3

The Workflows 2010 run w/o problems. All 2013, indipendently what they do, start but stuck on Stage 1 and in the information I find followings:

HTTP Unauthorized to http://myweb/_api/web/lists(guid'GUID') 
Korrelations-ID: GUID 
Instance-ID: GUID

I've read this, this, this but they did not help.

From the ULSViewer with level Verbose/Verbose:

Name=Request (GET:http://wed/_api/web/lists(guid'GUID'))                                
SPRequestModule.BeginRequestHandler End                             
ObjectCachePerRequest Global:True, Enabled:False                                
SPApplicationAuthenticationModule: Clear outgoing token context from SpThreadContext                                
Entering Monitored Scope (Application Authentication Pipeline). Parent=SPClaimsCounterScope                             
Leaving Monitored Scope: (Application Authentication Pipeline) Execution Time=0.0297; CPU Milliseconds=0; SQL Query Count=0; Parent=SPClaimsCounterScope                                
SPRequestModule.PostAuthenticateRequestHandler Begin                                
OAuth request. IsAuthenticated=False, UserIdentityName=, ClaimsCount=0                              
Value for isAnonymousAllowed is : False                             
Value for checkAuthenticationCookie is : True                               
Claims Windows Sign-In: Sending 401 for request 'http://web/_api/web/lists(guid'GUID')' because the user is not authenticated and resource requires authentication.                             
Sending HTTP response 401 - text/plain:401 UNAUTHORIZED.                                
SPRequestModule.PostLogRequestHandler Begin                             
SPRequestModule.PostLogRequestHandler End                               
SPRequestModule.EndRequestHandler Begin                             
Looking up SPSite by ID GUID in memory.                             
SPRequestModule.PreSendRequestHeaders End                               
Micro Trace Tags: 0 avwhy,0 nasq,0 az4z8,0 avwhz,0 aytib,0 bjvyg,0 nasq,0 b4ly,0 avwh6,0 agb9s,0 ajd6k,0 ajd6l,0 af32k,0 b6p2,0 avwia,0 avwib,0 avwic,0 az4z8,0 avwh5                               
Sending HTTP response 302 for HTTP request GET to http://web/_api/web/lists(guid'GUID')                             
Leaving Monitored Scope: (Request (GET:http://web/_api/web/lists(guid'GUID'))) Execution Time=2.54; CPU Milliseconds=2; SQL Query Count=0; Parent=None                              
SPRequestModule.EndRequestHandler End                               
Sending HTTP response 401 - text/plain:401 UNAUTHORIZED.                                
SPApplicationAuthenticationModule.IsBearerChallengeRequested: Return 'True'.                                
SPOAuthHttpChallenge: Adding OAuth WWW-Authenticate challenge without clearing others.                              
Name=Request (GET:http://web/_api/web/lists(guid'GUID'))                                
SPRequestModule.BeginRequestHandler End                             
ObjectCachePerRequest Global:True, Enabled:False                                
SPApplicationAuthenticationModule: Clear outgoing token context from SpThreadContext                                
Entering Monitored Scope (Application Authentication Pipeline). Parent=SPClaimsCounterScope                             
SPApplicationAuthenticationModule: Invalid token or signature. Exception: System.IdentityModel.Tokens.SecurityTokenException: Invalid JWT token. Could not resolve issuer token.     at Microsoft.IdentityModel.S2S.Tokens.JsonWebSecurityTokenHandler.ReadTokenCore(String token, Boolean isActorToken)     at Microsoft.IdentityModel.S2S.Tokens.JsonWebSecurityTokenHandler.ReadActor(IDictionary`2 payload)     at Microsoft.IdentityModel.S2S.Tokens.JsonWebSecurityTokenHandler.ReadTokenCore(String token, Boolean isActorToken)     at Microsoft.SharePoint.IdentityModel.SPApplicationAuthenticationModule.TryExtractAndValidateToken(HttpContext httpContext, SPIncomingTokenContext& tokenContext, SPIdentityProofToken& identityProofToken)                             
Leaving Monitored Scope: (Application Authentication Pipeline) Execution Time=0.4811; CPU Milliseconds=0; SQL Query Count=0; Parent=SPClaimsCounterScope                                
SPApplicationAuthenticationModule: Error authenticating request, Error details: Header: 3000006;reason="Token contains invalid signature.";category="invalid_client", Body: {"error_description":"Invalid JWT token. Could not resolve issuer token."}                              
SPRequestModule.ErrorAppHandler Begin                               
Application error when access /web/_api/web/lists(guid'GUID'), Error=Invalid JWT token. Could not resolve issuer token.   at Microsoft.IdentityModel.S2S.Tokens.JsonWebSecurityTokenHandler.ReadTokenCore(String token, Boolean isActorToken)     at Microsoft.IdentityModel.S2S.Tokens.JsonWebSecurityTokenHandler.ReadActor(IDictionary`2 payload)     at Microsoft.IdentityModel.S2S.Tokens.JsonWebSecurityTokenHandler.ReadTokenCore(String token, Boolean isActorToken)     at Microsoft.SharePoint.IdentityModel.SPApplicationAuthenticationModule.TryExtractAndValidateToken(HttpContext httpContext, SPIncomingTokenContext& tokenContext, SPIdentityProofToken& identityProofToken)                                
SPRequestModule.ErrorAppHandler End                             
SPRequestModule.PostLogRequestHandler Begin                             
SPRequestModule.PostLogRequestHandler End                               
SPRequestModule.EndRequestHandler Begin                             
Looking up SPSite by ID GUID in memory.                             
SPRequestModule.PreSendRequestHeaders End                               
Micro Trace Tags: 0 avwhy,0 nasq,0 az4z8,0 avwhz,0 aytib,0 bjvyg,0 nasq,0 ajez0,0 b4ly,0 ajezq,0 avwhw,0 8nca,0 avwhx,0 avwia,0 avwib,0 avwic,0 az4z8,0 avwh5                               
Sending HTTP response 500 for HTTP request GET to http://web/_api/web/lists(guid'GUID')                             
Leaving Monitored Scope: (Request (GET:http://web/_api/web/lists(guid'GUID'))) Execution Time=2.1315; CPU Milliseconds=2; SQL Query Count=0; Parent=None                                
SPRequestModule.EndRequestHandler End                               
SPApplicationAuthenticationModule.IsBearerChallengeRequested: Return 'True'.                                
SPOAuthHttpChallenge: Adding OAuth WWW-Authenticate challenge without clearing others.                              

