SharePoint 2013 remote authentication in Rest API

Question

I am trying to use SharePoint Rest API from a standalone application with hard-coded user id and password. The operations are working fine using this method. But we are trying to authenticate the current logged in user and send some header with the Rest Call so the SharePoint will do the authentication and authorization by itself with respect to the current user.

I went through this article and found out that we can send

Authorization: Bearer <access_token>

to authenticate the current user. But it is also mentioned in the article that the solution is specific to SharePoint Online only and not to the SharePoint On-Premise (SharePoint 2013 in my case).

So my question is how can I can do the same in SharePoint 2013.

Note :

1. I can only use Rest API and not CSOM or JSOM
2. I cannot create any provider hosted app (if it is a way)
3. If I open any SharePoint page in an I-Frame in my stand alone application page, is there way to grab some cookies or token from there and then pass them in my Rest Calls to SharePoint to authenticate the current user.

Thanks in advance..

Answer 1

I am using form digest for rest calls from Powershell to SharePoint. Using scheduled tasks running as the user you need to authenticate to SharePoint.

First do a POST to [https://...]/_api/contextinfo with header Accept=application/json;odata=verbose and an empty body. The response in $.d.GetContextWebInformation.FormDigestValue is the Request Digest.

Then do your other rest calls using the following header: Accept=application/json;odata=verbose Content-Type=application/json;odata=verbose X-RequestDigest=[response for FormDigestValue] X-FORMS_BASED_AUTH_ACCEPTED=f

The FormDigestValue does expire, so either check the expiration at the end of the value before every call and re-call contextinfo or re-call it every time you do a call.

It also works from workflows, using the dictionary variable and adding Authorization in the header with an empty value.

Answer 2

Following code to get SharePoint form digest as authentication header for your reference:

static async Task<string> GetDigestAsync(string endPoint, HttpClient client)
        {
            string digest = null;
            HttpResponseMessage response = await client.PostAsync(endPoint, new StringContent(""));
            if (response.IsSuccessStatusCode)
            {
                digest = await response.Content.ReadAsStringAsync();
            }
            JObject rss = JObject.Parse(digest);

            return rss["d"]["GetContextWebInformation"]["FormDigestValue"].ToString();
        }



        static async Task RunAsync()
        {
            var username = "administrator";
            var password = "P@ssw0rd";
            var domain = "contoso2016";
            var handler = new HttpClientHandler();
            handler.Credentials = new System.Net.NetworkCredential(username, password, domain);

            string rESTUrl = "http://sp2016/_api/web/lists/getbyTitle('List1')/items";
            var client = new HttpClient(handler);
            client.BaseAddress = new Uri("http://sp2016/");

            client.DefaultRequestHeaders.Accept.Clear();
            client.DefaultRequestHeaders.Add("Accept", "application/json;odata=verbose");
            var digest = await GetDigestAsync("/_api/contextinfo", client);
            Console.WriteLine(digest);
            client.DefaultRequestHeaders.Add("X-HTTP-Method", "POST");
            client.DefaultRequestHeaders.Add("X-RequestDigest", digest);
            HttpContent strContent = new StringContent(String.Concat("{ '__metadata': { 'type': 'SP.Data.List1ListItem' }, 'Title': 'CreatedViaRestAPIPost'}"));
            strContent.Headers.ContentType = new MediaTypeHeaderValue("application/json");
            strContent.Headers.ContentType.Parameters.Add(new NameValueHeaderValue("odata", "verbose"));
            HttpResponseMessage response = await client.PostAsync(rESTUrl, strContent);
            response.EnsureSuccessStatusCode();

        }

Call:

RunAsync().GetAwaiter().GetResult();