I have created a provider hosted app, in which the app reads a list which is in other site . But I am getting Error 403 when I'm trying to create a ClientContext object of this site.

So if I have context of http://server/sites/site1 and I want to access a list in other site with url http://server/sites/site2. Is this operation possible in CSOM?

I already have the context of the site in which the app is running.

 ClientContext siteContext = new ClientContext("http://some_url");

Please let me know what am I missing.


Error message:

Access denied. You do not have permission to perform this action or access this resource

  • Have you given the permissions to your app in app manifest file? Commented Mar 2, 2015 at 7:05
  • Yes. I have give full permission to the app on the site collection
    – nbi
    Commented Mar 2, 2015 at 7:06
  • 1
    How are you creating the context. Check this for more information: dannyjessee.com/blog/index.php/2014/07/… Commented Mar 2, 2015 at 7:15
  • I have created a clientContext using tokenHelper in page load method and then I'm trying to create context for other site(don't know its correct approach or not)
    – nbi
    Commented Mar 2, 2015 at 7:36

2 Answers 2


I would like to thank Nadeem Yousuf for providing the pointers.

Below is the code that I am using to create context for other site:

    string targetWebUrl = "some site collection url";
    HttpRequest request = "Http Request object"; // you can get it from Page_Load()
    Uri targetWeb = new Uri(targetWebUrl);
    ClientContext clientContext = null;

     string targetRealm = TokenHelper.GetRealmFromTargetUrl(targetWeb);
     var responseToken = TokenHelper.GetAppOnlyAccessToken(TokenHelper.SharePointPrincipal, targetWeb.Authority, targetRealm);

   clientContext = TokenHelper.GetClientContextWithAccessToken(targetWebUrl, responseToken.AccessToken);

The client context will authenticate as the user executing your code. This may be your local system account, depending on how you are running it. You can use Task Manager to locate the process and see what account identity it has.

Whatever identity the code is running under, that account must be added as a User in your site (go to Site Settings-> Users and Groups).

You can also use a specific SP User account to authenticate without changing the identity of your process. To do this, explicitly set the client context credentials like so:

siteContext.Credentials = new NetworkCredential("USERNAME", "PASSWORD", "DOMAIN");

Note that you will have to supply these credentials everytime you instantiate the client context.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.