I maintain a Windows application that uses CSOM to allow users to check values in a SharePoint list and update it if necessary. It had been working fine using only Windows authentication. Recently we switched over to Mixed mode authentication (Windows and ADFS 3.0) and the application stopped working. I can get it to work fine for Windows users by adding the X-FORMS_BASED_AUTH_ACCEPTED header. Unfortunately, I can't get it to work for ADFS users. I can get a SAML token from ADFS, and when I post that to SharePoint I get a FedAuth cookie, so I'm assuming it's authenticating me. But when the application tries to access any kind of user info (for example, siteusers) with the cookie, it throws an Access Denied error. When I try to look at the error in Fiddler I see the following:
X-Forms_Based_Auth_Required: https://<site>/_login/default.aspx?ReturnUrl=/_layouts/15/error.aspx&Source=%2f_vti_bin%2fclient.svc%2fProcessQuery X-Forms_Based_Auth_Return_Url: https://<site>/_layouts/15/error.aspx X-MSDAVEXT_Error: 917656; Access denied. Before opening files in this location, you must first browse to the web site and select the option to login automatically.
I've tried everything I can find but I always run into the same error.