Forms Based Authentication Sharepoint 2013 Application Forbidden error 403

Question

I am making a Provider-hosted application for SharePoint 2013.

I debug this application on a Development Collection with both Windows Authentication and FBA (Form Based Authentication) activated. I can successfully access to this collection with my Windows account or a user stored in SQL Server. Both accounts are administrators of the collection with full control on it.

When I run the application, I get the usual window asking for the authentication mode I want. After being successfully connected with a user (both are working), I get : "The remote server returned an error: (403) Forbidden" on clientContext.ExecuteQuery().

        var contextToken = TokenHelper.GetContextTokenFromRequest(Page.Request);
        var hostWeb = Page.Request["SPHostUrl"];

        using (var clientContext = new ClientContext(hostWeb))
        {
            clientContext.Load(clientContext.Web, web => web.Title);
            clientContext.ExecuteQuery();
            Response.Write(clientContext.Web.Title);
        }

I should precise that, if I disable the FBA on the collection and only let the Windows authentication, it works like a charm.

What am I doing wrong ? Any idea ?

thanks for helping

Answer 1

I'm not sure if these articles would apply in your situation but adding an event handler for the ExecutingWebRequest solved the Forbidden errors I was getting when making CSOM calls. Although most of these articles apply to previous versions of SharePoint I was able to get it working with our 2013 environment.

http://social.technet.microsoft.com/Forums/en-US/5494d5fe-5ca2-4424-a736-7bb1bd15bd96/how-to-download-file-from-claims-based-sharepoint-site

http://buyevich.blogspot.com/2011/03/accessing-mixed-authentication-web-app.html

http://bernado-nguyen-hoan.com/2011/12/16/making-webrequest-to-sharepoint-using-windows-authentication-in-mixed-mode-authentication/

Something close to this:

var contextToken = TokenHelper.GetContextTokenFromRequest(Page.Request);
var hostWeb = Page.Request["SPHostUrl"];

using (var clientContext = new ClientContext(hostWeb))
{
    clientContext.ExecutingWebRequest += new EventHandler<WebRequestEventArgs>(clientContext_ExecutingWebRequest)
    clientContext.Load(clientContext.Web, web => web.Title);
    clientContext.ExecuteQuery();
    Response.Write(clientContext.Web.Title);
}

And then implement the Event Handler Method like this:

static void clientContext_ExecutingWebRequest(object sender, WebRequestEventArgs e)
{
    e.WebRequestExecutor.WebRequest.Headers.Add(“X-FORMS_BASED_AUTH_ACCEPTED”, “f”);
}