403 Forbidden on Web Service

Question

I am trying to consume a SharePoint Web Service GetListItems.

The below is the XML request from SoapUI:

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:soap="http://schemas.microsoft.com/sharepoint/soap/">
   <soapenv:Header/>
   <soapenv:Body>
      <soap:GetListItems>

         <soap:listName>OnLineFormsList</soap:listName>

         <soap:Query>
            <Where>
              <Eq>
                 <FieldRef Name="Item Type" />
                 <Value Type="String">Personal</Value>
              </Eq>
             </Where>
         </soap:Query>

         <viewFields>
           <FieldRef Name="Process ID" />
           <FieldRef Name="Title" />
           <FieldRef Name="Description" />
         </viewFields>

         <soap:rowLimit>50</soap:rowLimit>

         <queryOptions xmlns:SOAPSDK9=
              "http://schemas.microsoft.com/sharepoint/soap/" >
           <QueryOptions/>
        </queryOptions>

         <soap:webID></soap:webID>
      </soap:GetListItems>
   </soapenv:Body>
</soapenv:Envelope>

I am getting a 403 FORBIDDEN error each time I try to consume an SP Web Service.

The thing is from within JS code (which is integrated into a Content Editor Web Part in a particular page) I can consume the Web Service, but from SoapUI I can't.

JS Code:

var soapPacket = "<soapenv:Envelope xmlns:soapenv='http://schemas.xmlsoap.org/soap/envelope/'>" +
             " <soapenv:Body> " +
                 " <GetListItems xmlns='http://schemas.microsoft.com/sharepoint/soap/'> " +
                 " <listName>OnlineFormsList</listName> " +
                 " <query><Query> " +
                 " <Where><And><Eq><FieldRef Name='Enabled'/><Value Type='Text'>Yes</Value></Eq> " +
                 " <Eq><FieldRef Name='Index'/><Value Type='Text'>" + index + "</Value></Eq></And></Where> " +
                 " </Query></query> " +
                 " <rowLimit><RowLimit>5000</RowLimit></rowLimit>" +
                 " <viewFields> " +
                 " <ViewFields> " +
                 " <FieldRef Name='Title' /> " +
                 " <FieldRef Name='Description' /> " +
                 " <FieldRef Name='Item_x0020_Type' /> " +
                 " <FieldRef Name='Form_x0020_Link' /> " +
                 " <FieldRef Name='Document_x0020_Link' /> " +
                 " <FieldRef Name='Form_x0020_Publishing_x0020_Type' /> " +
                 " <FieldRef Name='Index' /> " +
                 " <FieldRef Name='Process_x0020_ID' /> " +
                 " <FieldRef Name='Ministry' /> " +
                 " <FieldRef Name='Competent_x0020_Authority' /> " +
                 " <FieldRef Name='Business_x0020_Taxonomy' /> " +
                 " <FieldRef Name='Subject_x0020_Taxonomy' /> " +
                 " <FieldRef Name='Life_x0020_Events_x0020_Taxonomy' /> " +
                 " </ViewFields> " +
                 " </viewFields> " +
                 " </GetListItems> " +
             " </soapenv:Body> " +
             " </soapenv:Envelope> ";

        jQuery.ajax({
        url: "/en/Services-And-Information/eforms/_vti_bin/lists.asmx",
        type: "POST",
        async: true,
        dataType: "xml",
        data: soapPacket,
        complete: processResult,
        contentType: "text/xml; charset=\"utf-8\""
    });

I am using SharePoint 2013 Enterprise.

Answer 1

To consume SharePoint Web Services from SOAP UI the request needs to be authenticated, here is how to specify NTLM auth for SharePoint 2013:

• click AUTH tab at the bottom of the request message editor
• add Add new authorization in Type selector and choose NTLM
• set credentials

Official documentation: Authenticating SOAP Requests

Answer 2

This is straight up authentication/authorisation.

If the users aren't allowed to see anything on the site merely telling them they can request access is telling them something exists. In effect an information leak. There was a clever attack using Search that leveraged something like that.

Your users, for one reason or another, are not being authenticated by SharePoint, or if they are they aren't being authorised to see any content. Take one of your users and use the 'Check Permissions' tool. They almost certainly won't have any rights on the site.

If so then you'll either want to allow annonymous access or to add either an 'All Staff' AD group or 'NTAUTHORITY\All Authenticated' to the site's visitors group.

Also check if Is your site locked by any chance? SP logs should give you the error in case site it locked.

Answer 3

Your SOAPUI query is missing a query tag.

from js:

         " <query><Query> " +
         " blah blah bla " +
         " </Query></query>

From soapUI

 <soap:Query>
    <Where>
      <Eq>
         <FieldRef Name="Item Type" />
         <Value Type="String">Personal</Value>
      </Eq>
     </Where>
 </soap:Query>

Try changing SOAPUI to:

 <soap:query>
    <Query>
      <Where>
         <Eq>
           <FieldRef Name="Item Type" />
           <Value Type="String">Personal</Value>
         </Eq>
       </Where>
     </Query>
 </soap:query>

Answer 4

Note below two things:

1) Is this on a dev server? if so setup your web.config with the following:

Element (Network Settings)

don't do above on live. no need.

2) changed code slightly to get the full url:

var sEnvironment    =   (window.location.href.split(":")[0])+"://"+location.hostname ;

var soapPacket = "<soapenv:Envelope xmlns:soapenv='http://schemas.xmlsoap.org/soap/envelope/'>" +
             " <soapenv:Body> " +
                 " <GetListItems xmlns='http://schemas.microsoft.com/sharepoint/soap/'> " +
                 " <listName>OnlineFormsList</listName> " +
                 " <query><Query> " +
                 " <Where><And><Eq><FieldRef Name='Enabled'/><Value Type='Text'>Yes</Value></Eq> " +
                 " <Eq><FieldRef Name='Index'/><Value Type='Text'>" + index + "</Value></Eq></And></Where> " +
                 " </Query></query> " +
                 " <rowLimit><RowLimit>5000</RowLimit></rowLimit>" +
                 " <viewFields> " +
                 " <ViewFields> " +
                 " <FieldRef Name='Title' /> " +
                 " <FieldRef Name='Description' /> " +
                 " <FieldRef Name='Item_x0020_Type' /> " +
                 " <FieldRef Name='Form_x0020_Link' /> " +
                 " <FieldRef Name='Document_x0020_Link' /> " +
                 " <FieldRef Name='Form_x0020_Publishing_x0020_Type' /> " +
                 " <FieldRef Name='Index' /> " +
                 " <FieldRef Name='Process_x0020_ID' /> " +
                 " <FieldRef Name='Ministry' /> " +
                 " <FieldRef Name='Competent_x0020_Authority' /> " +
                 " <FieldRef Name='Business_x0020_Taxonomy' /> " +
                 " <FieldRef Name='Subject_x0020_Taxonomy' /> " +
                 " <FieldRef Name='Life_x0020_Events_x0020_Taxonomy' /> " +
                 " </ViewFields> " +
                 " </viewFields> " +
                 " </GetListItems> " +
             " </soapenv:Body> " +
             " </soapenv:Envelope> ";

        jQuery.ajax({
        url: sEnvironment+"/en/Services-And-Information/eforms/_vti_bin/lists.asmx",
        type: "POST",
        async: true,
        dataType: "xml",
        data: soapPacket,
        complete: processResult,
        contentType: "text/xml; charset=\"utf-8\""
    });