The scheme used for authenticating to SharePoint On-Premise instances. Accepted entries are NTLM, BASIC, DIGEST, FORMS, NONE, NEGOTIATE, and KERBEROSDELEGATION. NTLM is the default.

string

"NTLM"

Together with Password and User, this field is used to authenticate against the server. NTLM is the default option. Use the following options to select your authentication scheme:

NTLM: Set this to use your Windows credentials for authentication.

NEGOTIATE: If

AuthScheme is set to NEGOTIATE, the adapter will negotiate an authentication mechanism with the server. Set AuthScheme to NEGOTIATE if you want to use Kerberos authentication.

KERBEROSDELEGATION: Set this to use delegation through the Kerberos protocol. Set the User and Password of the account you want to impersonate.

NONE: Set this to use anonymous authentication; for example, to access a public site.

FORMS: Set this if your SharePoint instance uses a custom authentication method through a Web form.

DIGEST: Set this to use HTTP Digest authentication.

BASIC: Set this to use HTTP Basic authentication.

AzureMSI: Set this to automatically obtain Managed Service Identity credentials when running on an Azure VM.

If authenticating to Sharepoint Online, set AuthScheme to OAuth.

The Azure Environment to use when establishing a connection.

string

"GLOBAL"

In most cases, leaving the environment set to global will work. However, if your Azure Account has been added to a different environment, the AzureEnvironment may be used to specify which environment.

The Microsoft Online tenant being used to access data. If not specified, your default tentant will be used.

string

""

The Microsoft Online tenant being used to access data. For instance, contoso.onmicrosoft.com. Alternatively, specify the tenant id. This value is the directory Id in the Azure Portal > Azure Active Directory > Properties.

Typically it is not necessary to specify the Tenant. This can be automatically determined by Microsoft when using the OAuthGrantType set to CODE (default). However, it may fail in the case that the user belongs to multiple tenants. For instance, if an Admin of domain A invites a user of domain B to be a guest user. The user will now belong to both tenants. It is a good practice to specify the Tenant, although in general things should normally work without having to specify it.

The AzureTenant is required when setting OAuthGrantType to CLIENT. When using client credentials, there is no user context. The credentials are taken from the context of the app itself. While Microsoft still allows client credentials to be obtained without specifying which Tenant, it has a much lower probability of picking the specific tenant you want to work with. For this reason, we require AzureTenant to be explicitly stated for all client credentials connections to ensure you get credentials that are applicable for the domain you intend to connect to.

The data type to be used for calculated fields.

string

""

The data type to be used for calculated fields. By default, the data type is determined by the type of calculated field in SharePoint. However, in some cases these calculated fields may return values that are not appropriate for the specified type. In these instances, you may wish to set the Calculated Data Type to String.

The OAuth callback URL to return to when authenticating. This value must match the callback URL you specify in your Add-In settings.

string

""

During the authentication process, the OAuth authorization server redirects the user to this URL. This value must match the callback URL you specify in your Add-In settings

Indicates whether or not to continue updating items in a batch after an error.

bool

true

If this property is set to True (default), the adapter will continue adding, updating, or deleting items when an error is encountered on one of the items. When set to False, the adapter will stop adding, updating, or deleting items after an error is encountered (entries preceeding the problematic entry will still be added, updated, or deleted).

Indicates whether or not to create supplemental ID columns for SharePoint columns that use values from information stored in other Lists.

bool

true

Indicates whether or not to create supplemental ID columns for SharePoint columns that use values from information stored in other Lists (like "Lookup" or "Person or Group" columns). The ID column that is created will contain the related entry's ID (in the context of its original List). If set to false, the ID columns will not be created, the ID will be ignored, and only the value of the referenced column will be returned.

A password used to authenticate to a proxy-based firewall.

string

""

This property is passed to the proxy specified by FirewallServer and FirewallPort, following the authentication method specified by FirewallType.

The TCP port for a proxy-based firewall.

string

""

This specifies the TCP port for a proxy allowing traversal of a firewall. Use FirewallServer to specify the name or IP address. Specify the protocol with FirewallType.

