I am trying to get FedAuth
cookie in order to read SharePoint api from my mobile app.
However, I find that some of web applications do have FedAuth
cookie, but other web applications do not have this cookie. Originally I thought all SharePoint sites use this cookie for authentication. (Claims + NTLM mode)
Say I have SiteA and SiteB:
Both sites are Claims Based Authentication with NTLM
SiteA has no FedAuth cookie
It has WSS_KeepSessionAuthenticated
cookie instead (but it does not seems to be an authentication token since I can change it and SharePoint is still happy)
SiteB has Enabled Form Based Authentication, and it has FedAuth cookie. (if I change this cookie SharePoint reports error)
I experimented and found that when I disable the Form Based Authentication
in SiteB, it no longer sets the FedAuth
cookie.
Question:
- Why
FedAuth
only appears forForm Based Authentication
? - Can I make SharePoint to use
FedAuth
whenForm Based Authentication
is not enabled? Because I want to use this cookie in api call. - When SharePoint is not using
FedAuth
cookie, how does it maintain user session?
I don't have much knowledge in this area and probably missing some key concepts here, thanks for pointing out!