{"title":"Microsoft Authenticator","nodeType":"Source","id":"*f__YQsR0VpxoU5I3","factoryName":"org.knime.ext.microsoft.authentication.node.MicrosoftAuthenticatorNodeFactory","factoryId":"org.knime.ext.microsoft.authentication.node.MicrosoftAuthenticatorNodeFactory","path":["IO","Connectors"],"owner":"knime","ownerAccountId":"account:team:b5f0848f-496d-4e6a-b869-fa3532248db7","description":"<p>This node provides authentication to access Microsoft Azure and Office 365 cloud services. It supports the standard authentication of Azure AD/Office 365 (based on OAuth 2), as well as authentication mechanisms specific to Azure Storage.</p>\n        ","shortDescription":"Microsoft Authenticator node.","keywords":[],"deprecated":false,"streamable":false,"tags":["IO","Connectors"],"icon":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAB8AAAAQCAYAAADu+KTsAAAACXBIWXMAAAK+AAACvgEk+CLQAAAAGXRFWHRTb2Z0d2FyZQB3d3cuaW5rc2NhcGUub3Jnm+48GgAAAeBJREFUOI21lT9oU1EUxn/fTSJBHBTBycF/xCWDcN+jQxcXB5tJ6i66S8Wh6CBuooMIWRzdnVoHEQpSaCn43rsJCA5ObkrdWmrVau5xSCMhtE2oz7Ndvu/yOx/3XI7MjEFNTU2d7PV6d4BrwBlgE1gF2kVRrFJyaQBP03TazF4Cp/bwmZk963Q692y42zLgaZo2zWwFODbG/7goigdlwZ0kF2N8MQEYYN5770uDe++vSro0qR+4Xxa8ClwfOm+b2bKkBnBhrwuSWkmSvDskb8c5dzfLshxA3vuPwDngl6TpPM+7SZLUzGxR0pVDQg6qbeBGURQL8t5vAEfNbCmEMDNwpGk6Y2aL/wEOEIH5KvAvX+ebmX2VVANOj2hfzOyHpOPAiWHBzEzSjgPWASRdHkxys9k8EmO8PY4s6U0IoRFjbI1qzrlbIYQG0B6RtiTNFkXxvAqs0X/zmqS33vvler1+ETi/D/M38H43wSeAWq32vdfrdUbSbe42+NnMBtpPSXN5nnehP3AtYGFcyqG0r/I8n53Uf1C5EMJrM+tO6I8xxkdlgAGcmVmlUrkJbE3gfxJCCKXBAbIs++Cca5nZ+j4+A56GEB6WBYahrQZ/V+oc/ZV6FtiQtCKpnWXZWplggD+g9svk3pHFTAAAAABJRU5ErkJggg==","sinceVersion":"5.2.0","views":[],"inPorts":[],"outPorts":[{"objectClass":"org.knime.credentials.base.CredentialPortObject","color":"4386f7","dataType":"org.knime.credentials.base.CredentialPortObject","optional":false,"name":"Credential","description":"Credential with an OAuth 2 access token, or shared key/SAS URL for Azure Storage, depending on the chosen authentication type."}],"dynInPorts":[],"dynOutPorts":[],"additionalSiteInformation":{"url":"https://update.knime.com/analytics-platform/5.12","trusted":true,"enabledByDefault":true,"name":"KNIME Analytics Platform 5.12 Update Site","version":"5.12.0"},"dialog":[{"sectionName":"Options","fields":[{"name":"Authentication type","description":"Authentication type to use. The following types are supported: \n<ul><li><b>Interactive (OAuth 2)</b> : Interactive <i>user login</i> in your web browser, when you click on <i>Login</i> . In the browser window that pops up, you may be asked to consent to the scopes of access. The acquired access token typically will only be valid for a short amount of time, then you need to login again. Technically, this uses the <a href=\"https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-auth-code-flow\" rel=\"ugc nofollow noopener noreferrer\"> OAuth 2.0 authorization code flow</a> .</li><li><b>Username/Password (OAuth 2</b> : Non-interactive <i>user login</i> . This is well-suited for workflows on KNIME Hub, however you cannot to consent to the scopes of access, hence consent must be given beforehand, e.g. during a previous interactive login, or by an Azure AD directory admin. Second, accounts that require multi-factor authentication (MFA) will not work. Technically, this uses the <a href=\"https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth-ropc\" rel=\"ugc nofollow noopener noreferrer\"> OAuth 2.0 Resource Owner Password Credentials flow</a> .</li><li><b>Client/Application secret (OAuth 2)</b> : Non-interactive login as the service principal of the configured client/app. This is well-suited for workflows on KNIME Hub. Technically, this uses the <a href=\"https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-client-creds-grant-flow\" rel=\"ugc nofollow noopener noreferrer\"> OAuth 2.0 client credentials flow</a> . MicrosoftAzure cloud services are accessed on behalf of the application&#39;s service principal, not on behalf of a user <a href=\"https://learn.microsoft.com/en-us/azure/active-directory/develop/scenario-daemon-overview\" rel=\"ugc nofollow noopener noreferrer\"> (see here)</a> .</li><li><b>Azure storage shared key</b> : Authenticates using an Azure storage account and its secret key. Can only be used to access Azure Blob Storage and Azure Data Lake Storage Gen2.</li><li><b>Azure Storage shared access signature (SAS)</b> : Authenticates using a shared access signature (SAS). Can only be used to access Azure Blob Storage and Azure Data Lake Storage Gen2. For more details on shared access signatures see <a href=\"https://docs.microsoft.com/en-us/azure/storage/common/storage-sas-overview\" rel=\"ugc nofollow noopener noreferrer\"> here.</a></li></ul>","optional":false},{"name":"Tenant ID/Domain","description":"The directory tenant the application plans to operate against, in ID or domain-name format, for example <i>cf47ff49-7da6-4603-b339-f4475176432b,</i> or <i>mycompany.onmicrosoft.com.