The name or IP address of a proxy-based firewall.

string

""

This property specifies the IP address, DNS name, or host name of a proxy allowing traversal of a firewall. The protocol is specified by FirewallType: Use FirewallServer with this property to connect through SOCKS or do tunneling. Use ProxyServer to connect to an HTTP proxy.

Note that the adapter uses the system proxy by default. To use a different proxy, set ProxyAutoDetect to false.

The protocol used by a proxy-based firewall.

string

"NONE"

This property specifies the protocol that the adapter will use to tunnel traffic through the FirewallServer proxy. Note that by default the adapter connects to the system proxy; to disable this behavior and connect to one of the following proxy types, set ProxyAutoDetect to false.

 

 

To connect to HTTP proxies, use ProxyServer and ProxyPort. To authenticate to HTTP proxies, use ProxyAuthScheme, ProxyUser, and ProxyPassword.

The user name to use to authenticate with a proxy-based firewall.

string

""

The FirewallUser and FirewallPassword properties are used to authenticate against the proxy specified in FirewallServer and FirewallPort, following the authentication method specified in FirewallType.

An option to determine how to display folders in results. Enter either FilesOnly, FilesAndFolders, Recursive, or RecursiveAll.

string

"RecursiveAll"

An option to determine how to display folders in results. FilesOnly will display only files in specified lists or libraries. FilesAndFolders will display files and folders in the specified list. RecursiveAll will display files in the specified list and all subfolders.

This option controls whether the driver returns the lookup columns defined on a table.

bool

true

This option controls whether the driver returns the lookup columns defined on a table. The SharePoint server may reject the request if too many lookup columns are included in a single query.

Set this property to initiate the process to obtain or refresh the OAuth access token when you connect.

string

"OFF"

The following options are available:

OFF: Indicates that the OAuth flow will be handled entirely by the user. An OAuthAccessToken will be required to authenticate.

GETANDREFRESH: Indicates that the entire OAuth Flow will be handled by the adapter. If no token currently exists, it will be obtained by prompting the user via the browser. If a token exists, it will be refreshed when applicable.

REFRESH: Indicates that the adapter will only handle refreshing the OAuthAccessToken. The user will never be prompted by the adapter to authenticate via the browser. The user must handle obtaining the OAuthAccessToken and OAuthRefreshToken initially.

The Kerberos Key Distribution Center (KDC) service used to authenticate the user.

string

""

The Kerberos properties are used when using Windows Authentication. The adapter will request session tickets and temporary session keys from the Kerberos Key Distribution Center (KDC) service. The Kerberos Key Distribution Center (KDC) service is conventionally colocated with the domain controller. If Kerberos KDC is not specified the adapter will attempt to detect these properties automatically from the following locations:

Java System Properties: Kerberos settings can be configured in Java using the config file krb5.conf, or using the system properties java.security.krb5.realm and java.security.krb5.kdc. The adapter will use the system settings if KerberosRealm

and KerberosKDC are not explicitly set.

Domain Name and Host: The adapter will infer the Kerberos Realm and Kerberos KDC from the configured domain name and host as a last resort.

Note: Windows authentication is supported in JRE 1.6 and above only.

The Keytab file containing your pairs of Kerberos principals and encrypted keys.

string

""

The Keytab file containing your pairs of Kerberos principals and encrypted keys.

The Kerberos Realm used to authenticate the user with.

string

""

The Kerberos properties are used when using SPNEGO or Windows Authentication. The Kerberos Realm is used to authenticate the user with the Kerberos Key Distribution Service (KDC). The Kerberos Realm can be configured by an administrator to be any string, but conventionally it is based on the domain name. If Kerberos Realm is not specified the adapter will attempt to detect these properties automatically from the following locations:

Java System Properties: Kerberos settings can be configured in Java using a config file (krb5.conf) or using the system properties java.security.krb5.realm and java.security.krb5.kdc. The adapter will use the system settings if KerberosRealm and KerberosKDC

are not explicitly set.

Domain Name and Host: The adapter will infer the Kerberos Realm and Kerberos KDC from the user-configured domain name and host as a last resort. This might work in some Windows environments.

