 lines
4.9 KiB
Markdown
118 lines
4.9 KiB
Markdown
# SharePoint Toolbox
|
|
|
|
A web admin toolbox for Microsoft 365 / SharePoint Online, built with Blazor Server (.NET 10) and Microsoft Graph.
|
|
|
|
## Features
|
|
|
|
- **Site management** — bulk site creation, folder-structure provisioning, templates
|
|
- **Members & permissions** — bulk member add, permission inspection
|
|
- **Content tools** — search, duplicate finder, file transfer, storage usage, version cleanup
|
|
- **Reporting** — on-demand reports, scheduled reports (unattended via app-only cert auth)
|
|
- **Auditing** — tenant-wide user-access audit (SP + M365/AAD group expansion)
|
|
- **Directory** — user directory browsing
|
|
- Multi-tenant via connection profiles. EN / FR localization.
|
|
|
|
## Requirements
|
|
|
|
- An Entra ID (Azure AD) app registration — see [Configuration](#configuration)
|
|
- Docker, **or** the .NET 10 SDK for bare-metal
|
|
|
|
## Configuration
|
|
|
|
Authentication uses Microsoft OIDC (interactive sign-in) and, for scheduled reports, app-only certificate auth.
|
|
|
|
Set these as environment variables (or in `appsettings.json` under the `Oidc` section). .NET maps `Section__Key` to `Section:Key`.
|
|
|
|
| Variable | Description |
|
|
|----------|-------------|
|
|
| `Oidc__TenantId` | Entra tenant GUID |
|
|
| `Oidc__ClientId` | App registration client ID |
|
|
| `Oidc__ClientSecret` | App registration client secret |
|
|
| `DataFolder` | Persistent data path (default `/data`) |
|
|
| `ASPNETCORE_ENVIRONMENT` | Must be `Production` to enable OIDC |
|
|
|
|
> In `Development`, OIDC is disabled — the app uses a cookie-only auto-login (hardcoded Admin) for local work.
|
|
|
|
### Two distinct OAuth flows — two redirect URIs
|
|
|
|
These are separate and registered on **different** Entra apps. Don't conflate them.
|
|
|
|
1. **App sign-in (OIDC).** Logging into the toolbox itself via "Sign in with Microsoft". Uses the `Oidc__*` app above. Callback path is the framework default `/signin-oidc` (not configurable here).
|
|
→ On **this** app registration, add redirect URI `https://your-host/signin-oidc` under the **Web** platform. This app also needs the Graph permissions the audit/reporting features require: `GroupMember.Read.All`, `Group.Read.All`, `User.Read.All`.
|
|
|
|
2. **SharePoint connect (per-profile).** Getting a delegated SharePoint/Graph token for a client tenant. A PKCE public-client flow that uses **each connection profile's own `ClientId`/`TenantId`** — not the `Oidc__*` app. `ClientConnect__RedirectUri` is the callback for this flow.
|
|
→ On **each client-tenant profile's** app registration, add the `ClientConnect__RedirectUri` value (e.g. `https://your-host/connect/callback`) under the **Mobile and desktop / public client** platform.
|
|
|
|
> **HTTPS note.** The sign-in app is a confidential (Web) client, so Entra requires its `/signin-oidc` redirect URI to be **HTTPS** — plain HTTP is allowed only for `http://localhost`, not a LAN host/IP. To run OIDC on a plain-HTTP LAN deployment, put the app behind an HTTPS-terminating reverse proxy: register `https://your-host/signin-oidc`, and the app honours `X-Forwarded-Proto` (see `UseForwardedHeaders`) to build the correct `https` redirect. Without a proxy, OIDC sign-in won't work over a non-localhost HTTP host — use the local email/password login instead.
|
|
|
|
Persistent state (profiles, settings, templates, logs, exports, certs) lives in `DataFolder`.
|
|
|
|
## Installation — Docker
|
|
|
|
```bash
|
|
docker compose up -d --build
|
|
```
|
|
|
|
App listens on **http://localhost:8080**. Data persists in the `sptb-data` volume.
|
|
|
|
Set your OIDC values in `docker-compose.yml` under `environment:`, or pass an env file:
|
|
|
|
```yaml
|
|
environment:
|
|
- ASPNETCORE_ENVIRONMENT=Production
|
|
- DataFolder=/data
|
|
- Oidc__TenantId=...
|
|
- Oidc__ClientId=...
|
|
- Oidc__ClientSecret=...
|
|
- ClientConnect__RedirectUri=https://your-host/connect/callback
|
|
```
|
|
|
|
Plain Docker (no compose):
|
|
|
|
```bash
|
|
docker build -t sptb-web .
|
|
docker run -d -p 8080:8080 \
|
|
-v sptb-data:/data \
|
|
-e ASPNETCORE_ENVIRONMENT=Production \
|
|
-e Oidc__TenantId=... \
|
|
-e Oidc__ClientId=... \
|
|
-e Oidc__ClientSecret=... \
|
|
-e ClientConnect__RedirectUri=https://your-host/connect/callback \
|
|
sptb-web
|
|
```
|
|
|
|
## Installation — Bare metal
|
|
|
|
Requires the [.NET 10 SDK](https://dotnet.microsoft.com/download).
|
|
|
|
```bash
|
|
# Restore + build
|
|
dotnet restore
|
|
dotnet publish -c Release -o ./publish
|
|
|
|
# Configure (PowerShell example)
|
|
$env:ASPNETCORE_ENVIRONMENT = "Production"
|
|
$env:DataFolder = "C:\sptb-data"
|
|
$env:Oidc__TenantId = "..."
|
|
$env:Oidc__ClientId = "..."
|
|
$env:Oidc__ClientSecret = "..."
|
|
$env:ClientConnect__RedirectUri = "https://your-host/connect/callback"
|
|
|
|
# Run
|
|
dotnet ./publish/SharepointToolbox.Web.dll
|
|
```
|
|
|
|
By default it listens on the Kestrel port (`http://localhost:5000`). Override with `ASPNETCORE_URLS`, e.g. `http://+:8080`.
|
|
|
|
### Local development
|
|
|
|
```bash
|
|
dotnet run
|
|
```
|
|
|
|
Runs in `Development` mode — OIDC off, auto-login as Admin. No Entra config needed.
|
|
|
|
## Tech stack
|
|
|
|
.NET 10 · Blazor Server · Microsoft Graph SDK · PnP.Framework · Serilog · CsvHelper
|