Play Framework(Scala)对接SharePoint Online认证及访问配置咨询

Great question! Let's tackle your two requirements one by one—first integrating your Scala Play Framework app with Azure AD to access SharePoint data, then securing the SharePoint site collection to specific users or IP addresses.

Scala is fully compatible with Java libraries, so you don't have to rule out Azure's official auth tools entirely. Here are the most reliable approaches:

1. 直接集成 MSAL4J（推荐替代ADAL） #

Note: ADAL has been deprecated by Microsoft, so MSAL4J is the modern, supported alternative. Since Scala can call Java code seamlessly, this is the most straightforward path.

Step 1: Add MSAL4J dependency #

Update your build.sbt to include the library:

libraryDependencies += "com.microsoft.azure" % "msal4j" % "1.14.0"

Step 2: Implement an Azure AD token service #

Create a Play service to fetch access tokens for app-level access (or user-level, if needed):

import com.microsoft.aad.msal4j._
import java.util.concurrent.CompletableFuture
import scala.compat.java8.FutureConverters._
import scala.concurrent.Future

class AzureAdAuthService {
  private val clientId = sys.env.getOrElse("AZURE_CLIENT_ID", "")
  private val clientSecret = sys.env.getOrElse("AZURE_CLIENT_SECRET", "")
  private val tenantId = sys.env.getOrElse("AZURE_TENANT_ID", "")
  private val authority = s"https://login.microsoftonline.com/$tenantId"

  // Fetch token for app-level permissions (client credentials flow)
  def getAppAccessToken(scopes: List[String]): Future[IAuthenticationResult] = {
    val clientCredential = ClientCredentialFactory.createFromSecret(clientSecret)
    val app = ConfidentialClientApplication.builder(clientId, clientCredential)
      .authority(authority)
      .build()

    val params = ClientCredentialParameters.builder(scopes.asJava).build()
    app.acquireToken(params).toScala
  }
}

Step 3: Call SharePoint APIs with the token #

Use Play's WSClient to make authenticated requests to SharePoint's REST API or Microsoft Graph:

import play.api.libs.ws._
import play.api.libs.json.JsValue
import scala.concurrent.Future

class SharePointDataService(ws: WSClient, authService: AzureAdAuthService) {
  private val siteUrl = sys.env.getOrElse("SHAREPOINT_SITE_URL", "")
  // Scope for SharePoint app-level access
  private val scopes = List(s"$siteUrl/.default")

  def getListItems(listTitle: String): Future[JsValue] = {
    authService.getAppAccessToken(scopes)
      .map(token => token.accessToken())
      .flatMap(accessToken =>
        ws.url(s"$siteUrl/_api/web/lists/getbytitle('$listTitle')/items")
          .addHttpHeaders("Authorization" -> s"Bearer $accessToken")
          .addHttpHeaders("Accept" -> "application/json;odata=nometadata")
          .get()
          .map(_.json)
      )
  }
}

2. Use Play's Built-in OAuth2 for User-Level Access #

If your app needs to act on behalf of individual users (instead of a service account), leverage Play's native OAuth2 support to integrate with Azure AD:

Step 1: Configure Azure AD in application.conf #

play.modules.enabled += "play.api.mvc.SecurityModule"

play.oauth2.client {
  azuread {
    authorizationUrl = "https://login.microsoftonline.com/{YOUR_TENANT_ID}/oauth2/v2.0/authorize"
    tokenUrl = "https://login.microsoftonline.com/{YOUR_TENANT_ID}/oauth2/v2.0/token"
    clientId = "{YOUR_CLIENT_ID}"
    clientSecret = "{YOUR_CLIENT_SECRET}"
    redirectUri = "http://localhost:9000/azuread/callback"
    scope = "https://graph.microsoft.com/Sites.Read.All openid profile"
  }
}

Step 2: Build a controller for auth flow #

Create a controller to handle the OAuth2 redirect, token exchange, and subsequent SharePoint API calls using the user's access token.

3. Community-Maintained Scala Libraries #

While limited, you can explore community-built Scala wrappers for Azure AD (e.g., azure-ad-scala). Just ensure the library is actively maintained before adopting it.

You have two layers of control here—SharePoint-native settings and Azure AD conditional access:

1. Limit Access to Specific Users/Security Groups #

Step-by-Step: #

• Navigate to your target site collection > Click Settings (gear icon) > Site Permissions
• Click Stop Inheriting Permissions (if the site inherits from a parent site) to create a unique permission set
• Remove any existing users/groups that shouldn't have access
• Click Add Users > Select specific Azure AD users or security groups > Assign appropriate permissions (e.g., Read, Edit, Full Control)
• For granular control, create custom permission levels via Site Settings > Site Permissions > Permission Levels

2. Restrict Access by IP Address #

Option 1: SharePoint Native IP Restrictions #

Requires SharePoint Online Plan 2 or equivalent licensing:

• Go to the SharePoint Admin Center > Find your site collection > Click Settings > Site Information > View all site settings
• Locate IP Address Restrictions > Select "Allow access only from specific IP address ranges"
• Add your approved IP ranges (supports CIDR notation)

Option 2: Azure AD Conditional Access (More Flexible) #

This lets you combine IP restrictions with user/group rules:

• Go to the Azure AD Portal > Conditional Access > New Policy
• Under Cloud apps or actions, select "SharePoint Online"
• Under Assignments, choose the specific users/groups you want to allow
• Under Conditions > Locations, select "Include > Custom locations" and add your approved IP ranges
• Under Grant, select "Allow access" (or "Block access" for blacklisting)
• Enable the policy to enforce the rules

3. Combine Both Restrictions #

For maximum security, use both SharePoint permission controls and Azure AD conditional access: first filter users/IPs via Azure AD, then lock down granular permissions at the site collection level.

内容的提问来源于stack exchange，提问作者pushpraj rathore