Note: Kerberos-based authentication is supported in JRE 1.6 and above only.

The Kerberos KDC of the service.

string

""

The KerberosServiceKDC is used to specify the service Kerberos KDC when using cross-realm Kerberos authentication.

In most cases, a single realm and KDC machine are used to perform the Kerberos authentication and this property is not required.

This property is available for complex setups where a different realm and KDC machine are used to obtain an authentication ticket (AS request) and a service ticket (TGS request).

The Kerberos realm of the service.

string

""

The KerberosServiceRealm is the specify the service Kerberos realm when using cross-realm Kerberos authentication.

In most cases, a single realm and KDC machine are used to perform the Kerberos authentication and this property is not required.

This property is available for complex setups where a different realm and KDC machine are used to obtain an authentication ticket (AS request) and a service ticket (TGS request).

The Service Principal Name for the Kerberos Domain Controller.

string

""

If the Service Principal Name on the Kerberos Domain Controller is not the same as the URL that you are authenticating to, set the Service Principal Name here.

The full file path to an MIT Kerberos credential cache file.

string

""

This property can be set if you wish to use a credential cache file that was created using the MIT Kerberos Ticket Manager or kinit command.

A path to the directory that contains the schema files defining tables, views, and stored procedures.

string

""

The path to a directory which contains the schema files for the adapter (.rsd files for tables and views, .rsb files for stored procedures). The Location property is only needed if you would like to customize definitions (e.g., change a column name, ignore a column, etc.) or extend the data model with new tables, views, or stored procedures.

The schema files are deployed alongside the adapter assemblies. You must also ensure that Location points to the folder that contains the schema files. The folder location can be a relative path from the location of the executable.

Core modules to be included in the log file.

string

""

Only the modules specified (separated by ';') will be included in the log file. By default all modules are included.

Limits the number of rows returned rows when no aggregation or group by is used in the query. This helps avoid performance issues at design time.

string

"-1"

Limits the number of rows returned rows when no aggregation or group by is used in the query. This helps avoid performance issues at design time.

The access token for connecting using OAuth.

string

""

The OAuthAccessToken property is used to connect using OAuth. The OAuthAccessToken is retrieved from the OAuth server as part of the authentication process. It has a server-dependent timeout and can be reused between requests.

The access token is used in place of your user name and password. The access token protects your credentials by keeping them on the server.

The client ID assigned when you register your application with an OAuth authorization server.

string

""

As part of registering an OAuth application, you will receive the OAuthClientId value, sometimes also called a consumer key, and a client secret, the OAuthClientSecret.

The client secret assigned when you register your application with an OAuth authorization server.

string

""

As part of registering an OAuth application, you will receive the OAuthClientId, also called a consumer key. You will also receive a client secret, also called a consumer secret. Set the client secret in the OAuthClientSecret property.

The lifetime in seconds of the OAuth AccessToken.

string

""

Pair with OAuthTokenTimestamp to determine when the AccessToken will expire.

The grant type for the OAuth flow.

string

"CODE"

The grant type for the OAuth flow. The following options are available: CODE,CLIENT,PASSWORD

The OAuth refresh token for the corresponding OAuth access token.

string

""

The OAuthRefreshToken property is used to refresh the OAuthAccessToken when using OAuth authentication.

The location of the settings file where OAuth values are saved when InitiateOAuth is set to GETANDREFRESH or REFRESH. Alternatively, this can be held in memory by specifying a value starting with memory://.

string

"%APPDATA%\\CData\\SharePoint Data Provider\\OAuthSettings.txt"

When InitiateOAuth is set to GETANDREFRESH or REFRESH, the adapter saves OAuth values to avoid requiring the user to manually enter OAuth connection properties and allowing the credentials to be shared across connections or processes.

Alternatively to specifying a file path, memory storage can be used instead. Memory locations are specified by using a value starting with 'memory://' followed by a unique identifier for that set of credentials (ex: memory://user1). The identifier can be anything you choose but should be unique to the user. Unlike with the file based storage, you must manually store the credentials when closing the connection with memory storage to be able to set them in the connection when the process is started again. The OAuth property values can be retrieved with a query to the sys_connection_props system table. If there are multiple connections using the same credentials, the properties should be read from the last connection to be closed.

