I have created one provider hosted app and have done ADFS configuration for SSO to SharePoint Site to SharePoint APP Site.

But when I adding/updating list item created by user is “i:0i.t|00000003-0000-0ff1-ce00-000000000000|app@sharepoint” instead of my logged in user in SharePoint Site.

I am in impression that SharePoint Site passes same user token to SharePoint APP but its passing common token to everyone user and the user is “i:0i.t|00000003-0000-0ff1-ce00-000000000000|app@sharepoint”

I have implemented ADFS version 2.0. SharePoint 2013 and hosted site in my local IIS.

How can I have same user for both (SharePoint Site and SharePoint Provider APP Site)?

My SharePoint Site:

enter image description here

My APP Site:

enter image description here

Both have different user; how can I have same user in both site with ADFS SSO?

  • SharePointContextProvider.Current.GetSharePointContext(Context).CreateAppOnlyClientContextForSPHost() ... if this method is used to create the context then it'll resturn SharePoint app as the current user, ie App Only Call
    – Esaki
    Commented Dec 21, 2016 at 10:03

2 Answers 2


It seems you are making calls to SharePoint via App Only Context. Hence all the operations that the app performs are executed under App context and NOT user context. You can create context for logged in user as below:-

var spContext = SharePointContextProvider.Current.GetSharePointContext(Context);
var clientContext = spContext.CreateUserClientContextForSPAppWeb();

To create client context for SAML auth

var clientContext = TokenHelper.GetS2SClientContextWithClaimsIdentity(sharepoint‌​Url,HttpContext.Curr‌​ent.User, TokenHelper.IdentityClaimType.SMTP, TokenHelper.ClaimProviderType.SAML)

PS: you need to make sure the user whose context is being used has appropriate rights to perform the desired operation via SharePoint app
PS: you also need to make sure that the token helper class is modified for SAML support. Refer this link for detailed explanation and step by step process. Verify that you have all required entries in the config file of the PHA web application.

  • I have entered your code. As follows: var spContext = SharePointContextProvider.Current.GetSharePointContext(Context); using (var clientContext = spContext.CreateUserClientContextForSPHost()) { clientContext.Load(clientContext.Web, web => web.Title); clientContext.ExecuteQuery(); Response.Write(clientContext.Web.Title); } But giving "The remote server returned an error: (401) Unauthorized." error. If I am not using ClientContext working with SSO. Per your code not working. Commented Dec 21, 2016 at 11:10
  • does the user have access to the SharePoint site? Commented Dec 21, 2016 at 12:37
  • Yes, I am able to login with [email protected] to sharepoint site. Commented Dec 21, 2016 at 12:51
  • Are you using the default token helper class? If yes, you need to modify the token helper class to support claims based authentication. Please see the link below for detailed steps to be followed. samlman.wordpress.com/2015/03/01/… Commented Dec 22, 2016 at 1:21
  • Hi Vineet, Thank you so much for your response. I have followed your article and did practical same as samlman.wordpress.com/2015/03/01/… link. Still I am getting this user "i:0i.t|00000003-0000-0ff1-ce00-000000000000|app@sharepoint" instead of "[email protected]" Please help! Commented Dec 22, 2016 at 5:19

I accomplish my requirement as follows:

My SharePoint Site:

enter image description here

APP Site:

enter image description here

As I did ADFS but User context is different.

I solved this issue by impersonating concept as below code:

List oList = clientContext.Web.Lists.GetByTitle("Contact");


            ListItemCreationInformation itemCreateInfo = new ListItemCreationInformation();
            Microsoft.SharePoint.Client.ListItem oListItem = oList.AddItem(itemCreateInfo);

            User user = clientContext.Web.EnsureUser("[email protected]");
            Response.Write("<p>" + user.LoginName + "</p>");
            oListItem["Title"] = "Test";
            oListItem["Author"] = user;
            oListItem["Editor"] = user;

Also, I have created app part for Provider Hosted APP and in Page I am passing current user in query string and by reading Query String I am impersonating user and doing CRUD Operation.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.