2

I wrote a custom web app for a site collection. Url is something like

http://domain/sites/test/en/_layouts/15/AppName/ActionName.aspx

If someone types this url is fine, SharePoint asks for username and password.

But

If a user, which exists on Active Directory but does not have privileges to access the site, types the url gets this message but the code still runs.

Sorry, this list hasn't been shared with you

I debugged the code and it actually drops into the page_load even the user has no access to the site.

Is this normal?

Note: This is a fresh installed machine and all windows, iis, sharepoint e.t.c configurations are default settings

Edit: This site is publishing site. Clients does not have to be on domain to access it. Think two user, user #1 has privileges as site admin to access site and edit, user #2 is regular domain user and has no privileges on site. #1 can access that page and run the code, #2 can also access page gets "Sorry, this list hasn't been shared with you" error but code still runs, as you see debug drops in page_load in the animation gif. Why that code even run for #2?

enter image description here

0

Yes this is the normal behavior on a window machine. This is because of Internet Option property is set to auto login for intranet sites.

Try to change the auto login option and you'll be prompted with username and password.

To change auto login:

  1. Open control panel and select Internet Option (change the view to small/large icon).
  2. Switch to Security tab and click on Local Intranet.
  3. Now click on Custom Level... button and scroll to bottom of open dialog.
  4. Now, under User Authentication -> Logon, select Prompt for user name and password.

But you have to do this in every client machine within domain if they have auto login.

  • Irrelevant. Auto login has nothing to do with this. This is a server issue not a client issue. – Ergec Jun 16 '17 at 4:25
  • Your problem was, when you access the site out side of domain it ask for credentials while when you access it from domain, it show the access denied issue. Am I correct here? If so, try the above above solution. If not, please correct me. – ThinkB4Code Jun 16 '17 at 4:29
  • This site is public site. Clients does not have to be on domain to access it. Think two user, user #1 has privileges as site admin to access site and edit, user #2 is regular domain user and has no privileges on site. #1 can access that page and run the code, #2 can also access page gets "Sorry, this list hasn't been shared with you" error but code still runs, as you see debug drops in page_load in the animation gif. Why that code even run for #2? – Ergec Jun 16 '17 at 5:04
  • Ideally, if user dont have permission on web/site collection, he/she cannot access resource under it including Application Page. When the authentication is completed, SP checks for authorization and give this message that, Sorry, you dont have permission along with an access request form. Since you created a public site, because of that it is executing the code. Can you confirm what settings you have for web application in terms of User Policy, Anonymous Policy and Permission Policy. – ThinkB4Code Jun 16 '17 at 6:41
  • This is a test site and it's not even public yet, it's not anonymous. It's just a publishing site from publishing portal template. Like I said all settings are default sharepoint settings out of the box. Sharepoint gives error Sorry, you dont have permission but still runs the code. So why it still runs the code, if logged in user does not have permission and it clearly displays the error message but still runs it. – Ergec Jun 16 '17 at 8:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.