I have a workflow that I'd like to have call a web page inside of the web that it was run. I have turned on Site App Permissions at the site level, looked up the Workflow app id and granted it permissions via the Grant App Permissions page and used the following for the permission set:
Inside SP Designed, I create an App Step that lets me know that I have full read and write when doing anything in this step.
I create a Call Web Service [%Workflow Context:Current Site URL%]SitePages/WorkflowTools.aspx . I just want to make a simple GET request to this page, so I don't pass in anything in the request header. I log the response to the workflow's history. And each time this workflow is run, I always get an unauthorized response. It is definitely permissions, but I can't figure out another way to diagnose this. I don't see anything in the ULS on the WFE or the Workflow server. Is there anywhere else I can look to figure out why this workflow doesn't get elevated permissions?
Update I was able to find in the ULS logs the place that the call is made. The call is definitely being called with no claims attached. Further up in the logs, I can see the Workflow app getting permissions and I can see the claims request for the user initiating the workflow. But it still appears that the actual request is not being sent with any claims.
Further Update I wanted to see if SP could actually do a call against an ASPX page and it appears it can't. I created a new list and a new workflow. I pointed the workflow to call the HTTP web service /_api/web/webs. What I saw in the ULS was the application correctly getting privileged:
Entering monitored scope (Application Authentication Pipeline).
A bunch of lines followed that went through the process of authorizing the user and getting back the list of webs.
I then changed the workflow to point at /SitePages/WorkflowTools.aspx. The first line after the request in the ULS shows
Non-OAuth request. IsAuthenticated=False, UserIdentityName=, ClaimsCount=0
After this call, there are lines that are associated with the correlation id that go on to get authentication information, but the request is never made again to the page. So I guess my conclusion is that you can't call .aspx pages. It appears to not be part of some pre-processing component that SP would do if it were a service call :(
I have updated the service call to be against a WCF service versus a .aspx page and I still get the error. Here's what the Workflow looks like:
Am I just being dense? Why doesn't this get authenticated?