Nick.Rosenloecher/ApiCore
1
0 Fork 0
Code Issues 22 Pull Requests Actions Packages Projects Releases Wiki Activity

refactor: reuse the SSO app registration for M365 calendar sync

Browse Source 
One Entra enterprise application now covers both interactive login and
the calendar sync's client-credentials Graph access, instead of
requiring a second app registration. GraphClientService reads
OIDC_ISSUER_URL/OIDC_CLIENT_ID/OIDC_CLIENT_SECRET (same as SSO) and
derives the tenant ID from the issuer URL's path, rather than three
dedicated M365_CALENDAR_* env vars. The app registration just needs the
"Calendars.ReadWrite" Application permission added alongside its
existing delegated login scopes.

Co-Authored-By: Claude Sonnet 5 <[email protected]>
This commit is contained in:
Nick SzaunigandClaude Sonnet 5 committed 2026-09-04 14:35:18 +02:00
1 parent e7b157ec35
commit e133a677ab
6 files changed
+70 -44
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

deploy/k8s/backend/secret.example.yaml
+4 -7
View File
@@ -16,12 +16,9 @@ stringData:
JWT_ACCESS_SECRET: "change-me-to-a-random-value-at-least-32-characters-long"
JWT_REFRESH_SECRET: "change-me-refresh-secret"
# Entra ID App-Registrierung (SSO). Siehe configmap.example.yaml
# fuer OIDC_ISSUER_URL/OIDC_REDIRECT_URI.
# fuer OIDC_ISSUER_URL/OIDC_REDIRECT_URI. Wird auch fuer die
# M365-Kalender-Synchronisation wiederverwendet - dafuer in der
# App-Registrierung zusaetzlich die Application-Permission
# "Calendars.ReadWrite" hinzufuegen (Admin-Consent noetig).
OIDC_CLIENT_ID: "change-me-entra-client-id"
OIDC_CLIENT_SECRET: "change-me-entra-client-secret"
# Separate App-Registrierung fuer die M365-Kalender-Synchronisation
# (Application-Permission "Calendars.ReadWrite", Admin-Consent noetig) -
# NICHT dieselbe wie OIDC_CLIENT_ID/-SECRET oben.
M365_CALENDAR_TENANT_ID: "change-me-m365-tenant-id"
M365_CALENDAR_CLIENT_ID: "change-me-m365-client-id"
M365_CALENDAR_CLIENT_SECRET: "change-me-m365-client-secret"