Azure / Microsoft365R

R SDK for interacting with Microsoft 365 APIs
Other
313 stars 44 forks source link

Sending in the name of the admin after authentication #59

Closed vidarvr closed 3 years ago

vidarvr commented 3 years ago

I'm trying to send an email through R using Microsoft365R and blastual. When I run this code I need to authenticate. I'm not an admin so I had to get the one with the admin permission to authenticate.

Now when I send the email it's not from me, but from the admin, i.e. I want the email to be from me@xxx.com but it's actually from admin@xxx.com.

How do I solve this?

library(Microsoft365R)

# Get access to business account
outlb <- get_business_outlook()

# Compose
library(blastula)

email_body <- "Attached is the report"

bl_em <- compose_email(
        body = md(email_body)
)

em <- outlb$create_email(bl_em, subject = "Updated numbers", to = "boss@xxx.com")

# Add attachment
em$add_attachment("00_script/report.pdf")
em$send()
hongooi73 commented 3 years ago

That's not how you're supposed to use the package. You get your admin to approve the app registration, and then you authenticate as yourself.

Your admin is creating a big security hole by authenticating with their account and then sending you the token. By doing that, you can now do anything that they can do, including messing with stuff you're not supposed to access. So please tell them to do things the right way.