1

I need to implement option in Xamarin.Forms app to sign in as different user to remote SP web site. But the problem is no matter what username and password are used SP2013 server always authorize client request and return valid response from previous user credentials. As if new ClientContext never been instantiated. So, how would i invalidate previous user credentials?

Have simple XF app with one main page for testing (SP server implement NTML authentication):

public partial class MainPage : ContentPage
{
    public MainPage()
    {
        InitializeComponent();
    }

    protected override async void OnAppearing()
    {
        base.OnAppearing();

        await Task.Delay(2000);

        var ctx = new ClientContext("https://mysite.com/") { Credentials = new NetworkCredential("valid-user", "password", "domain") };
        var valid = await IsCredentialsValid(ctx); //expected: true, result: true
        InfoLabel.Text = $"User credentials {(valid ? "VALID" : " INVALID")} 1";
        ctx.Dispose();

        await Task.Delay(2000);

        var ctx2 = new ClientContext("https://mysite.com/") { Credentials = new NetworkCredential("fake-user", "fake-password", "domain") };
        valid = await IsCredentialsValid(ctx2); //expected: false, result: true
        InfoLabel.Text = $"User credentials {(valid ? "VALID" : " INVALID")} 2";
        ctx2.Dispose();
    }

    public static async Task<bool> IsCredentialsValid(ClientContext ctx)
    {
        try
        {
            var lists = ctx.Web.Lists;
            ctx.Load(lists);
            await ctx.ExecuteQueryAsync();
            Console.WriteLine($"Lists count: {lists.Count}");
            return true;
        }
        catch (Exception e)
        {
            Console.WriteLine(e.Message);
            return false;
        }
    }
}
0

I've tested your code. It works correctly.

Make sure nonvalid-user really doesn't have any permissions. On https://mysite.com/_layouts/15/user.aspx page press Check Permissions button. Type nonvalid-user in the popup and press Check Now. It should show only Limited Access.

|improve this answer|||||
  • Did you test on console app or on mobile device? Because plain console app works correctly indeed. Have problem only on mobile platform (Android, iOS). By 'nonvalid-user' i means non-existing fake user with fake password. – Arvis Oct 7 '19 at 10:03
  • @Arvis it was indeed console app. Hmmm, CSOM API should be consistent across platforms. I don't have Xamarin set up to test it. I'll delete the answer if you're sure it is platform related problem. EDIT: Also did you try sync call? – Slaven Semper Oct 7 '19 at 10:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.