I guess the Workflow Manager User needs more privileges, but which one? The user has Full Control for All Zones in the Policy for Web Application.

I don't understand the 401; when I open http://myweb/_api/web/lists(guid'GUID') in Chrome or IE, it works. It seems that the Workflow does not consider the authentication token.

2 Answers 2

1

The user executing the workflow must have a User Profile in the User Profile Service Application. In addition, you cannot have multiple profiles for the same user (e.g. you cannot have a SAML and a Windows Claim profile for the same user).

No additional rights, including Full Control, are required. The workflow runs under the context of the user executing the workflow.

3
  • It must be something else. I have only claim based users. The curious thing is that I get an 401 when the Workflow trys to get data from the list http://myweb/_api/web/lists(guid'GUID') ...in fact when I open that link, it works.
    – Emaborsa
    Mar 8, 2017 at 15:43
  • Best bet would be to run through the ULS log on the SharePoint server while the WF is executing. It should give you further details on why you're seeing the 401.
    – user6024
    Mar 8, 2017 at 16:39
  • I added the entire correlation
    – Emaborsa
    Mar 9, 2017 at 13:26
0

Problem found. The Workflow can be registered using http OR https. When registered using https it requires the certificate, otherwise you will hit to the problem discribed above.

  1. Solution: install the certificate (link)
  2. Solution: re-register the Workflow Service using http

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.