0

I've got an interesting permissions problem with the CSOM API.

We have about 200 site collections.

I have created a Permission Level on each site collection, and have assigned a Service Account AD Account the following permissions:

  • View Items
  • Open Items
  • View Versions
  • View Application Pages
  • View Web Analytics Data
  • Browse Directories
  • View Pages
  • Enumerate Permissions
  • Browse User Information
  • Open

I am authenticating through ADFS SAML, and then am using CSOM api to get site metadata about each site.

For 50% of these sites, it's working fine.

For the remaining sites, we get an access denied error:

[
    {
        "SchemaVersion": "14.0.0.0",
        "LibraryVersion": "16.0.19527.12083",
        "ErrorInfo": {
            "ErrorMessage": "Access denied. You do not have permission to perform this action or access this resource.",
            "ErrorValue": null,
            "TraceCorrelationId": "640d309f-b0f7-b000-8100-49826f3674cb",
            "ErrorCode": -2147024891,
            "ErrorTypeName": "System.UnauthorizedAccessException"
        },
        "TraceCorrelationId": "640d309f-b0f7-b000-8100-49826f3674cb"
    }
]

Here are curls that performs the web service request we are attempting to make. First get the digest value:

sharepointUrl="https://mytesttenant.sharepoint.com/sites/ndd2"
fedAuthCookieValue="77...L1NQPg=="
rtfaCookieValue="Gu...UAAAA="

curl --location --request POST "${sharepointUrl}/_vti_bin/sites.asmx" \
--header 'Content-Type: text/xml' \
--header 'SOAPAction: http://schemas.microsoft.com/sharepoint/soap/GetUpdatedFormDigestInformation' \
--header 'X-RequestForceAuthentication: true' \
--header "Cookie: FedAuth=$fedAuthCookieValue;rtFa=$rtfaCookieValue" \
--data-raw '<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
  <soap:Body>
    <GetUpdatedFormDigestInformation xmlns="http://schemas.microsoft.com/sharepoint/soap/" />
  </soap:Body>
</soap:Envelope>'

We are able to do this first step to get the digest value on all sites with no error. Next we use the digest value and try to get a site's metadata:

curl --location --request POST "${sharepointUrl}/_vti_bin/client.svc/ProcessQuery" \
--header 'Content-Type: text/xml' \
--header 'X-ClientService-ClientTag: TAPS (16.0.7813.0)' \
--header 'X-FORMS_BASED_AUTH_ACCEPTED: f' \
--header 'X-RequestForceAuthentication: true' \
--header "Cookie: FedAuth=$fedAuthCookieValue;rtFa=$rtfaCookieValue" \
--header 'X-RequestDigest: 0xAAFA94...from.above...F604C,01 Aug 2018 20:18:34 -0000' \
--data-raw '<Request AddExpandoFieldTypeSuffix="true" SchemaVersion="15.0.0.0" LibraryVersion="16.0.0.0" ApplicationName="SharePoint Online PowerShell (16.0.7813.0)" xmlns="http://schemas.microsoft.com/sharepoint/clientquery/2009"><Actions><ObjectPath Id="4" ObjectPathId="3" /><ObjectPath Id="6" ObjectPathId="5" /><Query Id="7" ObjectPathId="5"><Query SelectAllProperties="true"><Properties><Property Name="NextStartIndexFromSharePoint" ScalarProperty="true" /></Properties></Query><ChildItemQuery SelectAllProperties="true"><Properties /></ChildItemQuery></Query></Actions><ObjectPaths><Constructor Id="3" TypeId="{268004ae-ef6b-4e9b-8425-127220d84719}" /><Method Id="5" ParentId="3" Name="GetSitePropertiesFromSharePoint"><Parameters><Parameter Type="Null" /><Parameter Type="Boolean">false</Parameter></Parameters></Method></ObjectPaths></Request>'

This second request is where 50% of the time, we get a valid response, and the other 50% of the time, we get the access denied error.

We looked at the Permissions area for the site collection and see nothing different between the site collections that allow us to view metadata and the site collections that do not.

The only way we can proceed thus far is to grant site collection admin to our service account.

Can anyone shed some light on how these site collections could possibly be different causing 50% of our sites web service calls to fail due to "Access Denied?"

  • If permissions on all sites are same then maybe it is throwing an error because of the X- RequestDigest value. – Ganesh Sanap Jan 29 at 4:55
  • Thanks for the reply! Because it works fine when i grant the user Site Collection Administrator, I'm assuming the process I'm creating the digest with is fine. – Nicholas DiPiazza Jan 29 at 4:58
  • I added that part of the process to the ticket in case it helps – Nicholas DiPiazza Jan 29 at 5:00
0

Opened a ticket on Microsoft, then it magically started working. Someone probably fixed something. But I have no way to know what exactly was fixed.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.