Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

We run into following problem:

  • We have application, that makes authenticated calls to sharepoint 2013 REST services (PUT and GET). Everything works well, when anonymous access is turned off.
  • But we need to enable anonymous access for two or three lists. When this is done, request for FormDigest from C# code fails always with 403 result – forbidden.
  • I attach following code that is used for making the call. Again, it works fine when Anonymous Access is disabled for this site collection.

            var contextContent = new StringContent(string.Empty,Encoding.UTF8,"text/xml");
            var contextInfoRequest = await contextInfoClient.PostAsync(url + "/_api/contextinfo", contextContent);
            var contextInfoRequestStr = await contextInfoRequest.Content.ReadAsStringAsync();
    
            var formDigestXml = XDocument.Parse(contextInfoRequestStr);
            var formDigestNode = formDigestXml.Descendants(d + "FormDigestValue").First();
            var formDigest = formDigestNode.Value;
    
            var itemPostBody =
                Encoding.UTF8.GetBytes("{'__metadata':{'type':'" + entityTypeName + "'}, " + jsonProperties + "}");
    
            var addRequest = (HttpWebRequest)WebRequest.Create(queryUrl);
            addRequest.Method = "POST";
            addRequest.ContentType = "application/json;odata=verbose";
            addRequest.Accept = " application/atom+xml"; 
            addRequest.Headers["X-RequestDigest"] = formDigest;
    
            addRequest.Credentials = new NetworkCredential(user, pass, domain);
    
            var itemRequestStream = await addRequest.GetRequestStreamAsync();
            itemRequestStream.Write(itemPostBody, 0, itemPostBody.Length);
    

// Following line causes 403 Frobidden Exception:

            var itemResponse = (HttpWebResponse) await addRequest.GetResponseAsync();
            var respStream = itemResponse.GetResponseStream();
            var l = new List<byte>();
            while (respStream.CanRead)
            {
                var i = respStream.ReadByte();
                if (i == -1) break;
                l.Add((byte)i);
            }
            var xml = Encoding.UTF8.GetString(l.ToArray(),0,l.Count);
share|improve this question
add comment

2 Answers 2

You can disable the Access permission to remote interfaces to the anonymous users, follow this:

  1. Navigate to the site (or sub-site) where you wish to enable anonymous access.

  2. Go to Settings - Site settings.

  3. Under Users and Permissions, click on Site Permissions.

  4. Under the Permissions tab, click on Anonymous Access.

  5. Choose whether you want Anonymous users to have access to the entire Web site or to lists and libraries only. Uncheck Require Use Remote Interfaces permission if anonymous users are complaining they are having issues accessing the site and then click on OK.

From: http://support.sherweb.com/Faqs/Show/how-to-enable-anonymous-access-to-a-sharepoint-site-sharepoint-2013

share|improve this answer
    
Ernesto, can you include some details regarding the process? We discourage link only posts because blog posts can be moved or deleted. –  Robert Kaucher Mar 31 at 21:53
add comment

unfortunately, afaik (& tested) the REST services are only working for authenticated users. You'll need to create a bridge service calling with credentials the native ones if you want to provide that functionality but since you're authenticating your request, are you sure it's not an authentication issue ? Does the target username / password combination is valid and have sufficient rights to perfom the expected operations ?

Are you obtaining properly the form digest associated with the page / request (eg : the snippet took from Danny Jessee on his post : http://blog.cloudshare.com/2012/12/16/access-and-manipulate-data-in-your-cloudshare-sharepoint-2013-farm-from-anywhere-with-csom-rest-and-odata/ (which I highly advice you to read since it has pretty similar requirements).

string GetFormDigest()

{

// To get the form digest for external calls, need to make a POST request to

// http://siteUrl/_api/contextinfo

Uri uri = new Uri(siteUrl + "_api/contextinfo");

HttpWebRequest requestPost = (HttpWebRequest)WebRequest.Create(uri);

requestPost.Credentials = new NetworkCredential("username", "password", "domain");

requestPost.Method = "POST";

requestPost.ContentLength = 0;

HttpWebResponse responsePost = (HttpWebResponse)requestPost.GetResponse();

XDocument doc = XDocument.Load(responsePost.GetResponseStream());

XNamespace ns_dataservices = "http://schemas.microsoft.com/ado/2007/08/dataservices";

return doc.Descendants(ns_dataservices + "FormDigestValue").First().Value;

}

You should fire this with Fiddler running to see the request / response flows. You might receive a 401/403 if your request is not fully compliant to what SP is expecting (that canary protection took me a while as well in a public SP2010 implementation).

share|improve this answer
    
In our experience, REST service implementation in SharePoint 2010 leaves much to be desired and anonymous inability is one of the known unwelcome limitations, so we switched to Client Object Model, whether JavaScript or otherwise. Haven't tried 2013 yet, though. –  Alexey Krasheninnikov Jan 16 '13 at 7:19
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.