{name}) — always queries tenant root site #52

New issue

Open

opened 2026-10-18 21:13:55 +00:00 by bsakaguchi · 2 comments

bsakaguchi commented

2026-10-18 21:13:55 +00:00

Owner

Originally created by @rteslow on GitHub (Jul 15, 2026).
Original GitHub issue: https://github.com/open-webui/oikb/issues/83

Summary

The SharePoint connector's site resolution always issues a Graph API call against the bare tenant hostname (GET /v1.0/sites/{hostname}), regardless of what follows it in the source string. This means it can only reach document libraries that live at the tenant root site. It cannot reach a subsite (e.g. https://tenant.sharepoint.com/sites/{name}), even though subsites are extremely common in real SharePoint deployments.
Steps to reproduce

Have a document library inside a subsite, e.g.: https://contoso.sharepoint.com/sites/TeamSite/SomeLibrary
Grant the app Sites.Selected read access on that subsite specifically (via POST /sites/{subsite-id}/permissions), confirmed working via direct Graph calls.
Configure .oikb.yaml:

sources:

name: docs
source: sharepoint:contoso.sharepoint.com/TeamSite/SomeLibrary
kb-id:

Run oikb daemon (or oikb sync).

Actual behavior

HTTP Request: GET https://graph.microsoft.com/v1.0/sites/contoso.sharepoint.com "403 Forbidden"
Even after granting the app Sites.Selected read access on the root site as a workaround, the connector then fails to resolve the subsite path at all:

Sync failed for sharepoint:contoso.sharepoint.com/TeamSite/SomeLibrary:
Library 'TeamSite/SomeLibrary' not found. Available: []
This confirms the connector treats everything after the hostname as a single library name to search for within the root site, with no awareness that TeamSite could itself be a separate site.

Expected behavior

The source string should support explicitly addressing a subsite, e.g. one of:
sharepoint:contoso.sharepoint.com/sites/TeamSite/SomeLibrary
or a colon-delimited form matching Graph's own subsite lookup syntax (sites/{hostname}:/sites/{subsite}:), which already works when called directly against Graph:
GET https://graph.microsoft.com/v1.0/sites/contoso.sharepoint.com:/sites/TeamSite

Why this matters

Subsites are a very common SharePoint pattern (departmental sites, project sites, etc.), and Sites.Selected — the least-privilege permission model that the connector's own docs recommend — is typically granted per-subsite, not at the root. Right now those two things don't compose: you can secure a subsite correctly, but the connector can't reach it.
Select from "## Summary" down to the last line above and it should paste cleanly into the GitHub issue body field.

Originally created by @rteslow on GitHub (Jul 15, 2026). Original GitHub issue: https://github.com/open-webui/oikb/issues/83 ## Summary The SharePoint connector's site resolution always issues a Graph API call against the bare tenant hostname (GET /v1.0/sites/{hostname}), regardless of what follows it in the source string. This means it can only reach document libraries that live at the tenant root site. It cannot reach a subsite (e.g. https://tenant.sharepoint.com/sites/{name}), even though subsites are extremely common in real SharePoint deployments. Steps to reproduce Have a document library inside a subsite, e.g.: https://contoso.sharepoint.com/sites/TeamSite/SomeLibrary Grant the app Sites.Selected read access on that subsite specifically (via POST /sites/{subsite-id}/permissions), confirmed working via direct Graph calls. Configure .oikb.yaml: sources: - name: docs source: sharepoint:contoso.sharepoint.com/TeamSite/SomeLibrary kb-id: <kb-id> Run oikb daemon (or oikb sync). ## Actual behavior HTTP Request: GET https://graph.microsoft.com/v1.0/sites/contoso.sharepoint.com "403 Forbidden" Even after granting the app Sites.Selected read access on the root site as a workaround, the connector then fails to resolve the subsite path at all: Sync failed for sharepoint:contoso.sharepoint.com/TeamSite/SomeLibrary: Library 'TeamSite/SomeLibrary' not found. Available: [<list of ROOT SITE libraries only>] This confirms the connector treats everything after the hostname as a single library name to search for within the root site, with no awareness that TeamSite could itself be a separate site. ## Expected behavior The source string should support explicitly addressing a subsite, e.g. one of: sharepoint:contoso.sharepoint.com/sites/TeamSite/SomeLibrary or a colon-delimited form matching Graph's own subsite lookup syntax (sites/{hostname}:/sites/{subsite}:), which already works when called directly against Graph: GET https://graph.microsoft.com/v1.0/sites/contoso.sharepoint.com:/sites/TeamSite ## Why this matters Subsites are a very common SharePoint pattern (departmental sites, project sites, etc.), and Sites.Selected — the least-privilege permission model that the connector's own docs recommend — is typically granted per-subsite, not at the root. Right now those two things don't compose: you can secure a subsite correctly, but the connector can't reach it. Select from "## Summary" down to the last line above and it should paste cleanly into the GitHub issue body field.

bsakaguchi commented

2026-10-18 21:13:56 +00:00

Author

Owner

@Fyrlex commented on GitHub (Jul 20, 2026):

Definitely looking forward to this being resolved

@Fyrlex commented on GitHub (Jul 20, 2026): Definitely looking forward to this being resolved

bsakaguchi commented

2026-10-18 21:13:56 +00:00

Author

Owner

@Fyrlex commented on GitHub (Aug 4, 2026):

Hey, I worked with Claude and it impressively gave a really good approach to solving this issue. I'll be submitting a PR shortly

@Fyrlex commented on GitHub (Aug 4, 2026): Hey, I worked with Claude and it impressively gave a really good approach to solving this issue. I'll be submitting a PR shortly

bsakaguchi referenced this issue

2026-10-18 21:14:20 +00:00

[PR #72] [MERGED] fix: support Google Shared Drives in gdrive connector #98