Low-Trust Provider Hosted App Unauthorized for FBA users

Question

I configured my on-premise SharePoint environment for Low-Trust provider hosted apps as per below article "https://msdn.microsoft.com/en-us/library/dn155905.aspx"

My SharePoint web application supports windows authentication as well as forms based authentication (SqlMembershipProvider).

The app which is configured for low-trust, works well with windows users, but gives me 401 unauthorized error when accessing SharePoint resources using ClientContext.ExecuteQuery().

Following were taken from my ULS

Identity claims mapped to '0' user profiles. Claims: [nameid: 'uat', nii: 'forms:CustomMembership', upn: '', smtp: '', sip: ''], User Profiles:

UserProfileException caught.. Exception Microsoft.Office.Server.Security.UserProfileNoUserFoundException: 3001002;reason=The incoming identity is not mapped to any user profile account in SharePoint. Possible cause is that no user profiles are created in user profile database. Contact your administrator.

The set of claims could not be mapped to a single user identity. Exception 3001002;reason=The incoming identity is not mapped to any user profile account in SharePoint. Possible cause is that no user profiles are created in user profile database. Contact your administrator. has occured.

The registered mappered failed to resolve to one identity claim. Exception: Microsoft.Office.Server.Security.UserProfileNoUserFoundException: 3001002;reason=The incoming identity is not mapped to any user profile account in SharePoint. Possible cause is that no user profiles are created in user profile database. Contact your administrator.

STS Call Claims Saml: Problem getting output claims identity. Exception: 'Microsoft.Office.Server.Security.UserProfileNoUserFoundException: 3001002;reason=The incoming identity is not mapped to any user profile account in SharePoint. Possible cause is that no user profiles are created in user profile database. Contact your administrator.

STS Call: Failed to issue new security token. Exception: Microsoft.Office.Server.Security.UserProfileNoUserFoundException: 3001002;reason=The incoming identity is not mapped to any user profile account in SharePoint. Possible cause is that no user profiles are created in user profile database. Contact your administrator.

SPSecurityContext: Request for security token failed with exception: System.ServiceModel.FaultException: The server was unable to process the request due to an internal error. For more information about the error, either turn on IncludeExceptionDetailInFaults (either from ServiceBehaviorAttribute or from the configuration behavior) on the server in order to send the exception information back to the client, or turn on tracing as per the Microsoft .NET Framework SDK documentation and inspect the server trace logs. at Microsoft.IdentityModel.Protocols.WSTrust.WSTrustChannel.ReadResponse(Message response) I checked the user profile service, the use is available there. I'm able to access user information over REST as well

Thanks in advance

Dinusha

Answer 1

Is this a "SharePoint hosted" app (has an App Web), a Provider hosted app (has a "Remote Web" which you setup on a separate server), or a hybrid? According to Sahil Malik, a SharePoint MVP, FBA does not work with with SharePoint Hosted apps (or hybrids), see http://blah.winsmarts.com/2013-6-SharePoint_hosted_apps,_are_terrible.aspx

If you are not using a SharePoint hosted solution, you might try the following in PowerShell to make sure the user is really setup for SharePoint:

$web = Get-SPWeb "url to your site/web"

$web.EnsureUser("your fba username")