Sharepoint 2013 App Only Token

Question

I am making a Provider-Hosted Sharepoint 2013 app in PHP. I have successfully authenticated with OAuth and can make requests on behalf of a user but I am struggling to figure out how to make requests using the App-Only policy so I can execute requests with elevated permissions.

From my understanding I need to make requests with a App only token, but I do know how to retrieve this. The only examples I can find seem to use a the TokenHelper C# library which does not reveal any implementation details of the underlying requests that need to happen.

Any help would be much appreciated.

Ed

Edit: I have <AppPermissionRequests AllowAppOnlyPolicy="true"> set in my App's manifest

Answer 1

First of all, a user must be a site collection administrator to be able to grant an app to use app-only policy. Once you have installed and trusted (granted) an app, you can use app only requests to the site or web.

Basically there is an accessToken called App Only Token that you have to create in your code to request app only access. Here is the sample code to create app only access token,

string realm = TokenHelper.GetRealmFromTargetUrl(HostWebUri);
string accessToken = TokenHelper.GetAppOnlyAccessToken(TokenHelper.SharePointPrincipal, HostWebUri.Authority, realm).AccessToken;

Realm value is your tenant id. Once we have app only access token, Create a client context,

using (var clientContext = TokenHelper.GetClientContextWithAccessToken(HostWebUri.ToString(), accessToken))
{
   if (clientContext != null)
   {
      clientContext.Load(clientContext.Web);
      clientContext.ExecuteQuery();
   }
}

To understand how it works, Update or create a List Item within host web using app only client context. You will see "SharePoint App" as modified/created by user. Please note that app should have write access on the list in order to update/create list item.

SharePoint bypasses the current user authorization in this case. Obviously, the current user needs to be authenticated in order to be able to perform such operations.