1

Hi I've created a high trust sharepoint application which seems to work well for myself as a full trust user.

However when I do the same for a test user (less permissions) it doesn't work for a while. I get the error

Access denied. You do not have permission to perform this action or access this resource. 

When I'm trying to just do something simple like load the current user

[SharePointContextFilter]
        public ActionResult Index()
        {
            var spContext = SharePointContextProvider.Current.GetSharePointContext(HttpContext);

            using (var sp = spContext.CreateUserClientContextForSPHost())
            {
                if (sp != null)
                {

                    sp.Load(sp.Web.CurrentUser);
                    sp.ExecuteQuery();

                    return Content(sp.Web.CurrentUser.Email);
                }

            }
            return Content("SP Null");

        }

and then all of a sudden seems to spring to life and then works for the rest of the day.

I can only think it's because the the Token as that has an expiry of 12 hours.

My current theory is something to do with the sharepoint box and the users machine using different domain controllers and us requiring a 'ADFS' - but this is a 'systems' job and I'm currently waiting for the systems/sharepoint guy to return.

I'm getting very little through the reposting

SPAppToken: 
SPSiteUrl: xxxxxxx
SPSiteTitle: xxxxxx
SPSiteLogoUrl: 
SPSiteLanguage: en-US
SPSiteCulture: en-US
SPRedirectMessage: EndpointAuthorityMatches
SPCorrelationId: xxxxxx
SPErrorCorrelationId: xxxxxxxxx
SPErrorInfo: The Azure Access Control service is unavailable.

I can't see the error in the ULC logs.

The error that I do see in the ULC seems to be

SPSecurityTokenServiceManager!EnsureSharePointLogonRequestClaims: InputIdentity doesn't conatin a PrimarySid claim

Is there something I'm missing or that warrants further investigation? Oh and the test user can access the sharepoint site as well.

UPDATE

So we are using claims based sharepoint and the sid isn't set by default on the sync with AD. Given we are using the sid to tell sharepoint which user we want to pretend to be is this an issue?

private static JsonWebTokenClaim[] GetClaimsWithWindowsIdentity(WindowsIdentity identity)
        {
            JsonWebTokenClaim[] claims = new JsonWebTokenClaim[]
            {
                new JsonWebTokenClaim(NameIdentifierClaimType, identity.User.Value.ToLower()),
                new JsonWebTokenClaim("nii", "urn:office:idp:activedirectory")
            };
            return claims;
        }

Update 2

Ok, I think I've picked this out a bit - seems that there is a problem in the SharePoint roles/identity because when you go to the 'check roles' you get nothing despite the user having access (and can via the sharepoint site).

Then adding the user directly into sharepoint (not via the AD groups) then it works.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.