I created an provider hosted app and use SP2013 on-prem and ADFS authentication. I have an app part with some form. This app part is added to a page in a webpart zone. Initial this app part is working. You will see the form and can submit. But when the browser is inactive for example 15 minutes and you go again to the page with the app part, you will get the error:

The remote server returned an error (401) Unauthorized.

It is not fixed after 15 minutes. It looks like it is random.

enter image description here

A work around is to log off, and then log in. Then everything is working fine. Is there some cookie/session/token expired period which is doing this behavior?

We implemented this ADFS implementation.

In the ULS I found this information which is related to this error:

got client_id: i:0i.t|ms.sp.ext|0aeb5a99-dcc6-4208-9398-a4fc10272c6b@3a5e94a9-2edd-42b3-9fca-5ef76e45719f and instance_id: https://apps.myCompany.nl/PCDocument/Create?SPHostUrl=https%3A%2F%2Fbm%2EmyCompany%2Enl&SPHostTitle=myCompany&SPAppWebUrl=""&SPLanguage=nl%2DNL&SPClientTag=1&SPProductNumber=15%2E0%2E4841%2E1000&SenderId=960DD4660 from query string.

looking for app instance that matches client_id: i:0i.t|ms.sp.ext|0aeb5a99-dcc6-4208-9398-a4fc10272c6b@3a5e94a9-2edd-42b3-9fca-5ef76e45719f

The current user has System.Threading.Thread.CurrentPrincipal.Identity.Name = 05.t|adfs|sp-install@dev.com, System.Security.Principal.WindowsIdentity.GetCurrent().Name = NT AUTHORITY\IUSR, System.Web.HttpContext.Current.User.Identity.Name = 05.t|adfs|sp-install@dev.com.

app instance found whose AppPrincipalId matches client_id i:0i.t|ms.sp.ext|0aeb5a99-dcc6-4208-9398-a4fc10272c6b@3a5e94a9-2edd-42b3-9fca-5ef76e45719f

redirectLaunUrl after getting it from query string, web or app instance: https://apps.myCompany.nl/PCDocument/Create?SPHostUrl=https%3A%2F%2Fbm%2EmyCompany%2Enl&SPHostTitle=myCompany&SPAppWebUrl=""&SPLanguage=nl%2DNL&SPClientTag=1&SPProductNumber=15%2E0%2E4841%2E1000&SenderId=960DD4660

trying to get app tokens for site: 5998b5cd-6cef-41b4-b36a-eca33cbfbb03 Unable to load app tokens from appInstanceId: 05138aae-7267-455e-a630-a82098a5185e

redirectLaunUrl after getting token replacement: https://apps.myCompany.nl/PCDocument/Create?SPHostUrl=https%3A%2F%2Fbm%2EmyCompany%2Enl&SPHostTitle=myCompany&SPAppWebUrl=""&SPLanguage=nl%2DNL&SPClientTag=1&SPProductNumber=15%2E0%2E4841%2E1000&SenderId=960DD4660

m_oauthAppId after NormalizeAppIdentifier() i:0i.t|ms.sp.ext|0aeb5a99-dcc6-4208-9398-a4fc10272c6b@3a5e94a9-2edd-42b3-9fca-5ef76e45719f. Now getting app principal info.

decided that we need to do a POST to the app.

App token requested from appredirect.aspx for site: 5998b5cd-6cef-41b4-b36a-eca33cbfbb03 but there was an error in generating it. This may be a case when we do not need a token or when the app principal was not properly set up. LaunchUrl:https://apps.myCompany.nl/PCDocument/Create?SPHostUrl=https://bm.myCompany.nl&SPHostTitle=myCompany&SPAppWebUrl=""&SPLanguage=nl-NL&SPClientTag=1&SPProductNumber=15.0.4841.1000&SenderId=960DD4660 Exception Message:De app i:0i.t|ms.sp.ext|0aeb5a99-dcc6-4208-9398-a4fc10272c6b@3a5e94a9-2edd-42b3-9fca-5ef76e45719f has no endpoint or endpoint is not valid. Stacktrace: at Microsoft.SharePoint.ApplicationPages.AppRedirectPage.ValidateAndProcessRequest(). Since this is a nonfatal error, it will be sanitized and posted to the app as part of the app launch.

