I am having issues passing the current logged in user's credentials in to a REST API call. Here is the scenario:

I have a SP 2010 hosted site that has a web part that makes a REST API call to SharePoint 2013 search center to get the results.

I open the SharePoint 2010 site with windows authentication and then use sign in as different user option to log in using a different credential. Since the permissions for me and the second user is different the REST API call should return different results but it is returning the same number of results as the call is taking the credentials from the browser and not from SharePoint 2010.

Any pointers on how to pass the current logged in user's credentials would be helpful.

  • Does the web part make the REST calls on the server side (for example via C#) or on the client side (via JavaScript)?
    – pholpar
    Apr 16, 2015 at 8:16
  • the REST call is using the javascript.
    – user41449
    Apr 16, 2015 at 8:43

3 Answers 3


Don't you have cross-site scripting promlems, when accessing the SP 2013 site from the JavaScript on your SP 2010 page?

Regarding your original problem, I inserted the following JavaScript code into a SharePoint 2010 page:

    $.support.cors = true;
        url: "http://YourSP2013Server/_api/web/CurrentUser",
        type: "GET",
        crossDomain: true,
        dataType: "json",
        headers: { "Accept": "application/json; odata=verbose" },
        xhrFields: { withCredentials: true },
        success: function (response) {
            console.log('Request succeeded. Login name: ' + response.d.LoginName);
        error: function (xhr, status) {
            console.log('Request failed.');

and found, that it always returns the login name of the original user (the one, logged in in Windows), and not the second one you logged in via "Sign in as Different User". This option seems to have no effect to the REST requests you send from the browser.

  • That's the precise problem. We need this to pass the second user credentials as the search results would vary based on the user who has logged into the SharePoint 2010 site. This is required because the search results would vary based on the permissions that a user has on the contents. Would appreciate if you can provide pointers on achieving this.
    – user41449
    Apr 16, 2015 at 11:37
  • Just wondering how would jquery.SPServices would behave in a similar scenario.
    – user41449
    Apr 16, 2015 at 11:37
  • 1
    I might be wrong, but as far as I know both the ajax method in jQuery and SPServices use the same XMLHttpRequest object to communicate with the servers, and its authentication mechanism is independent from the "Sign in as Different User" feature. It's no surprise, that MS removed this functionality from SP 2013.
    – pholpar
    Apr 16, 2015 at 11:47

The problem depends on a lot of details like the authentication configuration of both systems (SP2010 and SP2013) and also the client.

If we are talking about Internet Explorer, the authentication is only available within the browser request. That is at least one reason why Microsoft removed the sign in as feature. If you do a sign in as and click on a word document to open in word (and word is now talking to SharePoint) the app will throw an error because access is denied because word is authenticating with the logon user of the workstation (in a windows integrated scenario like domain joined). The reason why it might work for user pholpar might be that authentication to the foreign resource is not already done. If NTLM is used the authentication will be cached and so debugging gets quickly really hard.

If you are using Kerberos it is similar. Authentication is at least happening on the domain/host part of your url. In SharePoint normally this is always the case so if you call the rest service on 2013 and Kerberos is used the browser (IE) will do the auth part and this will happen based on the user logged into the workstation.

I don't see a solution to your currently stated problem.

I'm not questioning your scenario, but more details about why it should work the way you want to have it would be interesting. Maybe there are alternative solutions available or a workaround.

  • Thanks for your thoughts Marco. The scenario is that the end users have a machine in their workplace that is logged in using a generic id and the individual will try accessing the SharePoint site but will receive a access denied message as teh generic id does not have access to the site. Then he uses the sign in as a different user option to access the site. In this scenario the REST API call fails as it tries to access the search with the generic id instead of individual's id used to access the site.
    – user41449
    Apr 16, 2015 at 15:43
  • Is it possible to run the complete browser with the new user? Right click - Run as different user? Or try to move the SharePoint urls to the IE innternet zone (instead of intranet) so the browser will request the user to authenticate. not sure if the rest call will open the credential prompt, but maybe the user can ngo to the rest target site and authenticate first? Apr 20, 2015 at 20:07

How do we pass credentials in a POST request if the request is made in a .net application (and not in apps):

"/_api/web/lists/getByTitle('" + library + "')"+ "/RootFolder/Files/add(url='" + filename + "',overwrite='true')?"+ "@TargetLibrary='" + library + "'&@TargetFileName='" + filename + "'";

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.