If left unspecified, the default location is "%APPDATA%\\CData\\SharePoint Data Provider\\OAuthSettings.txt" with %APPDATA% being set to the user's configuration directory:

The Unix epoch timestamp in milliseconds when the current Access Token was created.

string

""

Pair with OAuthExpiresIn to determine when the AccessToken will expire.

The verifier code returned from the OAuth authorization URL.

string

""

The verifier code returned from the OAuth authorization URL. This can be used on systems where a browser cannot be launched such as headless systems.

Set OAuthSettingsLocation along with OAuthVerifier. When you connect, the adapter exchanges the OAuthVerifier for the OAuth authentication tokens and saves them, encrypted, to the specified file. Set InitiateOAuth to GETANDREFRESH automate the exchange.

Once the OAuth settings file has been generated, you can remove OAuthVerifier from the connection properties and connect with OAuthSettingsLocation set.

To automatically refresh the OAuth token values, set OAuthSettingsLocation and additionally set InitiateOAuth to REFRESH.

These hidden properties are used only in specific use cases.

string

""

The properties listed below are available for specific use cases. Normal driver use cases and functionality should not require these properties.

Specify multiple properties in a semicolon-separated list.

 

The number of results to return per page of data retrieved from SharePoint.

string

"1000"

The number of results to return per page of data retrieved from SharePoint. Higher page sizes will result in fewer requests, but timeouts may occur.

The password used to authenticate the user.

string

""

The User, Password, and AuthScheme are together used to authenticate with the server.

The authentication type to use to authenticate to the ProxyServer proxy.

string

"BASIC"

This value specifies the authentication type to use to authenticate to the HTTP proxy specified by ProxyServer and ProxyPort.

Note that the adapter will use the system proxy settings by default, without further configuration needed; if you want to connect to another proxy, you will need to set ProxyAutoDetect to false, in addition to ProxyServer and ProxyPort. To authenticate, set ProxyAuthScheme and set ProxyUser and ProxyPassword, if needed.

The authentication type can be one of the following:

BASIC: The adapter performs HTTP BASIC authentication.

DIGEST: The adapter performs HTTP DIGEST authentication.

NEGOTIATE: The adapter retrieves an NTLM or Kerberos token based on the applicable protocol for authentication.

PROPRIETARY: The adapter does not generate an NTLM or Kerberos token. You must supply this token in the Authorization header of the HTTP request.

If you need to use another authentication type, such as SOCKS 5 authentication, see Firewall Type.

This indicates whether to use the system proxy settings or not. Set ProxyAutoDetect to FALSE to use custom proxy settings. This takes precedence over other proxy settings.

bool

true

By default, the adapter uses the system HTTP proxy. Set this to false if you want to connect to another proxy.

To connect to an HTTP proxy, see Proxy Server.

For other proxies, such as SOCKS or tunneling, see Firewall Type.

A semicolon separated list of hosts or IPs that will be exempt from connecting through the ProxyServer .

string

""

The ProxyServer will be used for all addresses, except for addresses defined in this property. Use semicolons to separate entries.

Note that the adapter will use the system proxy settings by default, without further configuration needed; if you want to explicitly configure proxy exceptions for this connection, you will need to set ProxyAutoDetect to false, and configure ProxyServer and ProxyPort. To authenticate, set ProxyAuthScheme and set ProxyUser and ProxyPassword, if needed.

A password to be used to authenticate to the ProxyServer proxy.

string

""

This property is used to authenticate to an HTTP proxy server that supports NTLM (Windows), Kerberos, or HTTP authentication. To specify the HTTP proxy, you can set ProxyServer and ProxyPort. To specify the authentication type, set ProxyAuthScheme.

If you are using HTTP authentication, additionally set ProxyUser and ProxyPassword to HTTP proxy.

