Provider hosted app : throw error 403 on creating clientcontext to other site

Question

I have created a provider hosted app, in which the app reads a list which is in other site . But I am getting Error 403 when I'm trying to create a ClientContext object of this site.

So if I have context of http://server/sites/site1 and I want to access a list in other site with url http://server/sites/site2. Is this operation possible in CSOM?

I already have the context of the site in which the app is running.

 ClientContext siteContext = new ClientContext("http://some_url");

Please let me know what am I missing.

UPDATE

Error message:

Access denied. You do not have permission to perform this action or access this resource

Answer 1

I would like to thank Nadeem Yousuf for providing the pointers.

Below is the code that I am using to create context for other site:

    string targetWebUrl = "some site collection url";
    HttpRequest request = "Http Request object"; // you can get it from Page_Load()
    Uri targetWeb = new Uri(targetWebUrl);
    ClientContext clientContext = null;

     string targetRealm = TokenHelper.GetRealmFromTargetUrl(targetWeb);
     var responseToken = TokenHelper.GetAppOnlyAccessToken(TokenHelper.SharePointPrincipal, targetWeb.Authority, targetRealm);

   clientContext = TokenHelper.GetClientContextWithAccessToken(targetWebUrl, responseToken.AccessToken);

Answer 2

The client context will authenticate as the user executing your code. This may be your local system account, depending on how you are running it. You can use Task Manager to locate the process and see what account identity it has.

Whatever identity the code is running under, that account must be added as a User in your site (go to Site Settings-> Users and Groups).

You can also use a specific SP User account to authenticate without changing the identity of your process. To do this, explicitly set the client context credentials like so:

siteContext.Credentials = new NetworkCredential("USERNAME", "PASSWORD", "DOMAIN");

Note that you will have to supply these credentials everytime you instantiate the client context.