2

I created an provider hosted app and use SP2013 on-prem and ADFS authentication. I have an app part with some form. This app part is added to a page in a webpart zone. Initial this app part is working. You will see the form and can submit. But when the browser is inactive for example 15 minutes and you go again to the page with the app part, you will get the error:

The remote server returned an error (401) Unauthorized.

It is not fixed after 15 minutes. It looks like it is random.

enter image description here

A work around is to log off, and then log in. Then everything is working fine. Is there some cookie/session/token expired period which is doing this behavior?

We implemented this ADFS implementation.

In the ULS I found this information which is related to this error:

got client_id: i:0i.t|ms.sp.ext|0aeb5a99-dcc6-4208-9398-a4fc10272c6b@3a5e94a9-2edd-42b3-9fca-5ef76e45719f and instance_id: https://apps.myCompany.nl/PCDocument/Create?SPHostUrl=https%3A%2F%2Fbm%2EmyCompany%2Enl&SPHostTitle=myCompany&SPAppWebUrl=""&SPLanguage=nl%2DNL&SPClientTag=1&SPProductNumber=15%2E0%2E4841%2E1000&SenderId=960DD4660 from query string.

looking for app instance that matches client_id: i:0i.t|ms.sp.ext|0aeb5a99-dcc6-4208-9398-a4fc10272c6b@3a5e94a9-2edd-42b3-9fca-5ef76e45719f

The current user has System.Threading.Thread.CurrentPrincipal.Identity.Name = 05.t|adfs|[email protected], System.Security.Principal.WindowsIdentity.GetCurrent().Name = NT AUTHORITY\IUSR, System.Web.HttpContext.Current.User.Identity.Name = 05.t|adfs|[email protected].

app instance found whose AppPrincipalId matches client_id i:0i.t|ms.sp.ext|0aeb5a99-dcc6-4208-9398-a4fc10272c6b@3a5e94a9-2edd-42b3-9fca-5ef76e45719f

redirectLaunUrl after getting it from query string, web or app instance: https://apps.myCompany.nl/PCDocument/Create?SPHostUrl=https%3A%2F%2Fbm%2EmyCompany%2Enl&SPHostTitle=myCompany&SPAppWebUrl=""&SPLanguage=nl%2DNL&SPClientTag=1&SPProductNumber=15%2E0%2E4841%2E1000&SenderId=960DD4660

trying to get app tokens for site: 5998b5cd-6cef-41b4-b36a-eca33cbfbb03 Unable to load app tokens from appInstanceId: 05138aae-7267-455e-a630-a82098a5185e

redirectLaunUrl after getting token replacement: https://apps.myCompany.nl/PCDocument/Create?SPHostUrl=https%3A%2F%2Fbm%2EmyCompany%2Enl&SPHostTitle=myCompany&SPAppWebUrl=""&SPLanguage=nl%2DNL&SPClientTag=1&SPProductNumber=15%2E0%2E4841%2E1000&SenderId=960DD4660

m_oauthAppId after NormalizeAppIdentifier() i:0i.t|ms.sp.ext|0aeb5a99-dcc6-4208-9398-a4fc10272c6b@3a5e94a9-2edd-42b3-9fca-5ef76e45719f. Now getting app principal info.

decided that we need to do a POST to the app.

App token requested from appredirect.aspx for site: 5998b5cd-6cef-41b4-b36a-eca33cbfbb03 but there was an error in generating it. This may be a case when we do not need a token or when the app principal was not properly set up. LaunchUrl:https://apps.myCompany.nl/PCDocument/Create?SPHostUrl=https://bm.myCompany.nl&SPHostTitle=myCompany&SPAppWebUrl=""&SPLanguage=nl-NL&SPClientTag=1&SPProductNumber=15.0.4841.1000&SenderId=960DD4660 Exception Message:De app i:0i.t|ms.sp.ext|0aeb5a99-dcc6-4208-9398-a4fc10272c6b@3a5e94a9-2edd-42b3-9fca-5ef76e45719f has no endpoint or endpoint is not valid. Stacktrace: at Microsoft.SharePoint.ApplicationPages.AppRedirectPage.ValidateAndProcessRequest(). Since this is a nonfatal error, it will be sanitized and posted to the app as part of the app launch.

