[Microsoft Teams] Rewrite Microsoft Teams connectors to only depend on application permissions

[artem-shelkovnikov]

Problem Description

Microsoft Teams connector currently uses dual auth that requires both application and delegated permissions:

• client_id/client_secret for delegated permissions
• username/password belonging to an admin for application permissions

This is very problematic and cannot really be used because:

1. username/password auth are really discouraged for Graph API
2. delegated permissions mean that connectors would need to handle MFA and per-user consent. Connectors are not interactive, so there's no real way to handle this

We need to review and fully redesign the connector to make sure it's actually usable.

Proposed Solution

Rewrite the connector having the following in mind:

1. Authentication model should follow the model that Sharepoint Online connector uses - authentication using client_id + client_secret OR certificate
2. Code should be shared with Sharepoint Online connector, such as: token management, Graph API calls and such
3. Only application permissions are allowed. We should follow the least privilege model and sync only entities that are relevant
   3.1 Avoiding .All permissions where .Selected or . WhereInstalled is possible
   3.2 Avoiding Users.Read.All because Users are shared with other applications that are running in Graph like Sharepoint. We need to only sync users that participate in Teams

Current entities that we need to sync are:

• Groups -> Teams to see all groups and teams available in the tenants
• Channels for all known teams, including messages, replies and attachments
• TeamMembers for all teams
• Chats for all TeamMembers, including messages, replies and attachments (group chats)