0

I have the following SSOM in a console app

    using (SPSite site = new SPSite("http://localhost"))
    {
        using(SPWeb web = site.OpenWeb())
        {
            Console.WriteLine(web.Title);
            TaxonomySession TaxonomySession = new TaxonomySession(site);
            TermStore termstore = TaxonomySession.DefaultKeywordsTermStore;
            var termGroup = termstore.GetSiteCollectionGroup(site, true);
        }
    }

When I run this I get this from the Claims to Windows token service:

STS Call Claims Windows: Successfully requested sign-in claim identity for user 'DOMAIN\USER'.

When I do the same in CSOM code in the same console app

        using (var clientContext = new ClientContext(new Uri("http://localhost")))
        {

            try
            {
                var siteCol = clientContext.Site;
                var web = siteCol.RootWeb;
                clientContext.Load(siteCol);
                clientContext.Load(web, w => w.Title);
                clientContext.ExecuteQuery();
                TaxonomySession session = TaxonomySession.GetTaxonomySession(clientContext);
                TermStore store = session.GetDefaultKeywordsTermStore();
                TermGroupCollection groups = store.Groups;
                clientContext.Load(session, s => s.TermStores);
                clientContext.Load(store, s => s.Groups);
                clientContext.ExecuteQuery();
            }
            catch (System.Net.WebException wEx)
            {
                Console.WriteLine("Error: " + wEx.Message);
            }
            catch (Microsoft.SharePoint.Client.ServerException sEx)
            {
                Console.WriteLine("Error: " + sEx.Message);
            }
        }

I get this error in my ULS

SPSecurityContext: Could not retrieve a valid windows identity for username 'DOMAIN\USER' with UPN 'user@domain.com'. UPN is required when Kerberos constrained delegation is used. Exception: System.ComponentModel.Win32Exception (0x80004005): Access is denied    Server stack trace:     
 at System.ServiceModel.Channels.AppContainerInfo.GetCurrentProcessToken()    
 at System.ServiceModel.Channels.AppContainerInfo.RunningInAppContainer()    
 at System.ServiceModel.Channels.AppContainerInfo.get_IsRunningInAppContainer()    
 at System.ServiceModel.Channels.PipeSharedMemory.BuildPipeName(String pipeGuid)    
 at System.ServiceModel.Channels.PipeSharedMemory.get_PipeName()    
 at System.ServiceModel.Channels.PipeConnectionInitiator.GetPipeName(Uri uri, IPipeTransportFactorySettings transportFactorySettings)    
 at System.ServiceModel.Channels.NamedPipeConnectionPoolRegistry.NamedPipeConnectionPool.GetPoolKey(EndpointAddress address, Uri via)    
 at System.ServiceModel.Channels.CommunicationPool`2.TakeConnection(EndpointAddress address, Uri via, TimeSpan timeout, TKey& key)    
 at System.ServiceModel.Channels.ConnectionPoolHelper.EstablishConnection(TimeSpan timeout)    
 at System.ServiceModel.Channels.ClientFramingDuplexSessionChannel.OnOpen(TimeSpan timeout)    
 at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout)    
 at System.ServiceModel.Channels.ServiceChannel.OnOpen(TimeSpan timeout)    
 at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout)    
 at System.ServiceModel.Channels.ServiceChannel.CallOpenOnce.System.ServiceModel.Channels.ServiceChannel.ICallOnce.Call(ServiceChannel channel, TimeSpan timeout)    
 at System.ServiceModel.Channels.ServiceChannel.CallOnceManager.CallOnce(TimeSpan timeout, CallOnceManager cascade)    
 at System.ServiceModel.Channels.ServiceChannel.EnsureOpened(TimeSpan timeout)    
 at System.ServiceModel.Channels.ServiceChannel.Call(String action, Boolean oneway, ProxyOperationRuntime operation, Object[] ins, Object[] outs, TimeSpan timeout)    
 at System.ServiceModel.Channels.ServiceChannelProxy.InvokeService(IMethodCallMessage methodCall, ProxyOperationRuntime operation)    
 at System.ServiceModel.Channels.ServiceChannelProxy.Invoke(IMessage message)    Exception rethrown
 at [0]:     
 at System.Runtime.Remoting.Proxies.RealProxy.HandleReturnMessage(IMessage reqMsg, IMessage retMsg)    
 at System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(MessageData& msgData, Int32 type)    
 at Microsoft.IdentityModel.WindowsTokenService.S4UClient.IS4UService_dup.UpnLogon(String upn, Int32 pid)    
 at Microsoft.IdentityModel.WindowsTokenService.S4UClient.CallService(Func`2 contractOperation)    
 at Microsoft.SharePoint.SPSecurityContext.GetWindowsIdentity().

and a unexpected error

No windows identity for domain\user.

Strange thing is, that I also see this error for the content access account when the crawler is active.

When I make the user that is running te console app local admin the error is gone. When I open the web.config for my webapplication and set aspnet:AllowAnonymousImpersonation to false

<add key="aspnet:AllowAnonymousImpersonation" value="false" />

the error is also gone but I don't see the message

STS Call Claims Windows: Successfully requested sign-in claim identity for user 'DOMAIN\USER'.

My config for the claims to windows token service has all accounts allowed

<allowedCallers>
  <clear />
  <add value="IIS_IUSRS" />
  <add value="NT AUTHORITY\IUSR" />
  <add value="WSS_WPG" />
  <add value="NT AUTHORITY\Authenticated Users" />    
</allowedCallers>
  • Are you using token-based (App) authentication or using Windows auth in your code? You don't show that piece. – Trevor Seward May 16 '19 at 14:56
  • In this sample I use the default network credentials.So WIndows auth. I also tested this with a high trust add in, using token based on certificate and I get the same error – Danny May 17 '19 at 10:25
  • Added some more details – Danny May 14 at 14:21
0

SharePoint server is trying to establish named pipes connection to Claims to Windows Token Service using account which doesn't have necessary permissions. This is a false positive and most likely doesn't have to do anything with your original error. Since CSOM doesn't allow you to run the code with elevated privileges, this error can't avoided by using CSOM alone. If you were to use SSOM the workaround would be (under the assumption you don't need Claims to Windows Token Service) to run this code before:

typeof(SPSecurityContext).GetProperty("ClaimsToWindowsTokenServiceEnabled", BindingFlags.NonPublic | BindingFlags.Static).SetValue(null, false);
| improve this answer | |
  • When I add this to my server side code I still see claims being converted to tokens. – Danny May 14 at 14:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.