If you are using NTLM authentication, set ProxyUser and ProxyPassword to your Windows password. You may also need these to complete Kerberos authentication.

For SOCKS 5 authentication or tunneling, see Firewall Type.

By default, the adapter uses the system proxy. If you want to connect to another proxy, set ProxyAutoDetect to false.

The TCP port the ProxyServer proxy is running on.

string

"80"

The port the HTTP proxy is running on that you want to redirect HTTP traffic through. Specify the HTTP proxy in ProxyServer. For other proxy types, see Firewall Type.

The hostname or IP address of a proxy to route HTTP traffic through.

string

""

The hostname or IP address of a proxy to route HTTP traffic through. The adapter can use the HTTP, Windows (NTLM), or Kerberos authentication types to authenticate to an HTTP proxy.

If you need to connect through a SOCKS proxy or tunnel the connection, see Firewall Type.

By default, the adapter uses the system proxy. If you need to use another proxy, set ProxyAutoDetect to false.

The SSL type to use when connecting to the ProxyServer proxy.

string

"AUTO"

This property determines when to use SSL for the connection to an HTTP proxy specified by ProxyServer. This value can be AUTO, ALWAYS, NEVER, or TUNNEL. The applicable values are the following:

 

A user name to be used to authenticate to the ProxyServer proxy.

string

""

The ProxyUser and ProxyPassword options are used to connect and authenticate against the HTTP proxy specified in ProxyServer.

You can select one of the available authentication types in ProxyAuthScheme. If you are using HTTP authentication, set this to the username of a user recognized by the HTTP proxy. If you are using Windows or Kerberos authentication, set this property to a username in one of the following formats:

You can use this property to enforce read-only access to SharePoint from the provider.

bool

false

If this property is set to true, the adapter will allow only SELECT queries. INSERT, UPDATE, DELETE, and stored procedure queries will cause an error to be thrown.

The type of schema to use.

string

"SOAP"

The schemas available are REST (to use Sharepoint REST API) and SOAP (to use Sharepoint SOAP API).

The edition of SharePoint being used. Set either SharePoint Online or SharePoint On-Premise.

string

"SharePoint OnPremise"

The edition of SharePoint being used. Set either SharePoint Online or SharePoint On-Premise.

Boolean determining if hidden columns should be shown or not. If false, all hidden columns will be removed from the column listing.

bool

false

Boolean determining if hidden columns should be shown or not. If false, all hidden columns will be removed from the column listing.

Boolean determining if predefined columns should be shown or not. If false, all columns derived from a base type will be removed from the column listing.

bool

true

Boolean determining if predefined columns should be shown or not. If false, all columns derived from a base type will be removed from the column listing. These columns are normally system columns such as CreatedBy and Author. But, predefined columns may also include common columns such as Title.

Indicate whether to display the view of list versions. Such as ListA_Versions.

bool

false

Indicate whether to display the view of list versions. Such as ListA_Versions.

The TLS/SSL client certificate store for SSL Client Authentication (2-way SSL).

string

""

The name of the certificate store for the client certificate.

The SSLClientCertType field specifies the type of the certificate store specified by SSLClientCert. If the store is password protected, specify the password in SSLClientCertPassword.

SSLClientCert is used in conjunction with the SSLClientCertSubject field in order to specify client certificates. If SSLClientCert has a value, and SSLClientCertSubject is set, a search for a certificate is initiated. See SSLClientCertSubject for more information.

Designations of certificate stores are platform-dependent.

The following are designations of the most common User and Machine certificate stores in Windows:

 

In Java, the certificate store normally is a file containing certificates and optional private keys.

When the certificate store type is PFXFile, this property must be set to the name of the file. When the type is PFXBlob, the property must be set to the binary contents of a PFX file (for example, PKCS12 certificate store).

The password for the TLS/SSL client certificate.

string

""

If the certificate store is of a type that requires a password, this property is used to specify that password to open the certificate store.

The subject of the TLS/SSL client certificate.

string

"*"

When loading a certificate the subject is used to locate the certificate in the store.

If an exact match is not found, the store is searched for subjects containing the value of the property. If a match is still not found, the property is set to an empty string, and no certificate is selected.

