Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

I've created an AppEventReceiver for my High Trust Remote app, when I deploy the app through Visual Studio 2012 I get the following error

The remote event receiver callout failed

The HTTP request is unauthorized with client authentication scheme 'Anonymous'. The authentication header received from the server was 'Negotiate,NTLM'.

My remote app is published to an IIS website with Windows Authentication enabled and Annoymous disabled as detailed in the instructions to set this up in the MSDN docs.

If I turn on Anonymous Authentication it trips up the TokenHelper class (I think because there is no Windows Identity)

From the error message it seems like SharePoint is trying to call the AppEventReceiver endpoint using Anonymous authenctication and my IIS site is expecting NTLM.

They are both hosted on the same server in the same IIS instance.

Am I missing some configuration or setting here?

If I remove the AppEventReceiver, the app deploys without any problems

share|improve this question
    
Did you find any resolution to this problem? I am having the same issue. –  Nadeem Yousuf Jan 3 at 16:11
add comment

1 Answer

Usually an unauthorised (Anonymous) error occurs when a credential is passed on more than once (double hop). This sounds like the issue you are having. This is a security mechanism to help prevent other applications using your credentials.

You can trace it back by logging credential info (username) at different points in your app (e.g. event receiver).

This can be solved using the following approaches:

  • Configure and enable kerberos - this will allow credentials to be passed on more than once. However, this requires a lot of configuration and should be considered carefully at an enterprise level.

  • Use service accounts - Have the user authenticated through the front end of your application (e.g. sharepoint access), then use application to authenticate with resources such as databases.
    You can impersonate a service account inside your application using SPSecurity.Runwithelevatedprivileges. This then runs as the application pool identity of the sharepoint web application.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.