On the SharePoint side, is it possible somehow to track the user that originates the request from the remote server when using the AppOnlyPolicy?


On the SharePoint side, no.

In a Provider-hosted app, it is the responsibility of the remote web to authenticate the user and pass that identity to SharePoint as part of the token. If you have trusted the app to make app-only calls, then you have to trust the app. :)

  • Thanks for your answer. Nevertheless, my question is about tracking the originating user, not about trust. IIS logs will show the app identity as the requestor. ULS might show some info if the app passes it in the token. Any way to enforce that? – Alex Filipovici Jul 15 '14 at 21:03
  • To enforce the token to contain a user, you remove app-only. – Paul Schaeflein Jul 16 '14 at 20:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.