12

I have registered an App in my SharePoint Online, and I can use it's ID and secret with the Office Dev PnP PowerShell library. Works like a charm. Now the issue is that we are trying to connect to the SP site to grab some data from another app. We don't want to use OAuth2 with the user, we want to connect with this key/secret to get the data. Seamless to the user.

I tried the path of registering an app in Azure AD, used that id/secret and I do get a token! However, using my app's ID/secret I get a token too, using the following URL. I'd rather use my app in the site over a tenant app.

https://login.microsoftonline.com/{tenant}/oauth2/token.

Getting a token with Postman

THEN I grab that access_token and try getting a list from the site using:

https://{tenant}.sharepoint.com/sites/site/_api/web/Lists/GetByTitle('Documents')

enter image description here enter image description here

The body response {"error_description":"Exception of type 'Microsoft.IdentityModel.Tokens.AudienceUriValidationFailedException' was thrown."}

and x-ms-diagnostics header from the response: 3000003;reason="Invalid audience Uri 'https://{tenant}.sharepoint.com/sites/test'.";category="invalid_client"

Here's the page that got me this far: https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-protocols-oauth-service-to-service. And I tried http://www.andrewconnell.com/blog/user-app-app-only-permissions-client-credentials-grant-flow-in-azure-ad-office-365-apis but not sure where/how to use this cert with Postman. I think the solution, since it works with POSH, is using the App's id/secret in the site instead of the tenant, I don't want to have full access, just 1 site.

  • 1
    If I put an invalid token in my 2nd request, I get access denied. So it knows the token is 'good', but isn't letting me all the way – David Lozzi Apr 29 '17 at 21:57
  • See daemon or server to web API reference: docs.microsoft.com/en-us/azure/active-directory/develop/… – Glenn Ferrie May 1 '17 at 0:45
  • I'm too having the same issue do you got resolution for this problem? – JAVAC Nov 10 '17 at 14:40
  • I'm stuck with the same issue. Did you figure it out? – Niels Filter May 24 '18 at 7:32
0

It sounds like you have a working solution with SharePoint App Registration instead of using the Azure credentials.

To be sure, follow this:

  1. Register a new app at the site level with url/_layouts/15/appregnew.aspx and record the id and secret
  2. Add "access" for the app, specifically with AllowAppOnlyPolicy="true". Use url/_layouts/15/appinv.aspx (Permission XML Details)
  3. Use your app id and secret to authenticate any "App Only" client context. There is no user. It effectively elevates permission of anyone you give access to the "hosted" app, to whatever permissions you give it in step 2

I know you kind of already know most/all of this, but I just wanted to ensure you got these steps down pat. At that point, you should be good to go. Errors mean you're trying to use user context with app-only or vice versa. Be sure which one you're using. Doing this in POSTMAN is tricky. Check your headers and verify which flow (app only vs user context) you're using.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.