SharePoint 2013 and anonymous access problem

Question

We run into following problem:

• We have application, that makes authenticated calls to sharepoint 2013 REST services (PUT and GET). Everything works well, when anonymous access is turned off.
• But we need to enable anonymous access for two or three lists. When this is done, request for FormDigest from C# code fails always with 403 result – forbidden.

• I attach following code that is used for making the call. Again, it works fine when Anonymous Access is disabled for this site collection.

          var contextContent = new StringContent(string.Empty,Encoding.UTF8,"text/xml");
          var contextInfoRequest = await contextInfoClient.PostAsync(url + "/_api/contextinfo", contextContent);
          var contextInfoRequestStr = await contextInfoRequest.Content.ReadAsStringAsync();
  
          var formDigestXml = XDocument.Parse(contextInfoRequestStr);
          var formDigestNode = formDigestXml.Descendants(d + "FormDigestValue").First();
          var formDigest = formDigestNode.Value;
  
          var itemPostBody =
              Encoding.UTF8.GetBytes("{'__metadata':{'type':'" + entityTypeName + "'}, " + jsonProperties + "}");
  
          var addRequest = (HttpWebRequest)WebRequest.Create(queryUrl);
          addRequest.Method = "POST";
          addRequest.ContentType = "application/json;odata=verbose";
          addRequest.Accept = " application/atom+xml"; 
          addRequest.Headers["X-RequestDigest"] = formDigest;
  
          addRequest.Credentials = new NetworkCredential(user, pass, domain);
  
          var itemRequestStream = await addRequest.GetRequestStreamAsync();
          itemRequestStream.Write(itemPostBody, 0, itemPostBody.Length);
  

// Following line causes 403 Frobidden Exception:

            var itemResponse = (HttpWebResponse) await addRequest.GetResponseAsync();
            var respStream = itemResponse.GetResponseStream();
            var l = new List<byte>();
            while (respStream.CanRead)
            {
                var i = respStream.ReadByte();
                if (i == -1) break;
                l.Add((byte)i);
            }
            var xml = Encoding.UTF8.GetString(l.ToArray(),0,l.Count);

Answer 1

unfortunately, afaik (& tested) the REST services are only working for authenticated users. You'll need to create a bridge service calling with credentials the native ones if you want to provide that functionality but since you're authenticating your request, are you sure it's not an authentication issue ? Does the target username / password combination is valid and have sufficient rights to perfom the expected operations ?

Are you obtaining properly the form digest associated with the page / request (eg : the snippet took from Danny Jessee on his post : http://blog.cloudshare.com/2012/12/16/access-and-manipulate-data-in-your-cloudshare-sharepoint-2013-farm-from-anywhere-with-csom-rest-and-odata/ (which I highly advice you to read since it has pretty similar requirements).

string GetFormDigest()

{

// To get the form digest for external calls, need to make a POST request to

// http://siteUrl/_api/contextinfo

Uri uri = new Uri(siteUrl + "_api/contextinfo");

HttpWebRequest requestPost = (HttpWebRequest)WebRequest.Create(uri);

requestPost.Credentials = new NetworkCredential("username", "password", "domain");

requestPost.Method = "POST";

requestPost.ContentLength = 0;

HttpWebResponse responsePost = (HttpWebResponse)requestPost.GetResponse();

XDocument doc = XDocument.Load(responsePost.GetResponseStream());

XNamespace ns_dataservices = "http://schemas.microsoft.com/ado/2007/08/dataservices";

return doc.Descendants(ns_dataservices + "FormDigestValue").First().Value;

}

You should fire this with Fiddler running to see the request / response flows. You might receive a 401/403 if your request is not fully compliant to what SP is expecting (that canary protection took me a while as well in a public SP2010 implementation).

Answer 2

You can disable the Access permission to remote interfaces to the anonymous users, follow this:

1. Navigate to the site (or sub-site) where you wish to enable anonymous access.

2. Go to Settings - Site settings.

3. Under Users and Permissions, click on Site Permissions.

4. Under the Permissions tab, click on Anonymous Access.

5. Choose whether you want Anonymous users to have access to the entire Web site or to lists and libraries only. Uncheck Require Use Remote Interfaces permission if anonymous users are complaining they are having issues accessing the site and then click on OK.

From: http://support.sherweb.com/Faqs/Show/how-to-enable-anonymous-access-to-a-sharepoint-site-sharepoint-2013

Answer 3

Old question but we had the same issue (SP2013) by where a site set up for anonymous access (and Use Remote Interfaces permission ticked) would not work with our REST POST calls, thought I would share our solution in case it helps others.

Our solution was to add the X-RequestForceAuthentication header with a value of true to the request to obtain a digest value.

So assuming the original posters contextInfoClient is an HttpClient then the following code would be required to add the header prior to making the PostAsync call:

contextInfoClient.DefaultRequestHeaders.Add("X-RequestForceAuthentication", "true");