Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

I have been banging my head against a wall on this problem for weeks now

Warning and Disclaimer .. I have very little JavaScript experience when it comes to REST / Web Services

  • I have an on premises SharePoint 2013 server running on a corporate AD domain
  • SharePoint authentication is Claims based NTLM
  • I have a mobile phone HTML5 app

I want to basically make SharePoint REST (or Web Service) calls from the phone app but I cannot work out how to pass over any NTLM credentials.

Is this even possible natively from JavaScript, or would I have to write my own anonymous Web Services and use the .NET Managed OM to proxy all of my requests around?

share|improve this question
    
I've personally gone the anonymous web service route you mentioned. I've added a bounty to this question because I would really like to know how to do it, if its even possible. –  ToddersLegrande Jul 11 '13 at 18:32
add comment

5 Answers 5

up vote 5 down vote accepted
+250

In your scenario it looks like you have some kind of mobile app running on android or iphone. As you talk about javascript it seems your talking about some kind of webview application (like phonegap). Simplified this is an app that is hosting a browser control. Typical development on the client using native tools for the plattform will work the way you descibe your probleme. The application is handing over the credentials to the object and the object is authenticating against sharepoint. For your scenario there is no native code running as you run in the "browser". In javascript there is no way to authenticate directly within your code. The hosting browser is authenticating against the url and any fututre request within the authenticated "session" is working. In your scenario you will try to access the REST api of sharepoint and the server is sending back a 401 HTTP status code so the browser lets the user enter the credentials. It depends on the API your using to make your REST request this 401 is not handled and the user is not able to authenticate.

If you are using some kind of emulator you can try to capture the traffic using Fiddler (www.fiddler2.com). This is a proxy that shows you any request your made and you will find the HTTP rest url and a 401 as reply.

Possible solutions depending on the software your use:

  • You could try to nagigate the "browser" inside of your application to show some kind of content from the sharepoint server. Try a picture from the sharepoint url. The "browser" normaly trieds to authenticate and will prompt the user to authenticate (depends on the platform). maybe you can change a setting of the "browser" that autnetication is allowed. After that authentication request you should be able top authenticate to the REST service.
  • [EVIL] Switch to basic authentication (you MUST use HTTPS) on the sharepoint web application (maybe a special zone only for the app). Your rest request can be authenticated directly within the url: http :// abc@company.com:1234Pwd@sharepoint.company.com/...

There might also be an issue with the type of authentication. If the mobile platform is only doing NTLM v1 and your company hopfully disallows this authentication (because it is insecure) you will never be able to access the REST endpoint. Try to get some kind of HTTP monitoring sofwtare between you (the app) and the server. Try fiddler or wireshark to gather more information about the problem.

share|improve this answer
    
If there are no constraints that the company is placing on the servers, are we certain basic authentication works with SharePoint this way? Is there any way to salt/hash/encrypt/etc. the credentials in addition to HTTPS? –  ToddersLegrande Jul 15 '13 at 13:31
    
This is what all of my research led me to as well and I couldn't even get basic authentication to work properly either which is why I was looking for examples along with the bounty. That being said this answer has more or less confirmed my thoughts so I'll award the bounty to you. Thanks for answering! –  ToddersLegrande Jul 17 '13 at 14:51
add comment

Roll your mobile app up into a 'provider-hosted' SharePoint app model app. Authenticate using OAuth.

http://msdn.microsoft.com/en-us/library/office/fp142382%28v=office.15%29.aspx

share|improve this answer
add comment

Martin,

The MSDN is quite full of client authentication, have you seen this one http://msdn.microsoft.com/en-us/library/jj870858.aspx#BuildMobileAppsInSharePoint2013ForNonWindowsPhone_AuthenticatingNonWindowsAppForSharePoint and http://www.microsoft.com/resources/msdn/en-us/office/media/video/video.html?cid=sdc&from=mscomsdc&VideoID=b1e7c9c5-0f62-4a78-bb7b-8e283c86145c

For use via Javascript only use http://pholpar.wordpress.com/2013/05/11/accessing-office-365-sharepoint-sites-using-rest-from-a-local-html-javascript-host/ also explained http://code.msdn.microsoft.com/SharePoint-Online-d9fdb136/sourcecode?fileId=100090&pathId=1864657548

share|improve this answer
    
Those all include C# code (which you can't execute on an iPhone / Android device). I was thinking of building a Web Service to generate the cookie using OAuthenticator .. but apparently the cookie is URL based so the JavaScript page needs to be on the same URL as the Web Service (again .. not going to happen) –  Martin Hatch Apr 8 '13 at 9:22
    
Also the ODataAuthenticator class referenced in that sample is part of the SharePoint SDK for Windows Phone .. so how it would execute on iPhone / Droid is confusing at best –  Martin Hatch Apr 8 '13 at 9:42
    
I've updated the answer with actual examples of JavaScript based authentication! –  C. Marius - MVP Feb 15 at 18:05
    
@Marius - I tried the JavaScript method to authenticate, however didn't succeed in getting it to work. I m getting the "HTTP Error 403.14 - Forbidden; The Web server is configured to not list the contents of this directory." error. Any suggestions. –  bkk Jun 5 at 9:25
add comment

i thinks u should include the FEDAUTH HTTP header within your request if you re using jquery with ajax calls .. you can setup default options with $.ajax.setup to specify what default header you should include in your requests good luck

$.ajaxSetup({headers:{
"content-type": "application/json;odata=verbose",
"accept": "application/json;odata=verbose"
}});

you only have to add your FEDAUTH header to the request

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.