How to authenticate user in SharePoint Online using rest api

Question

I have a website on SharePoint Online and a website on SharePoint On-premise. From my On-premise website i want to create a new list on my SharePoint Online site.

To authenticate I used the following codes:

    var soapRequest =
     '<?xml version="1.0" encoding="utf-8"?>
      <soap12:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"  
        xmlns:xsd="http://www.w3.org/2001/XMLSchema"
        xmlns:soap12="http://www.w3.org/2003/05/soap-envelope"> 
      <soap12:Body>  
         <Login xmlns="http://schemas.microsoft.com/sharepoint/soap/">
            <username>[email protected]</username>
            <password>userpassword</password>
         </Login>
      </soap12:Body>
     </soap12:Envelope>';
 

And then:

    $.ajax({ 
          url: myUrl + "_vti_bin/authentication.asmx?op=Login",
          type: "GET",  
          contentType: "text/xml",  
          dataType: "json", 
          data: soapRequest, 
          success: function (a) {
               console.log(a);
          },
          error: function (a) {
              console.log(a);
          }
    });

As result I get:

XMLHttpRequest cannot load https://myUrl/_vti_bin/authenti…in3!%22%3C/password%3E%3C/Login%3E%3C/soap12:Body%3E%3C/soap12:Envelope%3E. The request was redirected to 'https://myUrl/_layouts/15/error.aspx?ErrorText=Request%20format%20is%20unrecognized%2E', which is disallowed for cross-origin requests that require preflight.

What can I do to avoid the error?

Thank you very much.

Answer 1

In this post I describe the process of the authentication against O365. The most important steps are:

1. We get the token from the security token service (STS) of MS Online.

2. "Login" to the actual O365 site using the token provided by STS in the former step. As a result of this step, we have the required cookies (FedAuth and rtFA) to be used automatically in the next steps. These cookies are set by Set-Cookie headers of the response and cached and reused by the browser for later requests targeting the same site.

3. Get the digest from the contextinfo REST endpoint (see MSDN for details) or from the Sites web service store the value into a JavaScript variable (digest).

4. Execute the REST request.

Note, that the code sample was correct as I wrote the post about 2 years ago, however I have not tested it since then. The process itself should be the same.

Answer 2

The Root Federation Authentication (RTFA) cookie is used across all of SharePoint. When a user visits a new top-level site or another company's page, the RTFA cookie is used to authenticate them silently without a prompt. When a user signs out of SharePoint, the RTFA cookie is deleted.