2

I have a simple SharePoint-hosted app which wants to create an item in a list in its app web. (Explicitly not in the host web.) That's all.

If my understanding is correct, no special app permissions should be necessary to write to the app web as the app has full control. But it fails.

The app can only create the list item if the current user has also write permissions on the list. So if the user can go to the app web list and create an item, the app can. If the user can't create such an item, the app can't.

My expectation is that the app should always be able to create such an item, regardless of the permissions of the current user.

For completeness this the relevant part of my AppManifest.xml:

<AppPrincipal>
  <Internal />
</AppPrincipal>
<AppPermissionRequests>
</AppPermissionRequests>

Nothing to see here. And this is how I get my client context:

context = SP.ClientContext.get_current();

Where is the error in my thinking?

Improve this question

3 Answers 3

Reset to default
1

If you don't want to be limited by the current user's permissions and still make an entry to a list in the app web (even when the current user does not have the rights), you will have to use the app only policy as mentioned in the other answers.

One additional thing to note is that the app only policy is does not work with SharePoint Hosted Apps as it requires OAuth which is not possible through JavaScript.

So you need to create an autohosted or provider hosted app.

More on this on my blog on the same topic:

http://www.vrdmn.com/2013/01/sharepoint-2013-elevate-user-access.html

Improve this answer
0

From what I have read you need to setup the proper scope and request the proper permission level to access to the list.

Something like:

<AppPermissionRequests>
<AppPermissionRequest Scope="http://sharepoint/content/sitecollection/web/list" Right="Write"/>
</AppPermissionRequests>

The article here has more information that may help you sort it out.

App permissions in SharePoint 2013 http://msdn.microsoft.com/en-us/library/office/apps/fp142383.aspx

Improve this answer
4
  • 1
    From that link, contradicting to what you claim: "The app principal has full control rights to the app web so it only needs to request permissions to SharePoint resources in the host web or other locations outside the app web."
    – Robert Lindgren
    Commented Sep 30, 2013 at 18:07
  • How I read it was full control according to the user permission level. If the User has only a Read permission then the app has full control up that permission level. Which would line up with what Heinrich is seeing. If the user has permission then the app can do its job, otherwise it can't. Adding the explicit scope and permission access in the App Manifest (to me) seems like it would give the app its own permission rights instead of relying on the current user. I am new to the code side so I could be wrong. In the app manifest posted above. There is no AppPermissionRequest.
    – MunkeyWrench
    Commented Sep 30, 2013 at 18:22
  • @MonkeyWrench The same thought came to me, but I read the documentation like Robert - the app always has full control in the app web and doesn't need to request it. When requesting explicit rights the user could rightfully ask why the app would need to access his (host) site when in reality it doesn't have to.
    – Heinrich Ulbricht
    Commented Oct 1, 2013 at 8:07
  • If the app truly has 'full control' then why is it obviously limited by the current user context, and why is there a section for the app to request permission. To me it makes sense to limit any app according to the user because if it didn't you could have applications doing things above the users security permission level. I guess we are splitting the proverbial semantic hair. If you get around this problem I would be very curious how you did it. Otherwise I would guess you'll have to offload some of your functions to something that is not tied to the user like a workflow. Good luck.
    – MunkeyWrench
    Commented Oct 2, 2013 at 15:39
0

By default SharePoint would consider both app and user permissions. However one can overcome this by using <AppPermissionRequests AllowAppOnlyPolicy="true"> in AppManifest.xml file.

For more information: http://msdn.microsoft.com/en-us/library/office/fp179892.aspx

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.