7

I have a website on SharePoint Online and a website on SharePoint On-premise. From my On-premise website i want to create a new list on my SharePoint Online site.

To authenticate I used the following codes:


    var soapRequest =
     '<?xml version="1.0" encoding="utf-8"?>
      <soap12:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"  
        xmlns:xsd="http://www.w3.org/2001/XMLSchema"
        xmlns:soap12="http://www.w3.org/2003/05/soap-envelope"> 
      <soap12:Body>  
         <Login xmlns="http://schemas.microsoft.com/sharepoint/soap/">
            <username>username@email.com</username>
            <password>userpassword</password>
         </Login>
      </soap12:Body>
     </soap12:Envelope>';
 

And then:


    $.ajax({ 
          url: myUrl + "_vti_bin/authentication.asmx?op=Login",
          type: "GET",  
          contentType: "text/xml",  
          dataType: "json", 
          data: soapRequest, 
          success: function (a) {
               console.log(a);
          },
          error: function (a) {
              console.log(a);
          }
    });

As result I get:

XMLHttpRequest cannot load https://myUrl/_vti_bin/authenti…in3!%22%3C/password%3E%3C/Login%3E%3C/soap12:Body%3E%3C/soap12:Envelope%3E. The request was redirected to 'https://myUrl/_layouts/15/error.aspx?ErrorText=Request%20format%20is%20unrecognized%2E', which is disallowed for cross-origin requests that require preflight.

What can I do to avoid the error?

Thank you very much.

  • Are you sure about request type "GET"? I thought it should be "POST". Doesn't it the problem cause? – andrii May 6 '15 at 13:32
  • do you use SSO(ADFS)? – Mike Aug 14 '18 at 15:54
  • @Mike for ADFS, use oAuth. It's much simpler. This article is pretty similar to what you want to do: medium.com/@yash_agarwal2/…. This should give you an idea. You don't have to do all the steps that are mentioned there, but it's sufficient to give you a head-start. – Akhoy Aug 14 '18 at 16:24
  • there should be a way to authorize the user performing the request without having to create an Client Id and Client Secret, those are for tools that we want to authenticate automatically. but when we want to authenticate the user there should be a way like the the PNPauthentication manager. – Mike Aug 14 '18 at 16:31
  • 1
    @Mike Since REST api is mentioned in the question, the only way (as far as I'm aware) is to just register your app/website in SharePoint for getting the client ID and secret, get the authorization token and attach it for REST calls. Another way would be to (this step is also there in Pnp Authentication manager) open a window and show the login prompt, get the fedAuth and rTFa cookies and attach it to the REST call. – Akhoy Aug 16 '18 at 6:43
0

In this post I describe the process of the authentication against O365. The most important steps are:

  1. We get the token from the security token service (STS) of MS Online.

  2. "Login" to the actual O365 site using the token provided by STS in the former step. As a result of this step, we have the required cookies (FedAuth and rtFA) to be used automatically in the next steps. These cookies are set by Set-Cookie headers of the response and cached and reused by the browser for later requests targeting the same site.

  3. Get the digest from the contextinfo REST endpoint (see MSDN for details) or from the Sites web service store the value into a JavaScript variable (digest).

  4. Execute the REST request.

Note, that the code sample was correct as I wrote the post about 2 years ago, however I have not tested it since then. The process itself should be the same.

|improve this answer|||||
  • I tried your codes several times but I always get the following error: XMLHttpRequest cannot load https://login.microsoftonline.com/extSTS.srf. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://myLocalSP' is therefore not allowed access. So was can I do to avoid the error? – JohnSP Mar 24 '15 at 14:27
  • Which version of jQuery and what kind of browser do you use? My sample is based on the 1.8.3. version of jQuery and probably IE 9. Might be that something has been changed regarding the security. Note, that in my sample I work with a local HTML file. If you would like to access SP online from an on-premise site, you might have issues with the Same-origin policy. See stackoverflow.com/questions/19821753/… – pholpar Mar 24 '15 at 14:42
  • I'm using IE 10 and jquery 1.11. – JohnSP Mar 30 '15 at 7:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.