3

I have a workflow that I'd like to have call a web page inside of the web that it was run. I have turned on Site App Permissions at the site level, looked up the Workflow app id and granted it permissions via the Grant App Permissions page and used the following for the permission set:

Inside SP Designed, I create an App Step that lets me know that I have full read and write when doing anything in this step.

I create a Call Web Service [%Workflow Context:Current Site URL%]SitePages/WorkflowTools.aspx . I just want to make a simple GET request to this page, so I don't pass in anything in the request header. I log the response to the workflow's history. And each time this workflow is run, I always get an unauthorized response. It is definitely permissions, but I can't figure out another way to diagnose this. I don't see anything in the ULS on the WFE or the Workflow server. Is there anywhere else I can look to figure out why this workflow doesn't get elevated permissions?

Update I was able to find in the ULS logs the place that the call is made. The call is definitely being called with no claims attached. Further up in the logs, I can see the Workflow app getting permissions and I can see the claims request for the user initiating the workflow. But it still appears that the actual request is not being sent with any claims.

Further Update I wanted to see if SP could actually do a call against an ASPX page and it appears it can't. I created a new list and a new workflow. I pointed the workflow to call the HTTP web service /_api/web/webs. What I saw in the ULS was the application correctly getting privileged:

Entering monitored scope (Application Authentication Pipeline).

A bunch of lines followed that went through the process of authorizing the user and getting back the list of webs.

I then changed the workflow to point at /SitePages/WorkflowTools.aspx. The first line after the request in the ULS shows

Non-OAuth request. IsAuthenticated=False, UserIdentityName=, ClaimsCount=0

After this call, there are lines that are associated with the correlation id that go on to get authentication information, but the request is never made again to the page. So I guess my conclusion is that you can't call .aspx pages. It appears to not be part of some pre-processing component that SP would do if it were a service call :(

Another Update

I have updated the service call to be against a WCF service versus a .aspx page and I still get the error. Here's what the Workflow looks like:

Workflow

Am I just being dense? Why doesn't this get authenticated?

Improve this question
6
  • What Request Headers are you using? I've never used it to call a Site Page, but I guess if the returns in a valid format (JSON) it should be Ok. Also, in the ULS search for the page name and you might see the request get processed. If it didn't hit the page, do you have a proxy that might have been used by the request?
    – Choggo
    Commented Oct 22, 2014 at 16:37
  • @Choggo I haven't put in any request headers as I didn't think I'd need them. I was just hoping to push a GET request to a page in the site. I'll check the ULS for the page and see if I can find something.
    – jkandiko
    Commented Oct 22, 2014 at 16:42
  • I haven't successfully called a web service that doesn't return information in the JSON format so you might not have much luck calling a random aspx page. There are some authentication issues that happen in other situations which I can elaborate if you want
    – Choggo
    Commented Oct 22, 2014 at 17:07
  • 2
    The way to set the authentication header is by right clicking the activity and choosing properties. It's a hidden variable and not the one you set. The one you set is Requestcontent. I've made this mistake before =[
    – Choggo
    Commented Oct 23, 2014 at 17:03
  • @Chogoo You have got to be kidding me! I can't believe I overlooked this! +100
    – jkandiko
    Commented Oct 23, 2014 at 20:53

1 Answer 1

Reset to default
2

I've had a few issues with Authorization for web service calls, here are some alternatives you can try:

For on-premise, use WF Service

Add the Request Header: Authorization= "" I've used this so the workflow can query Project Server's OData and custom WCF Services running with SharePoint. Make sure to give the service account permission on the site collection.

Sources:

  1. http://social.msdn.microsoft.com/Forums/windowsazure/en-US/d3b8dd8f-a1ab-4a52-be58-dfb3e1f2b2eb/httpsend-to-call-custom-wcf-service?forum=wflmgr

  2. http://ranaictiu-technicalblog.blogspot.com.au/2013/04/sharepoint-2013-workflow-use-httpsend.htm

For the WF make calls using app permissions

Set Authorization = "Bearer " + access token This makes the request send the claims tokens for the workflow app.
MSDN About the token

Improve this answer
6
  • let me know the messages you get with these alternatives. I have a meeting now and will try to elaborate more later.
    – Choggo
    Commented Oct 22, 2014 at 17:43
  • I built a dictionary with Authorization and Bearer and sent that with the request. But in the ULS, it still showed 0 for Claims count. Since I am hitting an aspx page, does that make a difference in how SP does its thing? Does it have to be .svc endpoint to send in creds?
    – jkandiko
    Commented Oct 22, 2014 at 18:01
  • I don't know the criteria they use to send the tokens in the header. I know that by default it gets sent as Bearer and with the extra authentication information and that by sending Authorization="" you overwrite that and it seems to use Integrated Authentication. Why do you need to query that page again? Maybe we can find another alternative?
    – Choggo
    Commented Oct 22, 2014 at 20:31
  • I had written a custom web part that did some work on a list that was added to that page. Basically, I'm trying to find a way to edit the Email Alias of dynamic lists that get created during a workflow. Any ideas?
    – jkandiko
    Commented Oct 22, 2014 at 20:43
  • Create a custom WCF web service hsoted in SharePoint and Deployed in a WSP Put your update logic in there and have your Workflow call it instead. You'll need to use the Authorization="" to call this service
    – Choggo
    Commented Oct 22, 2014 at 20:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.