Client Object Model gives 401 when impersonating logged in user - MVC App

Question

I have an ASP.NET MVC app that connects to SharePoint 2010 via the Client OM. When I run ExecuteQuery(), I get a HTTP 401 error from SharePoint.

I have the MVC app set to impersonate the logged in user.

The impersonate setting in web.config (of the MVC app):

<configuration>
    <system.web>
        <identity impersonate="true" />
    </system.web>
</configuration>

The code:

Client Context ctx = new ClientContext("http://sharepoint.company.com/site");
ctx.Credentials = CredentialCache.DefaultNetworkCredentials;

Web web = ctx.Web;
ListCollection lists = web.Lists;

ctx.Load(web);
ctx.Load(lists);

ctx.ExecuteQuery();

The exception:

System.Net.WebException: The remote server returned an error: (401) Unauthorized. at System.Net.HttpWebRequest.GetResponse() at Microsoft.SharePoint.Client.SPWebRequestExecutor.Execute() at Microsoft.SharePoint.Client.ClientContext.EnsureFormDigest() at Microsoft.SharePoint.Client.ClientContext.ExecuteQuery() at MVCApp.Services.SharePointService.GetLibraries()

When I remove the impersonation setting from web.config, the Client OM uses the MVC app's app pool account to connect. When this happens, the connection is successful (after granting the app pool account permissions). Also, if I hard code a user credential instead of using DefaultNetworkCredentials, the connection works as well.

The app is configured for Windows authentication, and Anonymous authentication is disable in IIS.

Things we have tried:

1. ensure the app pool accounts are able to delegate permissions.
2. verified kerberos configuration (we removed some duplicate SPNs)
3. connect from a different server (we are hosting this app on the SharePoint App Server). Connecting from this server means we can't connect to ANY sharepoint instance. Connecting from another server allows us to connect to our DEV environment, but not this server (QA) or our production environment.

What can I do to get the Client OM to delegate the user permissions when connecting to SharePoint?

---

Update

Interestingly, I tried a simple WebRequest to SharePoint, with identical results, which tells me that the issue is not caused by the Client OM:

WebRequest request = WebRequest.Create("http://lopenet.qa.gcu.edu");
request.Credentials = CredentialCache.DefaultNetworkCredentials;

using(WebResponse response = request.GetResponse())
using(StreamReader reader = new StreamReader(response.GetResponseStream()))
{
    return Content(reader.ReadToEnd(), "text/html");
}

Answer 1

This sounds a lot like you are hitting the notorious NTLM Double Hop Problem and I'm sorry to say that there is no way around it aside from changing your authentication to Claims or Kerberos. Neither of which should be taken lightly.

If your code runs on the one of the machines in the SharePoint farm you are attempting to interact with, then you can probably get around this by skipping the second 'hop' altogether and interacting with SharePoint directly via the Object Model on the server rather than through web services.

Answer 2

Does the below link help? I am also facing a similar problem.

http://stackoverflow.com/questions/11691650/getlistitems-request-failed-with-http-status-401-unauthorized/11843756#11843756

Answer 3

Do you have <authentication mode="Windows" /> in there somewhere as well? I believe that is also required.

The below link has some information on the output of a few variables based on the configuration settings of the web.config and IIS

http://stackoverflow.com/a/1688220/1282079