Passing the Sharepoint Logged in user credentials to a REST API Call

Question

I am having issues passing the current logged in user's credentials in to a REST API call. Here is the scenario:

I have a SP 2010 hosted site that has a web part that makes a REST API call to SharePoint 2013 search center to get the results.

I open the SharePoint 2010 site with windows authentication and then use sign in as different user option to log in using a different credential. Since the permissions for me and the second user is different the REST API call should return different results but it is returning the same number of results as the call is taking the credentials from the browser and not from SharePoint 2010.

Any pointers on how to pass the current logged in user's credentials would be helpful.

Answer 1

Don't you have cross-site scripting promlems, when accessing the SP 2013 site from the JavaScript on your SP 2010 page?

Regarding your original problem, I inserted the following JavaScript code into a SharePoint 2010 page:

$(document).ready(function(){
    $.support.cors = true;
    $.ajax({
        url: "http://YourSP2013Server/_api/web/CurrentUser",
        type: "GET",
        crossDomain: true,
        dataType: "json",
        headers: { "Accept": "application/json; odata=verbose" },
        xhrFields: { withCredentials: true },
        success: function (response) {
            console.log('Request succeeded. Login name: ' + response.d.LoginName);
        },
        error: function (xhr, status) {
            console.log('Request failed.');
        }
    });
});

and found, that it always returns the login name of the original user (the one, logged in in Windows), and not the second one you logged in via "Sign in as Different User". This option seems to have no effect to the REST requests you send from the browser.

Answer 2

The problem depends on a lot of details like the authentication configuration of both systems (SP2010 and SP2013) and also the client.

If we are talking about Internet Explorer, the authentication is only available within the browser request. That is at least one reason why Microsoft removed the sign in as feature. If you do a sign in as and click on a word document to open in word (and word is now talking to SharePoint) the app will throw an error because access is denied because word is authenticating with the logon user of the workstation (in a windows integrated scenario like domain joined). The reason why it might work for user pholpar might be that authentication to the foreign resource is not already done. If NTLM is used the authentication will be cached and so debugging gets quickly really hard.

If you are using Kerberos it is similar. Authentication is at least happening on the domain/host part of your url. In SharePoint normally this is always the case so if you call the rest service on 2013 and Kerberos is used the browser (IE) will do the auth part and this will happen based on the user logged into the workstation.

I don't see a solution to your currently stated problem.

I'm not questioning your scenario, but more details about why it should work the way you want to have it would be interesting. Maybe there are alternative solutions available or a workaround.

Answer 3

How do we pass credentials in a POST request if the request is made in a .net application (and not in apps):

"/_api/web/lists/getByTitle('" + library + "')"+ "/RootFolder/Files/add(url='" + filename + "',overwrite='true')?"+ "@TargetLibrary='" + library + "'&@TargetFileName='" + filename + "'";