2

I have a SharePoint 2013 add-in that uses the SP REST API to add an item to a library on the host web. I don't want to grant app users edit-level permissions to the library since the app will be in charge of adding library items, not the user. I have already set the app's permission level in the app manifest to full-control, however the app's Post call returns an error when a user with read permissions attempts to use the app. Is there anyway for a user with read permissions to use an app that Posts to a host library?

1

Just use Add-in-only policy. In Visual Studio, open app manifest in design mode and there is a checkbox in upper left corner on the permissions tab. Add-ins-only policy enables Add-ins to use separate access rights in given scope. It should do the job for you.

  • I am sure that @Y.MoumenElidrissi is wrong. And following the link you can find: Add-in-only policy - "When the add-in-only policy is used, SharePoint checks only the permissions of the add-in principal." – user69904 Aug 28 '17 at 23:28
  • One more thing. I have created couple of provider hosted Add-Ins working this way. I have never used SharePoint hosted Add-Ins. – user69904 Aug 28 '17 at 23:47
  • 1
    After some research, it turns out that the add-in only policy only works for provider hosted apps – cmoody4 Aug 29 '17 at 17:33
  • @Radas I'm not wrong Add-in only policy works only for Provider hosted apps and User+add-in policy works for SharePoint hosted apps. Apps that do not make OAuth authenticated calls (for example, apps that are only JavaScript running in the app web) cannot use the app-only policy – Youssef Moumen El idrissi Aug 29 '17 at 23:08
1

You cannot use a Rest Post action on host web with users that have read permission. Check this link and read User+add-in policy : Get an overview of add-in authorization policies types

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.