Connecting to SharePoint Online from on-prem SharePoint with current user

Question

I have setup the cloud hybrid search between my on-prem SP2016 and SPO (SharePoint Online). I have azure ad synchronized with my ad etc. (without SSO).

sample scenario: I am displaying results from SPO in my webpart on on-prem SP2016. I want user to have possibility to interact with objects from SPO in on-prem SP2016.

When I am using ClientContext context = new ClientContext(siteUrl) and context.ExecuteQuery() I am getting 403 forbidden error.

The question is how to create authenticated ClientContext for current user without passing username and password to SPO? Is it possible at all? We can assume that user is already authenticated in browser in both on-prem and SPO.

I know that it is possible to get ClientContext using AccessToken but getting AccessToken requires registering app in SPO to get ClientId etc. and this is not my goal. (or am I wrong here and it is possible to get AccessToken for current user?)

I cloud try to open http://yourdomain.sharepoint.com/_forms/default.aspx?wa=wsignin1.0 ang get auth Cookies from this and then pass it along with every request header but will this work? (Unfortunately I didnt have time yet to test it and it doesn't seems like best solution ;))

Thanks in advance for any suggestions.

Answer 1

Do the users have the same permissions on SPO as they do on On-Prem? The reason I ask is because you are getting a 403 - Forbidden error, which means, that the browser knows who you are in both sites, but you are not permitted to view the resource.

Great example from this site:

The three status codes that felt the most appropriate are:

• 401 - Unauthorized

• 403 - Forbidden

• 404 - Not Found

In my mind, the use of each of these three HTTP status codes could be justified. Sarah is not authorized to view Tricia's profile (401); Sarah is forbidden from viewing someone else's profile (403); and, Sarah simply cannot see resources that she's not allowed to view (404).

The other possible problem is that you are not passing in all the required criteria into your headers request. You need to get the security token, the access token and the request digest to display the information on your 2016 site. This is a great article, which thoroughly explains that process with the REST API.