Microsoft Graph Plugin

The Microsoft Graph plugin (tika-pipes-microsoft-graph) provides a fetcher that retrieves files from OneDrive, SharePoint, and other Graph-accessible sources. It is fetcher-only — pair it with another emitter and iterator.

Interface Component name Class

Fetcher

microsoft-graph-fetcher

MicrosoftGraphFetcher

Credentials

The fetcher authenticates against Microsoft Entra (Azure AD) using one of two credential modes — set at least one:

  • Client secret (clientSecretCredentialsConfig) — easiest to set up; client secrets rotate manually.

  • Client certificate (clientCertificateCredentialsConfig) — for environments that require certificate-based auth.

Both modes need tenantId and clientId, plus either clientSecret or the PFX pair certificateBytes / certificatePassword. Setting neither block fails at startup; setting both is allowed and the certificate wins.

Microsoft Graph Fetcher (microsoft-graph-fetcher)

Fetches files via the Microsoft Graph API. The fetch key is siteDriveId,driveItemId — the two Graph identifiers separated by a comma.

{
  "fetchers": {
    "msgf": {
      "microsoft-graph-fetcher": {
        "clientSecretCredentialsConfig": {
          "tenantId": "REDACTED-TENANT-UUID",
          "clientId": "REDACTED-CLIENT-UUID",
          "clientSecret": "REDACTED"
        },
        "scopes": ["https://graph.microsoft.com/.default"],
        "spoolToTemp": true
      }
    }
  }
}

Configuration

Field Default Description

clientSecretCredentialsConfig

one of these two required

Nested object with tenantId, clientId, clientSecret. See Credentials.

clientCertificateCredentialsConfig

one of these two required

Nested object with tenantId, clientId, certificateBytes (PFX), certificatePassword. Takes precedence over clientSecretCredentialsConfig. See Credentials.

scopes

empty

OAuth scopes to request. Typical: ["https://graph.microsoft.com/.default"] (application permissions).

spoolToTemp

false

If true, files are spooled to a temp file before being parsed.

throttleSeconds

none

Retry/back-off array. Its length is the number of attempts, and entry i is the seconds to sleep before retry i. Absent or empty means a single attempt with no retry.

Notes

  • The plugin uses the official microsoft-graph SDK.

  • For most service-to-service workflows, use application permissions (https://graph.microsoft.com/.default scope) — delegated permissions require an interactive flow that the fetcher does not support.

  • Client secrets are sensitive — use environment-variable substitution or external secret stores rather than inlining them in source control.