Requirements

• ONLYOFFICE Document Server v7.1 (server or cloud version) or later
  You need to enable WOPI following this instruction.

  You need an instance of ONLYOFFICE Docs that is resolvable and connectable both from SharePoint and any end clients. It must be able to POST to SharePoint directly.

  Please refer to the official documentation page to learn more about installing ONLYOFFICE Docs.
• SharePoint 2019
• ONLYOFFICE Connector 3.0 for SharePoint

Installing and configuring ONLYOFFICE and SharePoint

The ONLYOFFICE SharePoint integration solution is an official ONLYOFFICE connector available on GitHub page under the GNU AGPL v.3 licence.

1. Click Start, point to All Programs, point to Administrative Tools, then click Services, and make sure that SharePoint Administration service is started.
2. Click Start, click SharePoint Management Shell, go to the directory with the .wsp file.
3. Run the Install.ps1 script:

   PS> .\Install.ps1

4. Enter your SharePoint site address:

   https://<yoursharepointsite>

   Instead of steps 3 and 4 you can type the following command:

   Add-SPSolution -LiteralPath<solutionpath>/onlyoffice.wsp

   On the SharePoint Central Administration home page, click System Settings > Farm Management > Manage farm solutions. On the Solution Management page, click onlyoffice.wsp, then click Deploy Solution.

5. On the SharePoint Central Administration home page, under Application Management, click Manage web applications.
6. Make sure you select your site and click the Authentication Providers icon.
7. In the Authentication Providers pop-up window click Default zone.
8. Under Edit Authentication, check Enable anonymous access and click Save.
9. Going back to Web Application Management click on the Anonymous Policy icon.
10. Under Anonymous Access Restrictions select your Zone and set the Permissions to None – No policy and click Save.
11. In SharePoint open the /_layouts/15/Onlyoffice/Settings.aspx page with administrative settings. Enter the following address:

    https://<documentserver>/

    Where the documentserver is the name of the server with the ONLYOFFICE Docs installed. The address must be accessible for the user browser and from the SharePoint server. The SharePoint server address must also be accessible from ONLYOFFICE Docs for correct work.

Starting from ONLYOFFICE Docs v7.2, JWT is enabled by default and the secret key is generated automatically. You need to enable it on the SharePoint side as well: find your secret key in the ONLYOFFICE Docs configuration file, then specify the same secret key in the SharePoint administrative settings. For more details, see the Enabling JWT for the ONLYOFFICE and SharePoint integration section of this article.

If JWT protection is enabled, it is necessary to specify a custom header name since the SharePoint security policy blocks external 'Authorization' Headers. This header should be specified in the ONLYOFFICE Docs signature settings as well (further information can be found here).

Enabling JWT for the ONLYOFFICE and SharePoint integration

To protect documents from unauthorized access, ONLYOFFICE editors use the JSON Web Token (JWT). The token is added in the configuration when the Document Editor is initialized and during the exchange of commands between inner ONLYOFFICE Docs services. The secret key is used to sign the JSON web token and validate the token upon the request to ONLYOFFICE Docs.

Starting from ONLYOFFICE Docs v7.2, JWT is enabled by default and the secret key is generated automatically. You need to find your secret key in the ONLYOFFICE Docs configuration file, then specify the same secret key in the connector settings.

Step 1: Find your secret key in the ONLYOFFICE Docs configuration file

1. Open the local.json file with any available text editor.
   • For Linux - /etc/onlyoffice/documentserver/local.json
   • For Windows - %ProgramFiles%\ONLYOFFICE\DocumentServer\config\local.json
   • For Docker – enter the ONLYOFFICE Docs container using the docker exec -it <containerID> bash command and open /etc/onlyoffice/documentserver/local.json

     Alternatively, you can use the following command to find the default secret key without opening local.json:

     sudo docker exec <containerID> /var/www/onlyoffice/documentserver/npm/json -f /etc/onlyoffice/documentserver/local.json 'services.CoAuthoring.secret.session.string'

   The local.json file should look like this:

   {"services": {"CoAuthoring": {"token": {"enable": {"request": {"inbox": true,"outbox": true},"browser": true}},"secret": {"inbox": {"string": "yoursecret"},"outbox": {"string": "yoursecret"},"session": {"string": "yoursecret"}}}}}

2. The true value is specified in three sections. It means that token validation is enabled.
   • services.CoAuthoring.token.enable.browser
   • services.CoAuthoring.token.enable.request.inbox
   • services.CoAuthoring.token.enable.request.outbox
3. The automatically generated secret key is specified in three sections. You can replace the default secret value with your own secret key. The secret key must be the same in three sections.
   • services.CoAuthoring.secret.inbox.string
   • services.CoAuthoring.secret.outbox.string
   • services.CoAuthoring.secret.session.string
4. If you make changes, save them and restart the services for the config changes to take effect.

   supervisorctl restart all

Step 2: Specify the same secret key in the connector settings

In the connector settings, specify the same secret in the Secret key field and save the settings.