Grant workflow app permission to peoplemanager REST interface

Question

I'm trying to authorize a 2013 workflow (made in SharePoint Designer) to make calls to our root site collections REST api for peoplemanager in Sharepoint Online. All I get back is:

{"odata.error":{"code":"-2147024891, System.UnauthorizedAccessException","message":{"lang":"en-US","value":"Access denied. You do not have permission to perform this action or access this resource."}}}

Per the documentation you should call this URL.

http://site url/_api/sp.userprofiles.peoplemanager/getpropertiesfor(@v)?@v='i%3A0%23.f%7Cmembership%7Cuser%40domain.onmicrosoft.com'

https://msdn.microsoft.com/en-us/library/office/dn790354.aspx#bk_PeopleManagerGetPropertiesFor

But as far as I have discovered that is not correct, you need to add accountName= in the method call. The call below works when I run it logged in from a browser. The URL above without the accountName= parameter does not.

http://site url/_api/sp.userprofiles.peoplemanager/getpropertiesfor(accountName=@v)?@v='i%3A0%23.f%7Cmembership%7Cuser%40domain.onmicrosoft.com'

I have authorized the site workflows to use app permissions on the site the workflow is run from. I have also added the workflow app id as trusted on our root site as per this guide.

https://msdn.microsoft.com/en-us/library/office/jj822159.aspx?f=255&MSPPError=-2147217396

I have tried calling the api from within an app step and without an app step. Still the same reply, unauthorized.

Should I give the workflow app permissions somewhere else, not in the root site? Is there a way to debug why this happens? Is the documentation correct regarding the "accountName=" parameter or am I reading old documentation? I don't know how to debug this problem.

---

EDIT 1 - 2016-12-18

After trials and tribulations I finally learned that I had given the workflow app incorrect permissions for accessing the tenants social features. The scope of the AppPermissionRequest for the workflow ought to be http://sharepoint/social/tenant as I found out per this article.

http://sharepoint-community.net/profiles/blogs/retrieving-user-profile-properties-in-a-sharepoint-2013-workflow

Now I didn't get the unauthorized response anymore. Instead I got the dreaded "the query string accountName is missing or invalid" response.

So I tried fooling around a little in my browser and soon noticed # is not automatically URL-encoded. So I thought maybe that's the case in the url I enter for the workflow action Call HTTP web service also, so I ran an action of string replace on the initiators login name, replacing # with %23.

Now I get a http 200 response but nothing more, I log the responseCode, the responseHeaders and the reponseContent, only the responseCode has any content in the history log. This also made the workflow never finish. The workflow is still listed as running on the testsite.

I tried calling the /gertmyproperties endpoint instead, it acts the same, http 200 OK but the workflow just keeps running and no content is returned.

---

EDIT 2 - 2016-12-18

So I read the whole article above once again and noticed the author use an other endpoint and that he also URL-encode the : character to %3A.

I tried changing endpoint using the one in the article /getuserprofilepropertyfor(accountName=@v,propertyName='Manager')?@v='urlEncodedUsername'

This works, it returns the Managerproperty from the userprofile object. But, my workflows are still showing as "in progress" in the Settings->Workflow Settings page on the SharePoint site.

I've tried calling both with URL-encoding the : and without, both seems to work, also tried with and without URL-encoding the ' character, no difference. Then I had to try without URL-encoding the # character, that returned the error the query string accountName is missing or invalid. So you need to manually URL-encode the #, other characters seem to work as they are.

Answer 1

Finally solved it. Removed everything that wasn't used (I had a step with actions I tried that didn't work that was never called which I think is the reason the workflow showd in progress, quite weird though because the first stages transition step was end of workflow) and all of the sudden the workflows finish and are not listed as in progress.

Conclusion.

1. You need to use the correct app permission scope for the tenants social features or you get the unauthorized response.
2. You need to URL-encode the # character in the users Login name or else you get the query parameter accountName is missing or invalid response.
3. I am calling the web service in an app step. Have not tried if this is really necessary. Since the user ought to have read permission to "his" social feed the combined app and user permissions ought to work without an app step.
4. SharePoint online workflow development and debugging is fundamentally broken and someone at Microsoft should get a daily beating until it's fixed.

Answer 2

we have same kind of issue, in our case reason for this issue is Workflow Manager's service account.

after setting the app permission and trust the app but we got the same access issue. Finally we add the Workflow manager service account into the policy of web app after that workflow working smoothly.

I think Workflow is being initiated by WFM's service account.