18

I am trying to authenticate with the REST API for a list in SharePoint Online using POSTMAN.

For example, the URL for my site looks something like this:

https://mytenantname.sharepoint.com/sites/mysitecollection/_api/web/lists

When I go to the URL for the REST API in browser I can access it fine using my SharePoint Online credentials. I log in and it returns the list of lists in JSON.

When I try to use a GET in POSTMAN it fails with "Access Denied" or it shows the following error:

{"error_description":"Exception of type 'Microsoft.IdentityModel.Tokens.AudienceUriValidationFailedException' was thrown."}

Which Authorization type should I be selecting in POSTMAN to authenticate correctly with SharePoint Online?

  • have you found the soultion , i am facing the same problem – Mohamed Sahir Feb 19 '18 at 19:29
  • 1
    Have you register the app and granted appropriate permission? As soon as I remember you will need Auth 2 and acquired a token by providing all the details related to app. – SharePointer Feb 19 '18 at 21:30
  • @MohamedSahir see answer below. I have just worked through this in POSTMAN and Azure and it works for me. – motionpotion Feb 20 '18 at 0:04
19

Answering my own question in case it helps somebody.

As mentioned in comment by @SharePointer you need to register an app in Azure AD in order to authenticate against it. That app that you register needs to be given permissions to your SharePoint Online.

Login to Azure Portal at https://portal.azure.com that is used by your O365 Tenant where you want to access the SharePoint site.

Navigate to Azure AD. Find "App Registrations" in the menu. Select "New App Registration". Give it a name like SPO or POSTMAN. Select the Application Type to be "Web app / API" and the Sign-on URL to https://www.getpostman.com/oauth2/callback

Once it is registered note the Application ID and copy it to notepad.

Go to Required Permissions in the application you just registered. Select SharePoint Online under the Select an API in step 1. Then under 2 Select Permissions choose "Have full control of all site collections".

Now choose KEYS blade and add a key. The key only shows once when you save it. Copy it to notepad.

Go to POSTMAN app on your desktop. Create a new request. For example, https://mytenantname.sharepoint.com/sites/mysitecollection/_api/web/lists Set a header of "Accept: application/json; odata=verbose"

Go to the Authorization tab in POSTMAN. Select Oauth 2.0 from the dropdown and press the Get New Access Token.

Fill out the fields in that dialog like below:

Auth URL : https://login.microsoftonline.com/common/oauth2/authorize?resource=https://mytenantname.sharepoint.com
Access Token URL : https://login.microsoftonline.com/common/oauth2/token
Client ID :
Client Secret :
Grant Type : Authorization Code

Click Request Token button.

At this point you should login with an admin user. You will also be asked to allow the permissions you set on the Application in Azure AD. This is why you need to log in as an Admin account. Accept the permissions request when asked.

The token is returned. Copy it to notepad and then click the "Use Token" button. This fills in the token to the correct place in POSTMAN.

Now Send your request and you should have a successful returend JSON list of lists.

[EDIT] In addition to above I have found that I need to create a certificate in order to authenticate. Just registering the app and giving permissions was not enough.

To do this check out the makecert command in a Visual Studio Developer command prompt. Example below:

makecert -r -pe -n "CN=POSTMAN-TEST" -b 12/15/2014 -e 12/15/2016 -ss POSTMAN-TEST -len 2048

Then go to mmc.exe and the Personal folder in the Certificates snap in. Export the cert you created with the command above to a .CER file. Then go to Azure Portal and your registered app that you did above. Download the manifest file. Replace the section for the key credentials in the manifest file and upload it back to the app registration in Azure.

For example put your values from your CER file into this section:

"keyCredentials": [ { "customKeyIdentifier": "$base64Thumbprint_from_above", "keyId": "$keyid_from_above", "type": "AsymmetricX509Cert", "usage": "Verify", "value": "$base64Value_from_above" } ],

  • The formatting in my answer is terrible I know. I will try to correct and make it more legible. – motionpotion Feb 22 '18 at 21:46
  • I wanted to comment but was unable to due to not having required reputation. I was following your steps but got stuck towards the end when you say to export the cert. I used your example to create the cert but I dont see anything in the mmc.exe that looks like that cert. Am I looking in the right place? – Michel Russell Nov 9 '18 at 15:48
  • you may need to add the snap in to your mmc console. I couldn't find the certs I created initially either so I played around with adding & expanding the various certificate locations. – motionpotion Nov 9 '18 at 15:54
  • so i added the certificate snap-in but still dont see the created certs – Michel Russell Nov 9 '18 at 15:55
1

Just to clarify a part of motionpotion's solution (would comment but not high enough rep), the values for the Azure AD Manifest have to be converted before updating.

I followed the guide below which uses Powershell for certificate generation and converting the individual properties to base64, before putting them in Json format for pasting into the manifest.

$cert = New-SelfSignedCertificate -Subject "CN=POSTMAN-TEST" -CertStoreLocation "Cert:\CurrentUser\My" -KeyExportPolicy Exportable -KeySpec Signature

$bin = $cert.RawData

$base64Value = [System.Convert]::ToBase64String($bin)

$bin = $cert.GetCertHash()

$base64thumbprint = [System.Convert]::ToBase64String($bin)

$keyid = [System.Guid]::NewGuid().ToString()

$jsonobj = @{customKeyIdentifier=$base64thumbprint;keyId=$keyId;type="AsymmetricX509Cert";usage="Verify";value=$base64Value}

$keyCredentials = ConvertTo-Json @($jsonobj)

The output of $keyCredentials will be the same as motionpotion's:

"keyCredentials": [ { "customKeyIdentifier": "$base64Thumbprint_from_above", "keyId": "$keyid_from_above", "type": "AsymmetricX509Cert", "usage": "Verify", "value": "$base64Value_from_above" } ],

https://azure.microsoft.com/en-au/resources/samples/active-directory-dotnet-daemon-certificate-credential/

1

Just adding this here since the Azure Portal is slightly different now.

  1. Login to Azure Portal at https://portal.azure.com for your O365 Tenant
  2. Either use the Search at the top of the page for App registrations or Select All Services > Scroll down to Identity and Select App registrations
  3. Select New Registration
  4. Give it a name, Change the account type to which ever you prefer, in this case I just used Accounts in this organizational directory only
  5. (Optional) Enter in a Redirect URL - I used : https://login.microsoftonline.com/common/oauth2/nativeclient
  6. Select Register
  7. On Overview blade copy the Application (client) ID
  8. Select the Certificates & Secrets blade
  9. Select New client secret
  10. Give description and set expiry date if required and Select Add
  11. After selecting Add, make sure you copy the Value generated to your clipboard, otherwise you'll have to generate a new one.
  12. Set Permissions you require on the API permissions blades, here I just added Sharepoint - AllSites.Read
  13. You can now build your REST request
0

enter image description hereyou can use Postman Interceptor for this scenario

Postman Interceptor helps you send requests which use browser cookies through the Postman app. It can also send headers which are normally restricted by Chrome but are critical for testing APIs. The Interceptor makes this process painless. Something that would have required a proxy earlier can now be achieved without any installation steps or extra configuration.

Postman Interceptor

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.