Getting data from SharePoint Online with an App, service to service

Question

I have registered an App in my SharePoint Online, and I can use it's ID and secret with the Office Dev PnP PowerShell library. Works like a charm. Now the issue is that we are trying to connect to the SP site to grab some data from another app. We don't want to use OAuth2 with the user, we want to connect with this key/secret to get the data. Seamless to the user.

I tried the path of registering an app in Azure AD, used that id/secret and I do get a token! However, using my app's ID/secret I get a token too, using the following URL. I'd rather use my app in the site over a tenant app.

https://login.microsoftonline.com/{tenant}/oauth2/token.

THEN I grab that access_token and try getting a list from the site using:

https://{tenant}.sharepoint.com/sites/site/_api/web/Lists/GetByTitle('Documents')

The body response {"error_description":"Exception of type 'Microsoft.IdentityModel.Tokens.AudienceUriValidationFailedException' was thrown."}

and x-ms-diagnostics header from the response: 3000003;reason="Invalid audience Uri 'https://{tenant}.sharepoint.com/sites/test'.";category="invalid_client"

Here's the page that got me this far: https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-protocols-oauth-service-to-service. And I tried http://www.andrewconnell.com/blog/user-app-app-only-permissions-client-credentials-grant-flow-in-azure-ad-office-365-apis but not sure where/how to use this cert with Postman. I think the solution, since it works with POSH, is using the App's id/secret in the site instead of the tenant, I don't want to have full access, just 1 site.

Answer 1

There is no cross over between SharePoint app permissions and AzureAD app permissions.

You can use Office PnP libraries to access SharePoint with your clientID and client secret for your SharePoint app.

If you want to use AzureAD app permissions, you can only use Microsoft Graph.

Answer 2

It sounds like you have a working solution with SharePoint App Registration instead of using the Azure credentials.

To be sure, follow this:

1. Register a new app at the site level with url/_layouts/15/appregnew.aspx and record the id and secret
2. Add "access" for the app, specifically with AllowAppOnlyPolicy="true". Use url/_layouts/15/appinv.aspx (Permission XML Details)
3. Use your app id and secret to authenticate any "App Only" client context. There is no user. It effectively elevates permission of anyone you give access to the "hosted" app, to whatever permissions you give it in step 2

I know you kind of already know most/all of this, but I just wanted to ensure you got these steps down pat. At that point, you should be good to go. Errors mean you're trying to use user context with app-only or vice versa. Be sure which one you're using. Doing this in POSTMAN is tricky. Check your headers and verify which flow (app only vs user context) you're using.

Answer 3

Late to the discussion but after hours of reading, testing and troubleshooting I now read the error message

Exception of type 'Microsoft.IdentityModel.Tokens.AudienceUriValidationFailedException' was thrown."

as: "I can see that you have a token, that's good. However there is something wrong with it and I wont tell you what it is. Good luck :) //MS"

For me, it was the permissions on the App Add-in the whole time and this xml permission cheat sheet really helped me. It's fair that when not specifying a token, you get a 403 forbidden. But very confusing that when using the API with a token for an app that doesn't have permissiong required, you get a general Exception thown at you as you can see above.

I wanted to give the app full access to a specific site, but my problem was that I did navigate to

https://tenant-admin.sharepoint.com/_layouts/15/appinv.aspx

when I should have been on

https://tenant-admin.sharepoint.com/site/MySite/_layouts/15/appinv.aspx

when assigning permissions with this XML to the app:

<AppPermissionRequests AllowAppOnlyPolicy="true">  
  <AppPermissionRequest Scope="http://sharepoint/content/sitecollection/web" 
   Right="FullControl" />
</AppPermissionRequests>

Another this I learned the hard way is that when assigning permission for an app on the tenant level. Make sure that you are on https://tenant-admin.sharepoint.com/_layouts/15/appinv.aspx and not https://tenant.sharepoint.com/_layouts/15/appinv.aspx...