Workstation – OneDrive Integration
Brief Overview
Microsoft OneDrive is a file hosting service that Microsoft operates. It enables registered users to share and synchronize their files. OneDrive also works as the storage back-end of the web version of Microsoft Office. OneDrive offers 5 GB of storage space free of charge, with 100 GB, 1 TB, and 6 TB storage options available either separately or with Office 365 subscriptions.
The OneDrive client app adds file synchronization and cloud backup features to its device. The app comes bundled with Microsoft Windows. In addition, Microsoft Office apps directly integrate with OneDrive.
Use Cases
Search for files stored on OneDrive.
Access recent files from the Recently Viewed widget on the homepage.
Security
The Enterprise Search uses 3rd-party integrations to implement a “federal search”. Searches within Workstation are backed by an NLP engine, and a graph database that supports a great user experience. Workstation Enterprise Search doesn't index 3rd-party data on an independently searchable database. See below sequence diagram describes the searching algorithm:
Notes
1. Cache layer saves results for a period of five minutes.
2. Each Adopter Service creates a unique identifier for the results which is meaningless without access to the 3rd-party and stores it in the graph database.
3rd-Party Access and Refresh Tokens
To activate the Enterprise Search (and the Personalized Workspace widgets), each employee is required to grant Workstation permission to access the 3rd-party. The granting process is using the OAuth2.0 protocol. Each time a new access token is granted to the Workstation, the application will encrypt the access and refresh tokens and store it in a remote database.
The encryption process includes a unique private key ("salt") that is generated for each individual at the very first bootstrap and stored in the local machine Keychain. The salt is irreplaceable and not restorable – losing it causes the access tokens to be voided. This security measure is being taken to eliminate identity spoofing when accessing high-sensitive data.
See the diagram below to review the salt generation and storage flow.
Accessing 3rd-Party Content
Accessing 3rd-party content requires end-user consent, and in some cases, mostly on Microsoft products, an organization admin consent. End-users grant Workstation the necessary permission by approving an OAuth2.0 consent screen that is being triggered by them from the Workstation application (“Third-party apps”).
The third-party apps are being approved and verified by third-parties products. By the end of the granting process, the third-party apps provide access and refresh tokens that are used by the search engine to establish the requests.
See 3rd-Party Access and Refresh Tokens section above for more information about the storing mechanism.
While searching, the search engine forwards the request, before hitting the Adopter Service, through the Token Injector; a service that injects the relevant tokens to accomplish the request. The local private key is being handed off over the search HTTPS request for runtime decryption.
JWT Protection
When an end-user initiates a search query - the WalkMe enterprise search starts a search flow that is being protected by a JWT assigned by WalkMe IdP integration, as part of the end-user signing flow:
The JWT is proxying the user identity and keeping any HTTPS request secured and individual.
Grant Administration Consent to WalkMe for OneDrive
1. First, make sure that at-least one person connects OneDrive from your organization. Follow the “Installing OneDrive on Workstation” section below to learn more
2. Then, as an Administrator - go to Azure Portal and connect with your Administrator account
3. Once logged in, select Enterprise Applications
4. Select All Applications and pick WalkMe for OneDrive
5. Select Permission tab and click on Grant admin consent for {{your organization name}}
6. Once clicked, a popup should appear (be aware if you have a popup disabler installed) – optionally, you'll be asked to sign in again – use your Administrator account
7. Click Accept on the dialog, confirming organization users to install, for personal usage, WalkMe for OneDrive
8. Once granted, you shall see a confirmation for each permission on the Application page
Installing OneDrive on Workstation
1. Enable the app in Console
2. Open the Workstation Menu by clicking the widget (on Windows) / the WalkMe icon on the Mac Menu bar, or by hitting ctrl/cmd+shift+E
3. Click the Settings icon in the tabs bar
4. Click Connect on the OneDrive card under Integrations
If the OneDrive card is not available, contact your WalkMe Owner in your organization and ask to enable OneDrive on Workstation.
Segmentation
Integrations can be segmented to a sub-set of users and audiences, rather than being enabled for all end-users. This feature streamlines the integration process and helps to ensure that users are only using the integrations that are relevant to their work.
To segment a Workstation integration:
- Navigate to the Workstation Integrations page in the console
- Click the All button on the integration you would like to segment
- Click Select specific recipients in the Manage Access popup
- Select the audiences or individual users from the dropdowns to handpick who can use the integration
- Click Apply
