SharePoint / OneDrive integration
onedrive syncs the checked folders and files of a SharePoint document library into the knowledge base, with scheduling, incremental runs, resume and deletion reconciliation. Files of Microsoft Teams teams and channels live in SharePoint, so they show up as regular libraries. General flow: Data source import.
Personal OneDrives are not offered in this version: only shared libraries are.
Register the app in Microsoft Entra (once, by the customer's admin)
The connector signs in as an application, with no user account or sign-in window. It reads nothing but SharePoint sites.
- Microsoft Entra → Applications → App registrations → New registration. Any name (e.g. "GsKnora"), accounts in this directory only, no redirect URI.
- On the Overview page, note the Application (client) ID and the Directory ID.
- Certificates & secrets → New client secret. Copy the value right away (it is not shown again) and note its expiry date.
- API permissions → Add a permission → Microsoft Graph → Application permissions →
Sites.Read.All, then Grant admin consent.
Sites.Read.All is read-only: GsKnora can neither change nor delete a SharePoint file.
Setup in the knowledge base
- Knowledge base settings → Data sources → New, "SharePoint / OneDrive".
- Enter the directory ID (or primary domain, e.g.
contoso.onmicrosoft.com), the application ID and the secret, then test the connection. The test gets a token and lists one site: it fails on a wrong secret or missing admin consent. - Check a library, folder or file. The first level lists every document library as "Site - Library"; folders open lazily. One data source = one library; create a second source for another one.
- Pick the mode, schedule, conflict strategy and deletion sync, save, then run a manual sync to check.
Checking a folder syncs everything in it, including new files and sub-folders; checking a file syncs that file alone. Only extensions GsKnora can import are offered; OneNote notebooks are skipped.
What a sync does
- Each file is identified by its path in the library. A file whose content is unchanged (same id, content tag and size) is not downloaded again.
- A changed file is re-imported; a file deleted, renamed or moved out of the selection is removed when deletion sync is on (a rename is a delete plus an add).
- Files are stored as
Site - Library/<path>; the name is frozen on the first sync. - An interrupted sync resumes from the last checkpoint.
- A failing file (too large, empty, permission denied) shows in the sync history with its reason; the others go on.
Network and security
| Request | Target | Token |
|---|---|---|
| App token | login.microsoftonline.com | Client secret |
| API (sites, libraries, folders) | graph.microsoft.com | Yes, Authorization: Bearer |
| File download | Pre-signed link returned by Microsoft Graph (*.sharepoint.com) | No |
Microsoft endpoints are fixed and never come from user input. A pagination link pointing anywhere other than graph.microsoft.com is refused, so the token never leaves for another domain. Downloads go through the SSRF-safe client. The secret is encrypted at rest like other data source credentials.
Implementation reference
Package internal/datasource/connector/sharepoint: client.go (app token, Graph calls with retries on 429/5xx and Retry-After, new token on 401), connector.go (test, tree), sync.go (folder-by-folder walk, download, deletion reconciliation), cursor.go (per-path fingerprints). Resource IDs: <library id>:<absolute path>.