Getting Error Message for Exception Microsoft.SharePoint.SPException: The app i:0i.t|ms.sp.ext|0aeb5a99-dcc6-4208-9398-a4fc10272c6b@3a5e94a9-2edd-42b3-9fca-5ef76e45719f has no endpoint or endpoint is not valid. at Microsoft.SharePoint.ApplicationPages.AppRedirectPage.ValidateAndProcessRequest()

Doing appredirect from appredirect.aspx: in site: 5998b5cd-6cef-41b4-b36a-eca33cbfbb03 with RedirectLaunchUrl: https://apps.myCompany.nl/PCDocument/Create?SPHostUrl=https%3A%2F%2Fbm%2EmyCompany%2Enl&SPHostTitle=myCompany&SPAppWebUrl=""&SPLanguage=nl%2DNL&SPClientTag=1&SPProductNumber=15%2E0%2E4841%2E1000&SenderId=960DD4660


Here are my modified TokenHelper.cs and SharePointContext.cs files.


I was triggered by Sergei Sergeev to increase the outer token lifetime. I did some investigation and this is the fix. The outer token lifetime (10 minutes) needs to be higher than the HighTrustAccessTokenLifetime (12 hours). Another reason why it was not working in our situation, is because we save the SharePointHighTrustSamlContext in the session like they do for SharePointAcsContext and SharePointHighTrustContext. In this example of Tobias Lekman the tokens will always recreated for each new request and you dont have a dependancy with the lifetime of the tokens.


Access token expires in 12hrs by default in high-trust (when using TokenHelper.cs). Session in 20min, but in that case SharePointContext.cs should renew it.

May be your custom logic affects this somehow.
My guess - try to adjust session expiration time to one hour for example (web.config):

     <sessionState timeout="60"></sessionState>

Looking at the modified SharePointContext.cs it seems I found exact reason for your issue.
Take a look at the line 1178 in SharePointContext.cs:


Your user+add-in token lifetime is only 10 minutes (besides your add-in only token, line 1150 is good). Put here TokenLifetimeMinutes instead of 10 and I think you are good to go.

  • What should happen after the default 20 minutes expiration? Should I expect the adfs login page? – Ola Jan 3 '17 at 10:17
  • SharePointContext.cs stores context information inside the Session. When it expires, it tries to renew it by forcing redirect to AppRedirect.aspx. AppRedirect.aspx in turns, redirects back to your page with context information. – Sergei Sergeev Jan 3 '17 at 10:28
  • I dont have this issue after 15 minutes. It looks like it is random. Sometimes 15, 20, 30, 45, 60 minutes etc. – Ola Jan 3 '17 at 12:16
  • How your remote app (MVC) is hosted? May be multiple web servers? If not, for me it looks like some issues with business logic inside code (as you said it's random).. caching doesn't work as expected or something. – Sergei Sergeev Jan 3 '17 at 12:25
  • I created manual a new web site in IIS. Created a self signed certificate. Created a https binding with hostname. I did this on the SP server. I have also a adfs domain controller server and a sql server. This is my development environment. We have also modified the tokenhelper.cs file to make it compatible with adfs authentication. – Ola Jan 3 '17 at 20:00

Try to increase your token cache limit and token lifetime.

$sts = Get-SPSecurityTokenServiceConfig
$sts.CookieLifetime = New-TimeSpan -Minutes 600
$sts.WindowsTokenLifetime = New-TimeSpan -Minutes 600
$sts.MaxApplicationTokenCacheItems = 100000
$sts.MaxLogonTokenCacheItems = 100000
$sts.MaxServiceTokenCacheItems = 100000

Make sure that you document what these values are before you change them and research each value to understand what they are and what changing the value means to your environment.

When I changed these values, it took about a day to take hold. I assume the old values are cached but don't know how to force the cache to clear.

  • Why should I increase these settings? And why are the default values giving me this issue. I expect that the default values should working fine. – Ola Jan 10 '17 at 16:32
  • I'm not going to Google for you. I clearly gave you a link explaining what these values do. – James Grizzle Jan 10 '17 at 19:41
  • but is this a known issue and is this the solution, or is this just a workaround to increate the expired time? – Ola Jan 11 '17 at 8:00
  • I do not know if Microsoft knows about this or recognizes this as an issue. – James Grizzle Jan 11 '17 at 13:53
  • James, did you ever have the same issue like me? – Ola Jan 12 '17 at 10:32


I think your configuration could be the problem. You need to make sure you have a high trust created, so the provider hosted app can authenticate with SharePoint.

Take a look at these instructions to see if you missed something.

Configure an environment to run your provider-hosted high trust apps in SharePoint 2013

Let me know if you need any help.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.