Cannot contact site at the specified URL on try ClientContext.ExecuteQuery();

Question

I try to get list from remote SharePoint server using CSOM in .NET Web Application, but ClientContext.ExecuteQuery() return exception

Cannot contact site at the specified URL

If I try to get list from local server, all work fine. How do I fix it? Why an exception occurs?

I use following code:

    public string testRest()
    {
        try
        {
            ClientContext context = new ClientContext(new Uri(@"http://sharepointRemoteServer/sites/subsite"));
            context.AuthenticationMode = ClientAuthenticationMode.Default;
            context.Credentials = CredentialCache.DefaultNetworkCredentials;
            List spList = context.Web.Lists.GetByTitle("ListName");
            context.Load(spList);
            context.ExecuteQuery();
            return "OK";
        }
        catch (Exception ex)
        {
            return ex.Message;
        }
    }

Answer 1

You're most probably facing what is known as a "double-hop" issue:

1. Your client user connects and authenticate as himself against the Web app (through Windows NTLM protocol, that requires the client to know her/his password).
2. The Web app uses impersonation. It means the code runs under the user's identity.
3. With your context.Credentials = CredentialCache.DefaultNetworkCredentials, the call to SharePoint tries to authenticate with the user's identity, with NTLM. However, this requires the Web app to know the user's password: as it does not, the authentication fails (unless the client browses the Web app from the Web app server, in witch case it works fine).

Simplest solution here is to avoid impersonation at the Web app level (in the web.config); all requests to SharePoint will then be made Under the application pool's identity (that will require permissions under SharePoint, of course).

Another option I described here: Saving file from SharePoint Server to shared folder - Which user account?.

With these two above solutions, the connection to SP will always be made under the same identity, i.e. the app pool's identity.
If you really require the connection to be made on behalf of the initial user, the solution would be use Kerberos instead of NTLM, but that's a complicated one, involving Active Directory configuration, client requirements (IE, user logged on the same domain, ...).

Answer 2

You can't get a subsite using ClientContext constructor. Try this:

public string testRest()
{
    try
    {   // In constructor, put only the Site URL
        ClientContext context = new ClientContext(new Uri(@"http://sharepointRemoteServer/"));
        context.AuthenticationMode = ClientAuthenticationMode.Default;
        context.Credentials = CredentialCache.DefaultNetworkCredentials;

        // Load subsites and their titles
        Web w = context.Web;
        context.Load(w, website => website.Webs,
                        website => website.Title);
        context.ExecuteQuery();

        // Get list's subsite by title
        Web subsite = (Web) webs.Select(w => w.Title.Equals("subsite"));

        List spList = subsite.Lists.GetByTitle("ListName");
        context.Load(spList);
        context.ExecuteQuery();
        return "OK";
    }
    catch (Exception ex)
    {
        return ex.Message;
    }
}

I hope it helps!

Answer 3

Solved! Trouble in JS for cross-site REST-query located in global.asax. This JS get User-agent from request header and replace request header in all query. Web application not send user-agent in request header and JS crash.