Designer 2013 workflow cross-site REST

Question

I'm trying to use a 2013 designer workflow to read a cross-site collection list. I'm following several different tutorials similar to this one.

Because of the cross-site stuff I'm first doing a POST to

https://<remote site>/_api/contextinfo

The trick to get that to work was to include Authorization with no value in the request headers. And eventually I got that to work. And I'm retrieving the d/GetContextWebInformation/FormDigest value. I log it to the work history list and it looks correct. My understanding is that the digest is what is required to allow reading of the remote list.

I then create a new requestHeaders dictionary with the following values.

Accept:application/json;odata=verbose
Content-Type:application/json;odata=verbose
X-RequestDigest:variable digestValue

And then I try and make a GET request to

https://<remote site>/_api/web/lists/getbytitle('<listname>')/items

I'm getting a response code of unauthorized and the following response content:

{"error":{"code":"-2147024891, System.UnauthorizedAccessException","message":{"lang":"en-US","value":"Access denied. You do not have permission to perform this action or access this resource."}}}

Both sites are on the same farm and I'm site collection owner of both sites and have full control in both locations.

I've tried adding the Authorization blank to the request headers. I've tried changing the capitalization (just in case you were going to suggest that) of all the different params in the request headers. I've checked the url and list name and it is correct.

Any ideas on how to get this to work?

A little bit more I couldn't log the returned contents nor request header dictionary to the work history -- they would crash the workflow. But I can email them to myself, so here they are.

This is the response to contextinfo endpoint. It looks correct to me.

{  
   "d":{  
      "GetContextWebInformation":{  
         "__metadata":{  
            "type":"SP.ContextWebInformation"
         },
         "FormDigestTimeoutSeconds":1799,
         "FormDigestValue":"0x01E2FB49D36AAFC7DE415ECD0FB7542817ECCB7F01E27D06E2563C5DC3EBBD524A4116E3139C5E59D39FE81148B4C5287574263F903A15BE7A8C4A3505E3FF94,20 Jun 2017 19:58:30 -0000",
         "LibraryVersion":"15.0.4805.1000",
         "SiteFullUrl":"https:\/\/<on-prem>\/<managed-path>\/<site-collection>",
         "SupportedSchemaVersions":{  
            "__metadata":{  
               "type":"Collection(Edm.String)"
            },
            "results":[  
               "14.0.0.0",
               "15.0.0.0"
            ]
         },
         "WebFullUrl":"https:\/\/<on-prem>\/<managed-path>\/<site-collection>"
      }
   }
}

And this is the request headers I constructed with the returned value.

{  
   "Accept":"application\/json;odata=verbose",
   "Content-Type":"application\/json;odata=verbose",
   "X-RequestDigest":"0x01E2FB49D36AAFC7DE415ECD0FB7542817ECCB7F01E27D06E2563C5DC3EBBD524A4116E3139C5E59D39FE81148B4C5287574263F903A15BE7A8C4A3505E3FF94,20 Jun 2017 19:58:30 -0000"
}

Overall they look correct to me. Anybody else?

Answer 1

You can try to run the workflow with elevated privileges. In SharePoint 2013 designer workflow to run with elevated privileges, you should run your HTTP web call action in the APP Steps.

The steps you have to follow to activate the APP Step

• Go to Site Settings.
• Go to "Manage Site Features"
• Activate the feature "Workflow can use App Permissions".

This will APP Step in the SharePoint Designer workflow ribbon.

By default, the app step will have permissions to do any change in the current site. To give additional permissions to the Workflow app we need to follow below steps.

App permissions to workflow steps

• Go to site settings.
• In the Users and Permissions section, select Site app permissions.
• Copy the client section of the App Identifier. This is the identifier between the last "|" and the "@" sign.
• Navigate to the Grant permission to an app page.
• Add new permissions from the http://{hostname}/{the Site Collection}/_layouts/15/appinv.aspx page.
• You have to paste the Workflow App Id to that page.
• Paste the following permissions to permissions textbox.

<AppPermissionRequests>
    <AppPermissionRequest Scope="http://sharepoint/content/sitecollection" Right="Read" />
    <AppPermissionRequest Scope="http://sharepoint/content/sitecollection/web" Right="FullControl" />
</AppPermissionRequests>

The above one read every resource from site collection and has full control on current web resources.

The APP permissions may differ as per your requirement.

You can refer below article for complete steps

Configure SPD workflow to run with elevated privileges

Different APP permissions to set for workflow