</i>","optional":false},{"name":"Username and password","description":"The username and password to use.","optional":false},{"name":"Client/App ID and secret","description":"The client/app ID and secret to use.","optional":false},{"name":"Storage account and shared key","description":"The storage account name and shared key (also called access key) to use.","optional":false},{"name":"Service SAS URL","description":"The Azure Service SAS URL. Note that only <a href=\"https://learn.microsoft.com/en-us/azure/storage/common/storage-sas-overview#service-sas\" rel=\"ugc nofollow noopener noreferrer\"> Service SAS</a> is supported. The SAS URL must delegate access to the Blob storage service, or an object within.","optional":false},{"name":"Scope type","description":"Scopes are <a href=\"https://learn.microsoft.com/en-us/entra/identity-platform/permissions-consent-overview#types-of-permissions\" rel=\"ugc nofollow noopener noreferrer\"> permissions</a> that need to be requested during login. They specify what the resulting access token can be used for. This setting defines whether to select scopes from a list of predefined <b>standard</b> scopes or to enter <b>custom</b> scopes manually.","optional":false},{"name":"Standard scopes (delegated permissions)","description":"Choose scopes from a predefined list of standard scopes. These scopes are <a href=\"https://learn.microsoft.com/en-us/entra/identity-platform/permissions-consent-overview#types-of-permissions\" rel=\"ugc nofollow noopener noreferrer\"> delegated permissions</a> and define what the resulting access token can be used for.","optional":false},{"name":"Standard scopes (application permissions)","description":"Choose scopes from a predefined list of standard scopes. These scopes are <a href=\"https://learn.microsoft.com/en-us/entra/identity-platform/permissions-consent-overview#types-of-permissions\" rel=\"ugc nofollow noopener noreferrer\"> application permissions</a> and define what the resulting access token can be used for.","optional":false},{"name":"Custom scopes","description":"Enter a list of custom scopes to request during login. These scopes are <a href=\"https://learn.microsoft.com/en-us/entra/identity-platform/permissions-consent-overview#types-of-permissions\" rel=\"ugc nofollow noopener noreferrer\"> permissions</a> and define what the resulting access token can be used for.","optional":false},{"name":"Azure Storage account","description":"If the Azure Blob Storage/Azure Data Lake Storage Gen2 scope is chosen, then this field specifies the specific Azure storage account to request access to.","optional":false},{"name":"Which authorization endpoint to use","description":"Whether to use the Microsoft default authorization endpoint, or a custom one.","optional":false},{"name":"Custom endpoint URL","description":"Custom authorization endpoint URL to use.","optional":false},{"name":"Which client/app to use","description":"Whether to use the KNIME default app, or enter a custom one. The KNIME default app is called &#34;KNIME Analytics Platform&#34; and its ID is cf47ff49-7da6-4603-b339-f4475176432b.","optional":false},{"name":"ID","description":"The custom client/app ID to use.","optional":false},{"name":"Redirect URL (should be http://localhost:XXXXX)","description":"Redirect URL to use during interactive login. Technical note: Only URLs such as http://localhost:37489 are allowed (localhost, no https, random non-privileged port number). Any URL entered here must be part of the configuration of your custom app.","optional":false},{"name":"HTTP User-Agent","description":"Whether to use the default HTTP User-Agent or a custom one, when fetching the OAuth2 access token. The default User-Agent is OS-specific, for example &#34;KNIME (Windows 11)&#34;. A custom User-Agent only needs to be set in rare cases, for example if the default User-Agent is rejected by a conditional access rule in Azure Entra ID.","optional":false},{"name":"Custom HTTP User-Agent","description":"Sets a custom HTTP User-Agent when fetching the OAuth2 access token. This only needs to be set in rare cases, where the default KNIME User-Agent is rejected.","optional":false},{"name":"Login","description":"Clicking on login opens a new browser window/tab which allows to interactively log into the service.","optional":false}]}],"links":[],"kudos":[{"accountId":"account:user:b5888967-43dc-473e-a378-56a1e9ecd734","user":"fhernandez","date":"2026-03-24T15:43:30+00:00"}],"kudosCount":1,"bundleInformation":{"bundleVersion":"5.4.0.v202411261352","bundleName":"Microsoft authentication extension for KNIME Workbench","bundleSymbolicName":"org.knime.ext.microsoft.authentication","bundleVendor":"KNIME AG, Zurich, Switzerland","featureSymbolicName":"org.knime.features.ext.office365.filehandling","featureName":"KNIME Office 365 Connectors","featureVersion":"5.12.0.v202604301232","featureVendor":"KNIME AG, Zurich, Switzerland","extensionId":"*rWpIjDx0kHihyqtm"},"frequentSuccessors":[]}