3

Dear SharePoint community,

I need to be able to access SharePoint online API's in an environment that uses PingIdentity to provide SSO to Office 365.

When a user requests a https://mycompany.sharepoint.com/somesite

  1. They are redirected to login.microsoftonline.com and asked for their "email" account.
  2. They are then taken to Ping Identity login page. They are asked here for a password.
  3. Once they present the password, they are now taken to https://mycompany.sharepoint.com/somesite with rtfa / fedAuth cookies present in the request headers which allows them to now access the protected resources.

I was able to get this exact same scenario working via REST API for ADFS as high-level documented here:

How to authenticate to SharePoint Online (Office 365) using REST API when On-premise ADFS Sync to Office 365 cloud is enabled?

Does anyone have the equivalent of how to make REST api requests to obtain the cookies from PingIdentity/Microsoft Login in this scenario? I can use SOAP, REST, or C# to do it. Whatever works to generate the fedAuth and rtfa cookies I can use? Postman, soapUI, code snippets, or high-level description, anything.

  • I can get Token and FedAuth and rtFa cookie . But I want to use those data to login my sharepoint site page(teaner.sharepoint.com/site/mysite)on browser. How to do it? Thank you. – Bryant Nov 4 '18 at 8:52
2

The simple way to connect to SharePoint Online is using .net CSOM SDK. You don't need to generate FedAuth and rtfa cookies. SharePointOnlineCredentials class which is provided as part of .net sdk is sufficient to make the connection (even with PingFederate). The latest version of the sdk can handle authentication in federated identity scenarios. A lot of examples online which involves generating FedAuth cookie seems to refer to older version of CSOM sdk, which did not seem to support federated scenarios. Below code sample shows how to connect to SPO using .net SDK using powershell, same can be done in C#.

[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;

$Password = Read-Host -Prompt "Please enter your password" -AsSecureString
$Creds = New-Object Microsoft.SharePoint.Client.SharePointOnlineCredentials($User,$Password)
$Context = New-Object Microsoft.SharePoint.Client.ClientContext($SiteURL)
$Creds = New-Object Microsoft.SharePoint.Client.SharePointOnlineCredentials($User,$Password)
    $Context.Credentials = $Creds

Because in this scenario we are trying to get cookies using web requests, take a look at this link's idea: https://allthatjs.com/2012/03/28/remote-authentication-in-sharepoint-online/

Basically you can

  1. set up csom to log in as indicated
  2. enable fiddler
  3. run the program to log in and make a csom request
  4. Check the fiddler output to copy the network calls as they came in
  • Thanks sssreddy. I don't understand... where in that snippet do you specify the sharepoint endpoint? And unfortunately, I need to get the rtfa/fedauth cookies because i'm making REST and Soap api calls using an existing application that is already written. is it possible to use CSOM to get these cookies? Do you know if this will work on Mono/Linux? Or will I need to use windows? – Nicholas DiPiazza Jan 19 '18 at 18:40
  • Can you please provide a brief detail on what platform and language used in your application. The above example uses SharePoint Online .net CSOM Sdk and runs on windows. When using this sdk you don't need to explicitly get the FedAuth and rtfa cookie, it is handled internally in the sdk. – sssreddy Jan 19 '18 at 19:05
  • I am using REST API requests, therefore platform independent. Bypassing the fedauth/rtfa cookies won't work for me because i explicitly need them. – Nicholas DiPiazza Jan 20 '18 at 7:19
  • I didn't realize i can use that SPOIDCRL cookie achieve login. – Nicholas DiPiazza Feb 23 '18 at 6:55
  • I tried this... it worked on my Sharepoint Online instance that uses microsoft native login. But for my instance with ADFS synced Federation... it does NOT work. Returns NULL cookie every time. @sssreddy any ideas? – Nicholas DiPiazza Feb 23 '18 at 18:16
0

Created a github project for us non-windows folks

https://github.com/nddipiazza/SharepointOnlineCookieFetcher

Creates a program in bundled mono (requires no mono installation required, but does have an annoying sudo mkdir and chmod step needed).

You can then platform independently run this CSOM based cookie fetcher and use it in your web service based program.

UPDATE: This worked only on Sharepoint Online with Microsoft built-in login. ADFS backed sharepoint online did NOT work with this approach.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.