0

We'd like to develop an on-provider web app which can import documents from a Sharepoint instance. Right now we are focusing on Sharepoint Online, but later on, we will create on-premise solutions as well. We want to stick with REST API because we use different technologies accessing the Sharepoint site which includes .NET Core which doesn't have a fully implemented SharepointContext and TokenHelper class.

How can I give permission to any user who has read / download permission on the site to use our app? Since we are not on the Sharepoint site, we have to use low trust authorization, but we don't want our users to have Manage permissions on the Sharepoint site.

The other question is how to authorize our app to include user permissions as well. I've already come to a solution where we could authorize the App, but we need to do it with a user who has Manage permission on the site, and the Context token we got didn't include any user information like it is mentioned on the Sharepoint developer site. User+Add-in policy

Maybe my question is a bit confusing, but I am confused now too.

Any suggestion is welcome.

Thanks, SanTa

1

I think you confuse some principals around SharePoint provider hosted addins.

What is user + addin authorization? Below sample can explain it:

Let's say you requested Read Web permissions for your addin via manifest file. Your user has Full Control permission:

User: Full Control + Addin: Read Web -> Read Web = effective permission for User+Addin

Another situation:

User: Read Web + Addin: Full Control -> Read Web = effective permission for User+Addin

Above explanation answers your question:

How can I give permission to any user who has read / download permission on the site to use our app?

If you want to use User+Addin permission, you should give a user whatever permissions are needed for your app to function properly. If your app needs Manage Web and a user has only Read it won't work.

To answer you next question

The other question is how to authorize our app to include user permissions as well

Just use a sample of provided hosted add-in with "old" .net and inspect access token. The token contains both user and addin permissions. However you should adjust it to your workflow, because you use REST instead of CSOM.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.