0

I have the following CSOM code

        using (var clientContext = new ClientContext(new Uri("http://localhost")))
        {

            try
            {
                var siteCol = clientContext.Site;
                var web = siteCol.RootWeb;
                clientContext.Load(siteCol);
                clientContext.Load(web, w => w.Title);
                clientContext.ExecuteQuery();

                TaxonomySession session = TaxonomySession.GetTaxonomySession(clientContext);
                TermStore store = session.GetDefaultKeywordsTermStore();
                TermGroupCollection groups = store.Groups;


                clientContext.Load(session, s => s.TermStores);
                clientContext.Load(store, s => s.Groups);
                clientContext.ExecuteQuery();
            }
            catch (System.Net.WebException wEx)
            {
                Console.WriteLine("Error: " + wEx.Message);
            }
            catch (Microsoft.SharePoint.Client.ServerException sEx)
            {
                Console.WriteLine("Error: " + sEx.Message);
            }
        }

When I remove these lines I have no errors in my ULS.

                TaxonomySession session = TaxonomySession.GetTaxonomySession(clientContext);
                TermStore store = session.GetDefaultKeywordsTermStore();
                TermGroupCollection groups = store.Groups;


                clientContext.Load(session, s => s.TermStores);
                clientContext.Load(store, s => s.Groups);
                clientContext.ExecuteQuery();

With these lines I get the error

05/16/2019 09:19:32.38 w3wp.exe (0x2958) 0x23E0 SharePoint Foundation Claims Authentication bz7l Medium SPSecurityContext: Could not retrieve a valid windows identity for username 'DOMAIN\USER' with UPN 'user@domain.com'. UPN is required when Kerberos constrained delegation is used. Exception: System.ComponentModel.Win32Exception (0x80004005): Access is denied Server stack trace: at System.ServiceModel.Channels.AppContainerInfo.GetCurrentProcessToken() at System.ServiceModel.Channels.AppContainerInfo.RunningInAppContainer() at System.ServiceModel.Channels.AppContainerInfo.get_IsRunningInAppContainer() at System.ServiceModel.Channels.PipeSharedMemory.BuildPipeName(String pipeGuid) at System.ServiceModel.Channels.PipeSharedMemory.get_PipeName() at System.ServiceModel.Channels.PipeConnectionInitiator.GetPipeName(Uri uri, IPipeTransportFactorySettings transportFactorySettings) at System.ServiceModel.Channels.NamedPipeConnectionPoolRegistry.NamedPipeConnectionPool.GetPoolKey(EndpointAddress address, Uri via) at System.ServiceModel.Channels.CommunicationPool2.TakeConnection(EndpointAddress address, Uri via, TimeSpan timeout, TKey& key) at System.ServiceModel.Channels.ConnectionPoolHelper.EstablishConnection(TimeSpan timeout) at System.ServiceModel.Channels.ClientFramingDuplexSessionChannel.OnOpen(TimeSpan timeout) at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout) at System.ServiceModel.Channels.ServiceChannel.OnOpen(TimeSpan timeout)
at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout) at System.ServiceModel.Channels.ServiceChannel.CallOpenOnce.System.ServiceModel.Channels.ServiceChannel.ICallOnce.Call(ServiceChannel channel, TimeSpan timeout) at System.ServiceModel.Channels.ServiceChannel.CallOnceManager.CallOnce(TimeSpan timeout, CallOnceManager cascade) at System.ServiceModel.Channels.ServiceChannel.EnsureOpened(TimeSpan timeout) at System.ServiceModel.Channels.ServiceChannel.Call(String action, Boolean oneway, ProxyOperationRuntime operation, Object[] ins, Object[] outs, TimeSpan timeout) at System.ServiceModel.Channels.ServiceChannelProxy.InvokeService(IMethodCallMessage methodCall, ProxyOperationRuntime operation) at System.ServiceModel.Channels.ServiceChannelProxy.Invoke(IMessage message) Exception rethrown at [0]: at System.Runtime.Remoting.Proxies.RealProxy.HandleReturnMessage(IMessage reqMsg, IMessage retMsg) at System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(MessageData& msgData, Int32 type) at Microsoft.IdentityModel.WindowsTokenService.S4UClient.IS4UService_dup.UpnLogon(String upn, Int32 pid) at Microsoft.IdentityModel.WindowsTokenService.S4UClient.CallService(Func
2 contractOperation) at Microsoft.SharePoint.SPSecurityContext.GetWindowsIdentity(). f61add9e-e6f5-b088-d589-9faf490ff571 05/16/2019 09:19:32.38 w3wp.exe (0x2958) 0x23E0 SharePoint Foundation Claims Authentication g220 Unexpected No windows identity for DOMNAIN\USER. f61add9e-e6f5-b088-d589-9faf490ff571

Why do I get a Kerberos error. I have no double hops. I do everything on my development server.

  • Are you using token-based (App) authentication or using Windows auth in your code? You don't show that piece. – Trevor Seward May 16 '19 at 14:56
  • In this sample I use the default network credentials.So WIndows auth. I also tested this with a high trust add in, using token based on certificate and I get the same error – Danny May 17 '19 at 10:25
0

SharePoint server is trying to establish named pipes connection to Claims to Windows Token Service using account which doesn't have necessary permissions. This is a false positive and most likely doesn't have to do anything with your original error. Since CSOM doesn't allow you to run the code with elevated privileges, this error can't avoided by using CSOM alone. If you were to use SSOM the workaround would be (under the assumption you don't need Claims to Windows Token Service) to run this code before:

typeof(SPSecurityContext).GetProperty("ClaimsToWindowsTokenServiceEnabled", BindingFlags.NonPublic | BindingFlags.Static).SetValue(null, false);

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.