The special value "*" picks the first certificate in the certificate store.

The certificate subject is a comma separated list of distinguished name fields and values. For example, "CN=www.server.com, OU=test, C=US, E=support@company.com". The common fields and their meanings are shown below.

 

The type of key store containing the TLS/SSL client certificate.

string

""

This property can take one of the following values:

 

The certificate to be accepted from the server when connecting using TLS/SSL.

string

""

If using a TLS/SSL connection, this property can be used to specify the TLS/SSL certificate to be accepted from the server. Any other certificate that is not trusted by the machine will be rejected.

This property can take the forms:

 

 

If not specified, any certificate trusted by the machine will be accepted. Use '*' to signify to accept all certificates (not recommended for security concerns).

The domain of the user when using single sign-on (SSO).

string

""

This property is only applicable when using single sign-on (UseSSO is set to true) and if the domain of the User (e.g. user@mydomain.com) is different than the domain configured within the SSO service (e.g. user@myssodomain.com).

This property may be required when using the AD FS, OneLogin, or OKTA SSO services.

The identity provider's login URL.

string

""

The identity provider's login URL. This property can be found in the SharePoint account settings by navigating to Administration Setup > Security Controls > Single Sign-On Settings and then choosing the desired organization.

The password of the SSOProvider used to authenticate the user.

string

""

The SSOUser and SSOPassword are together used to authenticate with the SSOProvider.

Additional properties required to connect to the identity provider in a semicolon-separated list.

string

""

Additional properties required to connect to the identity provider in a semicolon-separated list. SSOProperties is used in conjunction with the SSOLoginUrl.

The name of the SSO provider you are trying to authenticate.

string

"OKTA"

The name of the SSO provider you are trying to authenticate. The following options are available: OKTA,OneLogin,ADFS

The SSOProvider user account used to authenticate.

string

""

Together with SSOPassword, this field is used to authenticate against the specified SSOProvider.

The URL of the security token service (STS) when using single sign-on (SSO).

string

""

The URL of the security token service (STS) when using single sign-on (SSO). This rarely needs to be set explicitly.

The value in seconds until the timeout error is thrown, canceling the operation.

string

"60"

If the Timeout property is set to 0, operations do not time out: They run until they complete successfully or encounter an error condition.

If Timeout expires and the operation is not yet complete, the adapter throws an exception.

The base URL for the site.

string

""

The following are examples of valid URLs:

http://server/SharePoint/

http://server/Sites/mysite/

http://server:90/

The provider will use URL to derive URLs for other calls to the server.

Boolean determining if the display names for the columns should be used instead of the API names.

bool

true

Boolean determining if the display names for the columns should be used instead of the API names.

Determines whether the driver will attempt to connect with NTLMv1 or NTLMv2 (default).

bool

false

Determines whether the driver will attempt to connect with NTLMv1 or NTLMv2 (default).

The SharePoint user account used to authenticate.

string

""

Together with Password, this field is used to authenticate against the SharePoint server.

For SharePoint On-Premise, User should include the domain and will look similar to the following: DOMAIN\Username.

For SharePoint Online, User will look similar to the following: username@domain.onmicrosoft.com.

Boolean determining if simple names should be used for tables and columns.

bool

false

Boolean determining if simple names should be used for tables and columns. SharePoint lists can have special characters in names that are normally not allowed in standard databases. UseSimpleNames makes the adapter easier to use with traditional database tools.

Setting UseSimpleNames to true will simplify the names of tables and columns returned. If set to false, the tables and columns will appear as they do in SharePoint.

Whether or not to use single sign-on (SSO) to authenticate to SharePoint Online.

bool

false

When set to true, single sign-on (SSO) will be used to authenticate to SharePoint Online using the account specified via User and Password. The Active Directory Federation Services (AD FS), OneLogin, and OKTA SSO identity providers are supported.

SSODomain may be required to be set if the domain configured on the SSO domain is different than the domain of the User.

SSO is only applicable when using SharePoint Online. SSO is not supported for On-Premise versions of SharePoint.