I have setup the cloud hybrid search between my on-prem SP2016 and SPO (SharePoint Online). I have azure ad synchronized with my ad etc. (without SSO).

sample scenario: I am displaying results from SPO in my webpart on on-prem SP2016. I want user to have possibility to interact with objects from SPO in on-prem SP2016.

When I am using ClientContext context = new ClientContext(siteUrl) and context.ExecuteQuery() I am getting 403 forbidden error.

The question is how to create authenticated ClientContext for current user without passing username and password to SPO? Is it possible at all? We can assume that user is already authenticated in browser in both on-prem and SPO.

I know that it is possible to get ClientContext using AccessToken but getting AccessToken requires registering app in SPO to get ClientId etc. and this is not my goal. (or am I wrong here and it is possible to get AccessToken for current user?)

I cloud try to open http://yourdomain.sharepoint.com/_forms/default.aspx?wa=wsignin1.0 ang get auth Cookies from this and then pass it along with every request header but will this work? (Unfortunately I didnt have time yet to test it and it doesn't seems like best solution ;))

Thanks in advance for any suggestions.

1 Answer 1


Do the users have the same permissions on SPO as they do on On-Prem? The reason I ask is because you are getting a 403 - Forbidden error, which means, that the browser knows who you are in both sites, but you are not permitted to view the resource.

Great example from this site:

The three status codes that felt the most appropriate are:

• 401 - Unauthorized

• 403 - Forbidden

• 404 - Not Found

In my mind, the use of each of these three HTTP status codes could be justified. Sarah is not authorized to view Tricia's profile (401); Sarah is forbidden from viewing someone else's profile (403); and, Sarah simply cannot see resources that she's not allowed to view (404).

The other possible problem is that you are not passing in all the required criteria into your headers request. You need to get the security token, the access token and the request digest to display the information on your 2016 site. This is a great article, which thoroughly explains that process with the REST API.

  • Hi Amanda, Thanks for your replay. Unfortunately I want to avoid passing username and password so it is not a solution. It seems like the only thing that can be done here is to setup SSO or somehow grab the auth cookies and add them to ExecutingWebRequest event of ClientContext
    – m.jedrzej
    Aug 23, 2016 at 8:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.