> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bagofwords.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SharePoint Server (on-prem)

> Read and search on-premises SharePoint Server document libraries over the REST API with NTLM or Kerberos — no Microsoft Graph or Entra app required

<Note>
  The SharePoint Server connector is part of the **Enterprise Edition**.
</Note>

This connector reads document libraries from a **self-hosted SharePoint Server** farm over SharePoint's own REST API. It is separate from [SharePoint and OneDrive](/data-sources/connectors/sharepoint-onedrive) and [SharePoint Lists](/data-sources/connectors/sharepoint-lists), which both go through Microsoft Graph and need an Entra app registration. Here there is no Graph and no app registration — the backend authenticates to the farm directly with Windows credentials or Kerberos.

The connection is **read-only**. The agent browses, searches, and reads documents; it never writes to SharePoint. Report attachments and saved queries live in Bag of words, not in the source library.

## What the agent sees

A searchable file catalog, scoped to what you configure:

* **Library scope** — all visible document libraries, one named library, or the site's default library. With all libraries, returned paths include the library name.
* **Folder scope** — a folder path, recursive or not, narrowed further with include globs and allowed extensions.
* **File handling** — CSV/TSV and XLS/XLSX load as dataframes; PDF, DOCX, PPTX and text files are extracted for reading; JSON is parsed; anything else can be downloaded as its original binary.

Scope is enforced on every read, including when a read is given an absolute server-relative path, and search hits outside the configured origin, site, library, folder or globs are rejected and re-authorized live.

<Warning>
  Content search depends on the farm's own crawl. A newly uploaded document is matched by **filename** immediately, but its **contents** are only searchable once SharePoint's Search Service Application has crawled it — indexing the catalog in Bag of words does not trigger that crawl.
</Warning>

## Fields

| Field | Required | Default | Notes |
| :- | :- | :- | :- |
| `site_url` | Yes | — | Site URL including the `/sites/<name>` path. **Not** the Central Administration URL. Must be reachable from the backend, and should match your SharePoint alternate access mappings. |
| `drive_name` | No | — | A single document library to expose. Blank uses the site's default library; `*` exposes every visible library. |
| `folder_path` | No | — | Restrict the catalog to a folder within the library. |
| `include_globs` | No | — | Glob patterns narrowing which files are cataloged. |
| `allowed_extensions` | No | — | Restrict the catalog to specific file extensions. |
| `recursive` | No | `true` | Walk subfolders beneath the configured folder. |
| `index_mode` | No | — | Index file metadata up front, or list live on demand. |
| `max_catalog_objects` | No | `5000` | Cap on cataloged files (max `50000`). Narrow the scope instead of raising this for very large libraries. |
| `max_file_size_mb` | No | `50` | Reject oversized downloads before parsing (max `250`), so files are never silently truncated. |
| `allow_http` | No | `false` | Permit unencrypted HTTP. An explicit escape hatch for an isolated test lab — use HTTPS with a trusted certificate everywhere else. |

## Authentication modes

**Windows credentials (NTLM) — `ntlm`** (the default; scopes: system and user)

| Field | Required | Notes |
| :- | :- | :- |
| `username` | Yes | `DOMAIN\username` or `user@domain`. Use a read-only account scoped to the intended libraries. |
| `password` | Yes | That account's password. |

At **system** scope the whole connection uses one service account. At **user** scope each member supplies their own Windows account, so SharePoint applies that person's permissions — members who have not entered credentials are blocked rather than falling back to the service account.

<Note>
  Per-user NTLM is credential-based Windows authentication, **not** automatic single sign-on. Each member enters and tests their own domain username and password once.
</Note>

**Kerberos service account — `kerberos`** (scope: system)

| Field | Required | Notes |
| :- | :- | :- |
| `principal` | No | Optional service-account UPN, e.g. `svc_bow@EXAMPLE.COM`. |

Kerberos authenticates as the **service account**, not as the signed-in Bag of words user — it does not impersonate the caller, and end-user delegation is not implemented by this connector. Choose it for a single shared identity, not for per-person permissions.

The keytab is never uploaded through the connection form. A deployment owner mounts it read-only and points the backend at it (`krb5.conf` plus `KRB5_CLIENT_KTNAME`, or a ticket cache). The backend also needs the `kerberos` extra installed — the shipped Docker image already includes the MIT Kerberos runtime.

## Requirements on the SharePoint side

1. A site URL reachable from the backend, with alternate access mappings configured for it.
2. HTTPS with a trusted certificate. For a private CA, mount a CA bundle and set `REQUESTS_CA_BUNDLE` in the backend environment — certificate validation stays on.
3. A least-privilege account with read access to the selected site and libraries. No Domain Admin or SQL access is needed.
4. For content search: a Search Service Application with a working content source and crawl, and search URLs matching the configured access URL. Verify security trimming with both an allowed and a denied test user.
5. For Kerberos: Windows Integrated Authentication (Negotiate) on the web application, correct unique `HTTP/<site-FQDN>` SPNs for the IIS service identity, working AD DNS and realm configuration, synchronized clocks, and private backend access to the KDC. Kerberos here uses the **HTTP** SPN — not `MSSQLSvc`.

## Not supported

Arbitrary SharePoint lists (use [SharePoint Lists](/data-sources/connectors/sharepoint-lists)), site pages, attachments on list items, any form of write, and Microsoft Graph OAuth. Servers predating the ResourcePath REST API are unverified; the connector is validated against SharePoint Server Subscription Edition.

## Related

* [SharePoint and OneDrive](/data-sources/connectors/sharepoint-onedrive) — the Microsoft Graph equivalent for SharePoint Online and OneDrive.
* [SharePoint Lists](/data-sources/connectors/sharepoint-lists) — lists as queryable tables, over Graph.
* [Authentication and access](/data-sources/authentication) — shared vs per-user credentials across connectors.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.