Getting Error Message for Exception Microsoft.SharePoint.SPException: The app i:0i.t|ms.sp.ext|0aeb5a99-dcc6-4208-9398-a4fc10272c6b@3a5e94a9-2edd-42b3-9fca-5ef76e45719f has no endpoint or endpoint is not valid. at Microsoft.SharePoint.ApplicationPages.AppRedirectPage.ValidateAndProcessRequest()

Doing appredirect from appredirect.aspx: in site: 5998b5cd-6cef-41b4-b36a-eca33cbfbb03 with RedirectLaunchUrl: https://apps.myCompany.nl/PCDocument/Create?SPHostUrl=https%3A%2F%2Fbm%2EmyCompany%2Enl&SPHostTitle=myCompany&SPAppWebUrl=""&SPLanguage=nl%2DNL&SPClientTag=1&SPProductNumber=15%2E0%2E4841%2E1000&SenderId=960DD4660

UPDATE

Here are my modified TokenHelper.cs and SharePointContext.cs files.

UPDATE

I was triggered by Sergei Sergeev to increase the outer token lifetime. I did some investigation and this is the fix. The outer token lifetime (10 minutes) needs to be higher than the HighTrustAccessTokenLifetime (12 hours). Another reason why it was not working in our situation, is because we save the SharePointHighTrustSamlContext in the session like they do for SharePointAcsContext and SharePointHighTrustContext. In this example of Tobias Lekman the tokens will always recreated for each new request and you dont have a dependancy with the lifetime of the tokens.

Improve this question

3 Answers 3

Reset to default
1
+50

Access token expires in 12hrs by default in high-trust (when using TokenHelper.cs). Session in 20min, but in that case SharePointContext.cs should renew it.

May be your custom logic affects this somehow.
My guess - try to adjust session expiration time to one hour for example (web.config): 

<configuration>
  <system.web>
     <sessionState timeout="60"></sessionState>
  </system.web>
</configuration>

UPD
Looking at the modified SharePointContext.cs it seems I found exact reason for your issue.
Take a look at the line 1178 in SharePointContext.cs: 

DateTime.UtcNow.AddMinutes(10)

Your user+add-in token lifetime is only 10 minutes (besides your add-in only token, line 1150 is good). Put here TokenLifetimeMinutes instead of 10 and I think you are good to go.

Improve this answer
14
  • What should happen after the default 20 minutes expiration? Should I expect the adfs login page?
    – Ola
    Jan 3, 2017 at 10:17
  • SharePointContext.cs stores context information inside the Session. When it expires, it tries to renew it by forcing redirect to AppRedirect.aspx. AppRedirect.aspx in turns, redirects back to your page with context information.
    – Sergei Sergeev
    Jan 3, 2017 at 10:28
  • I dont have this issue after 15 minutes. It looks like it is random. Sometimes 15, 20, 30, 45, 60 minutes etc.
    – Ola
    Jan 3, 2017 at 12:16
  • How your remote app (MVC) is hosted? May be multiple web servers? If not, for me it looks like some issues with business logic inside code (as you said it's random).. caching doesn't work as expected or something.
    – Sergei Sergeev
    Jan 3, 2017 at 12:25
  • I created manual a new web site in IIS. Created a self signed certificate. Created a https binding with hostname. I did this on the SP server. I have also a adfs domain controller server and a sql server. This is my development environment. We have also modified the tokenhelper.cs file to make it compatible with adfs authentication.
    – Ola
    Jan 3, 2017 at 20:00
0

Try to increase your token cache limit and token lifetime.

$sts = Get-SPSecurityTokenServiceConfig
$sts.CookieLifetime = New-TimeSpan -Minutes 600
$sts.WindowsTokenLifetime = New-TimeSpan -Minutes 600
$sts.MaxApplicationTokenCacheItems = 100000
$sts.MaxLogonTokenCacheItems = 100000
$sts.MaxServiceTokenCacheItems = 100000
$sts.Update()

Make sure that you document what these values are before you change them and research each value to understand what they are and what changing the value means to your environment.

When I changed these values, it took about a day to take hold. I assume the old values are cached but don't know how to force the cache to clear.

Improve this answer
6
  • Why should I increase these settings? And why are the default values giving me this issue. I expect that the default values should working fine.
    – Ola
    Jan 10, 2017 at 16:32
  • I'm not going to Google for you. I clearly gave you a link explaining what these values do.
    – James Grizzle
    Jan 10, 2017 at 19:41
  • but is this a known issue and is this the solution, or is this just a workaround to increate the expired time?
    – Ola
    Jan 11, 2017 at 8:00
  • I do not know if Microsoft knows about this or recognizes this as an issue.
    – James Grizzle
    Jan 11, 2017 at 13:53
  • James, did you ever have the same issue like me?
    – Ola
    Jan 12, 2017 at 10:32
0

Ola,

I think your configuration could be the problem. You need to make sure you have a high trust created, so the provider hosted app can authenticate with SharePoint.

Take a look at these instructions to see if you missed something.

Configure an environment to run your provider-hosted high trust apps in SharePoint 2013

Let me know if you need any help.

Jim

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.