1

I have registered an app principal in one of our sites using "appregnew.aspx" and gave permissions using "appinv.aspx". I'm using this app's client ID and client secret in a console job which was running fine for few months till now.

The job suddenly started failing and I see the below error message from TokenHelper.cs -

Microsoft.IdentityModel.SecurityTokenService.RequestFailedException was caught HResult=-2146233088 Message=Token request failed. Source=Microsoft.IdentityModel.Extensions StackTrace: at Microsoft.IdentityModel.S2S.Protocols.OAuth2.OAuth2S2SClient.Issue(String securityTokenServiceUrl, OAuth2AccessTokenRequest oauth2Request) at SFMO.CIM.SPToBPM.TokenHelper.GetAppOnlyAccessToken(String targetPrincipalName, String targetHost, String targetRealm) in c:\Users\v6urbn\Desktop\Raghav\Dev\CIM\SFMO.CIM.SPToBPM\SFMO.CIM.SPToBPM\TokenHelper.cs:line 355 at SFMO.CIM.SPToBPM.SyncBPM.StartSync() in c:\Users\v6urbn\Desktop\Raghav\Dev\CIM\SFMO.CIM.SPToBPM\SFMO.CIM.SPToBPM\SyncBPM.cs:line 47 InnerException: System.Net.WebException HResult=-2146233079 Message=The remote server returned an error: (401) Unauthorized. Source=System StackTrace: at System.Net.HttpWebRequest.GetResponse() at Microsoft.IdentityModel.S2S.Protocols.OAuth2.OAuth2WebRequest.GetResponse() at Microsoft.IdentityModel.S2S.Protocols.OAuth2.OAuth2S2SClient.Issue(String securityTokenServiceUrl, OAuth2AccessTokenRequest oauth2Request) InnerException:

And this is how I create the ClientContext -

Uri siteUri = new Uri(config.SiteUrl);
string realm = TokenHelper.GetRealmFromTargetUrl(siteUri);
string accessToken = TokenHelper.GetAppOnlyAccessToken(TokenHelper.SharePointPrincipal, siteUri.Authority, realm).AccessToken;
using (var clientContext = TokenHelper.GetClientContextWithAccessToken(siteUri.ToString(), accessToken))
{
}

I've tried providing the permissions again for the app principal and it did not work. If I generate a new app principal with permissions and use it in the job it is working fine.

Any pointers on how to troubleshoot this issue?

3

I've found the issue. It looks like the client secret generated for a client ID expires after one year.

https://docs.microsoft.com/en-us/sharepoint/dev/sp-add-ins/replace-an-expiring-client-secret-in-a-sharepoint-add-in

A new client ID should be re-generated and assigned to this client ID.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.