Search code examples
oauth-2.0azure-active-directorypostmanodataproject-online

Project Online Authenticate OData Feed using Azure AD and Postman

I have recently spent a substantial amount of time determining how to authenticate an OData feed from Project Online using Azure AD and Postman. There are many posts in different forums about this, but I wasn't able to find a single post that gave a complete working example. Following is the method that I have used.

Solution

  • ASSIGN PERMISSIONS IN PROJECT ONLINE

    Open Server Settings / Manage Groups. Choose the Group that you want to allow to access the OData Feed and Ensure it has the Access Project Server Reporting Service under General in Global Permissions ticked. enter image description here

    CONFIGURE AZURE AD

    Register a new app in Azure. enter image description here

    Define the Redirect Uri. (For postman, use https://oauth.pstmn.io/v1/callback) enter image description here

    Define a client secret enter image description here

    CONFIGURE POSTMAN

    Create a new Request and define a Get query along the lines of the following. https://[Your Domain].sharepoint.com/sites/pwa/_api/ProjectData/Projects
    This requests a list of projects.

    Under params, add a new key accept = application/json if you want Json output. default is XML enter image description here

    Under Authorization Tab, choose the following:

    • Type = OAuth 2.0
    • Access Token = Available Tokens
    • Header Prefix = Bearer
    • Token Name = [Any Name you want]
    • Grant Type = Authorization
    • Code Callback URL = [tick Authorize Using Browser. This will then default to https://oauth.pstmn.io/v1/callback]
    • Auth URL = https://login.microsoftonline.com/common/oauth2/v2.0/authorize
    • Access Token URL = https://login.microsoftonline.com/common/oauth2/v2.0/token
    • Client ID = [From Azure AD] Client Secret = [From Azure AD]
    • Scope = https://[Your Tenant Name].sharepoint.com/ProjectWebAppReporting.Read
    • State = [Anything you want]
    • Client Authentication = Send client credentials in body.

    enter image description here

    If you enter all of this correctly and then press Get New Access Token, you should see a browser open, enter your credentials and then a token should return to Postman as shown in screenshots below. Press Use Token.

    enter image description here

    enter image description here

    Note, if you are interested to see what the token contains, you can decode it at https://jwt.io/

    At this point, press Send, run your query and confirm that the Body contains odata output.

    enter image description here EDIT NOTE: I have made multiple adjustments to this answer as I identified and resolved multiple roadblocks that I encountered. It turned out to be quite simple in the end, but the key concept that was needed to get this right was that the Scope parameter needed to be targeted to the PWA site. ie. https://[your tenant name].sharepoint.com.au/user.read