Document how to acquire OneDrive's access_token or at least refer to useful information

Relevant information from openDAL side:

Cross-posting relevant replies from imWildCat #2129 (comment)

To get a working access_token for OneDrive, we can leverage https://crates.io/crates/graph-rs-sdk, especially its demo: https://github.com/sreeise/graph-rs-sdk/tree/master/examples/oauth

From #2129 (comment)

If you'd like to check some tutorials, I did find a quick for you: https://www.youtube.com/watch?v=NljQx11YqNY
In general, OAuth flows for these big techs are pretty complex, sometimes replying on their own SDKs by default. I was working in MSFT. So I knew this very well. For example, if you'd like to use Graph API on iOS/macOS, you might want https://github.com/AzureAD/azure-activedirectory-library-for-objc Why this flow is always complicated? Because they must respect users' privacy and also data compliance, like GDPR. So it is always required something like "User Consent".
The goal of OpenDAL is just a light-weight wrapper of some data uploading / downloading apis. So this lib is not depending on any of these first-party SDKs provided by the service companies.
In my own company, I write these logic into Rust directly, referring to the sample code link I shared above. You'd better check them out before being surprised here. This flow would be easier for you if you write them in Rust for all the other big ones, like Google and/or Dropbox.

Ref: #1161 apache/opendal#4715

FWIW the current Rustic release 0.7.0 has OpenDAL OneDrive support disabled too, so documentation is misleading. I had to manually edit Cargo.toml and rebuild to enable it.

Ref: #1161 (comment)

@intgr

@intgr Would you be able to provide some information about the onedrive config you are using and pull request it against this directory: https://github.com/rustic-rs/rustic/tree/main/config/services

Would be a nice addition :)

I just finally looked into this and got it working

We need the access_token etc, but MS/azure makes it exceedingly difficult to figure out. I found my way to this page but it seems to need you to create some directory now, which I couldnt figure out despite signing up for the developer program.

But my solution came from trying to revive my old rclone:onedrive remote. Rclone seems to have an automated process when you create a onedrive remote that opens a browser and has you log into microsoft and approve it, then it adds the access token, refresh token etc... to the ~/.config/rclone/rclone.conf file

I simply took those values and put it into my ~/.config/rustic/rustic.toml file

[repository.options]
access_token = "rclone.conf token json"
refresh_token = "rclone.conf token json"
client_id = "{rclone.conf drive_id}"
enable_versioning = "false"
root = "path/within/onedrive/to/save/rustic/repo"

other config values are here, but i omitted them

then i just did rustic init and there were some warning messages, but then it worked! Then rustic backup and everything else as normal.

Now I just need to figure out why I would even use this rather than rclone... I dont care about having a separate binary for rclone. Is this any more performant or reliable?

NEVERMIND. This might not work - the token only gets a 1 hour expiry. Rclone will automatically refresh it and update the rclone.conf file. But it doesn't seem to be working for opendal:onedrive. Probably 2 reasons:

missing client_secret - no idea what that should be
im guessing that the rustic opendal mechanism isnt set up to update the rustic.toml file with these values

heres the error output:

[INFO] using config /home/nick/.config/rustic/rustic.toml
[ERROR] service=onedrive name= path=config: stat failed Unexpected (persistent) at stat => {"error":{"code":"InvalidAuthenticationToken","message":"IDX14100: JWT is not well formed, there are no dots (.).\nThe token needs to be in JWS or JWE Compact Serialization Format. (JWS): 'EncodedHeader.EncodedPayload.EncodedSignature'. (JWE): 'EncodedProtectedHeader.EncodedEncryptedKey.EncodedInitializationVector.EncodedCiphertext.EncodedAuthenticationTag'.","innerError":{"date":"2025-07-04T00:37:41","request-id":"zxcv","client-request-id":"zxcv"}}}

Context:
   uri: https://graph.microsoft.com/v1.0/me/drive/root:/Rustic-Backups/wsl2/versioningadsg/config
   response: Parts { status: 401, version: HTTP/1.1, headers: {"transfer-encoding": "chunked", "content-type": "application/json", "strict-transport-security": "max-age=31536000", "request-id": "zxcv", "client-request-id": "zxcv", "x-ms-ags-diagnostic": "{\"ServerInfo\":{\"DataCenter\":\"East US\",\"Slice\":\"E\",\"Ring\":\"5\",\"ScaleUnit\":\"010\",\"RoleInstance\":\"MN1PEPF000278D5\"}}", "date": "Fri, 04 Jul 2025 00:37:41 GMT"} }
   service: onedrive
   path: config

error: `rustic_core` experienced an error related to `the backend`.

Message:
Path `config` does not exist.

Im going back to rclone. But am happy to help debug this if anyone is interested in fixing it

Opened PR #1838 with a OneDrive service profile and credential-mapping coverage.

Navigation Menu

Repository navigation

Document how to acquire OneDrive's `access_token` or at least refer to useful information #1320

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Document how to acquire OneDrive's access_token or at least refer to useful information #1320

Description

Activity

intgr commented on Jun 13, 2024

simonsan commented on Oct 11, 2024

nickchomey commented on Jul 3, 2025

nickchomey commented on Jul 4, 2025

magrathean-uk commented on Aug 1, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Document how to acquire OneDrive's `access_token` or at least refer to useful information #1320