We are trying to deploy our first high-trust SharePoint 2016 app in a non-dev environment but get the common “401 Unauthorized” error. Our environment is as follows:
- SharePoint 2016 Server
- Remote Provider Hosted App-server with IIS 10.0
This Stack Exchange post from 2017 lists almost exactly the same problem and symptoms, but we already have their solution in place (use a CA certificate instead of a self-signed one).
We have double-checked the following:
- Certificate in use (from our internal CA) using a FQDN address, using SHA256 and SAN
- Certificate serial number in web.config (on remote server) is typed by hand
- Certificate private key (on remote server) has Read permission for IIS_IUSR group. (Without this we get a “Keyset does not exist” error.)
- Client ID generated by AppRegnew.aspx is correct in web.config
- Token Issuer ID is correct in web.config
- Everything is running HTTPS, both SharePoint and the remote web server
- Remote web server authentication is set to NTLM followed by Negotiate. Anonymous access is disabled.
- Get-SPTrustedRootAuthority lists our FQDN certificate (as well as an intermediate and root certificate.)
- Get-SPTrustedSecurityTokenIssuer lists our Token Issuer with the RegisteredIssuerName as “IssuerGUID@SharePointRealmGUID”
- The app permissions in our app manifest XML file are “Manage” at SiteCollection level and we have also tried “Full Control” at Tenant level.
SharePoint ULS logs
Error when get token for app i:0i.t|ms.sp.ext|133809c8-e459-44f7-a206-1136bf1c2539@77b99930-703e-4df3-94b0-acc6556794a5, exception: Microsoft.SharePoint.SPException: Azure Access Control Service is unavailable.
at Microsoft.SharePoint.Administration.SPSecurityTokenServiceDiscoveryManager.DiscoverApplicationSecurityTokenService(SPServiceContext serviceContext)
at Microsoft.SharePoint.ApplicationServices.SPApplicationContext.GetApplicationSecurityTokenServicesUri(SPServiceContext serviceContext)
at Microsoft.SharePoint.ApplicationServices.SPApplicationContext..ctor(SPServiceContext serviceContext, SPIdentityContext userIdentity, OAuth2EndpointIdentity applicationEndPoint)
at Microsoft.SharePoint.SPSecurityContext.SecurityTokenForApplicationContext(SPIdentityContext userIdentityContext, String applicationId, Uri applicationRealm, SPApplicationContextAccessTokenType applicationTokenType, SPApplicationDelegationConsentType consentValue)
at Microsoft.SharePoint.SPServerToAppServerAccessTokenManager.GetAccessTokenPrivate(SPServiceContext serviceContext, String appId, Uri appEndpointUrl, SPAppPrincipalInfo appPrincipal, SPApplicationContextAccessTokenType tokenType, Boolean useThreadIdentity, SPUserToken userToken)
App token requested from appredirect.aspx for site: 913136fe-207e-447c-9630-4f0fd88304b0 but there was an error in generating it. This may be a case when we do not need a token or when the app principal was not properly set up. LaunchUrl:https://remoteserver.domain.com/Pages/Default.aspx?SPHostUrl=https://sharepoint.domain.com/sites/site&SPLanguage=sv-SE&SPClientTag=14&SPProductNumber=16.0.4615.1000&SPAppWebUrl=https://app-9f504b2adb7f3a. appdomain.com/sites/site/OurApp Exception Message: Azure Access Control Service is unavailable. Stacktrace:
at Microsoft.SharePoint.Administration.SPSecurityTokenServiceDiscoveryManager.DiscoverApplicationSecurityTokenService(SPServiceContext serviceContext)
at Microsoft.SharePoint.ApplicationServices.SPApplicationContext.GetApplicationSecurityTokenServicesUri(SPServiceContext serviceContext)
at Microsoft.SharePoint.ApplicationServices.SPApplicationContext..ctor(SPServiceContext serviceContext, SPIdentityContext userIdentity, OAuth2EndpointIdentity applicationEndPoint)
at Microsoft.SharePoint.SPSecurityContext.SecurityTokenForApplicationContext(SPIdentityContext userIdentityContext, String applicationId, Uri applicationRealm, SPApplicationContextAccessTokenType applicationTokenType, SPApplicationDelegationConsentType consentValue)
Fiddler logs
Two instanes of 401 – 1) the server presents NTLM and Negotiate options and 2) the client tries with NTLM.
From TextView: SPAppToken=&SPSiteUrl=https%3A%2F%2Fportal.domain.com%2Fsites%2Fsite&SPSiteTitle=Sitename&SPSiteLogoUrl=https%3A%2F%2Fapp-9f504b2adb7f33.domain.appdomain.com%2Fsites%2Fsite%2Fbranding%2FImages%2FSiteIcon.jpg&SPSiteLanguage=sv-SE&SPSiteCulture=sv-SE&SPRedirectMessage=EndpointAuthorityMatches&SPCorrelationId=7b04499f-e991-504a-5c02-7a78bc35c7ee&SPErrorCorrelationId=7b04499f-e991-504a-5c02-7a78bc35c7ee&SPErrorInfo=The Azure Access Control service is unavailable.
We have followed several guides:
Questions:
- Just double-checking that ClientSecret is not needed in the web.config file for high-trust apps? (This Microsoft page says “Note that there is no ClientSecret key in a high-trust SharePoint Add-in.”)
- Please help. :)
Thank you so much for any help!