1

We are trying to deploy our first high-trust SharePoint 2016 app in a non-dev environment but get the common “401 Unauthorized” error. Our environment is as follows:

  • SharePoint 2016 Server
  • Remote Provider Hosted App-server with IIS 10.0

This Stack Exchange post from 2017 lists almost exactly the same problem and symptoms, but we already have their solution in place (use a CA certificate instead of a self-signed one).

We have double-checked the following:

  • Certificate in use (from our internal CA) using a FQDN address, using SHA256 and SAN
  • Certificate serial number in web.config (on remote server) is typed by hand
  • Certificate private key (on remote server) has Read permission for IIS_IUSR group. (Without this we get a “Keyset does not exist” error.)
  • Client ID generated by AppRegnew.aspx is correct in web.config
  • Token Issuer ID is correct in web.config
  • Everything is running HTTPS, both SharePoint and the remote web server
  • Remote web server authentication is set to NTLM followed by Negotiate. Anonymous access is disabled.
  • Get-SPTrustedRootAuthority lists our FQDN certificate (as well as an intermediate and root certificate.)
  • Get-SPTrustedSecurityTokenIssuer lists our Token Issuer with the RegisteredIssuerName as “IssuerGUID@SharePointRealmGUID”
  • The app permissions in our app manifest XML file are “Manage” at SiteCollection level and we have also tried “Full Control” at Tenant level.

SharePoint ULS logs

Error when get token for app i:0i.t|ms.sp.ext|133809c8-e459-44f7-a206-1136bf1c2539@77b99930-703e-4df3-94b0-acc6556794a5, exception: Microsoft.SharePoint.SPException: Azure Access Control Service is unavailable.    
 at Microsoft.SharePoint.Administration.SPSecurityTokenServiceDiscoveryManager.DiscoverApplicationSecurityTokenService(SPServiceContext serviceContext)    
 at Microsoft.SharePoint.ApplicationServices.SPApplicationContext.GetApplicationSecurityTokenServicesUri(SPServiceContext serviceContext)    
 at Microsoft.SharePoint.ApplicationServices.SPApplicationContext..ctor(SPServiceContext serviceContext, SPIdentityContext userIdentity, OAuth2EndpointIdentity applicationEndPoint)    
 at Microsoft.SharePoint.SPSecurityContext.SecurityTokenForApplicationContext(SPIdentityContext userIdentityContext, String applicationId, Uri applicationRealm, SPApplicationContextAccessTokenType applicationTokenType, SPApplicationDelegationConsentType consentValue)    
 at Microsoft.SharePoint.SPServerToAppServerAccessTokenManager.GetAccessTokenPrivate(SPServiceContext serviceContext, String appId, Uri appEndpointUrl, SPAppPrincipalInfo appPrincipal, SPApplicationContextAccessTokenType tokenType, Boolean useThreadIdentity, SPUserToken userToken)

App token requested from appredirect.aspx for site: 913136fe-207e-447c-9630-4f0fd88304b0 but there was an error in generating it.  This may be a case when we do not need a token or when the app principal was not properly set up.  LaunchUrl:https://remoteserver.domain.com/Pages/Default.aspx?SPHostUrl=https://sharepoint.domain.com/sites/site&SPLanguage=sv-SE&SPClientTag=14&SPProductNumber=16.0.4615.1000&SPAppWebUrl=https://app-9f504b2adb7f3a. appdomain.com/sites/site/OurApp Exception Message: Azure Access Control Service is unavailable.  Stacktrace:   
 at Microsoft.SharePoint.Administration.SPSecurityTokenServiceDiscoveryManager.DiscoverApplicationSecurityTokenService(SPServiceContext serviceContext)    
 at Microsoft.SharePoint.ApplicationServices.SPApplicationContext.GetApplicationSecurityTokenServicesUri(SPServiceContext serviceContext)    
 at Microsoft.SharePoint.ApplicationServices.SPApplicationContext..ctor(SPServiceContext serviceContext, SPIdentityContext userIdentity, OAuth2EndpointIdentity applicationEndPoint)    
 at Microsoft.SharePoint.SPSecurityContext.SecurityTokenForApplicationContext(SPIdentityContext userIdentityContext, String applicationId, Uri applicationRealm, SPApplicationContextAccessTokenType applicationTokenType, SPApplicationDelegationConsentType consentValue)    

Fiddler logs

  • Two instanes of 401 – 1) the server presents NTLM and Negotiate options and 2) the client tries with NTLM.

    From TextView: SPAppToken=&SPSiteUrl=https%3A%2F%2Fportal.domain.com%2Fsites%2Fsite&SPSiteTitle=Sitename&SPSiteLogoUrl=https%3A%2F%2Fapp-9f504b2adb7f33.domain.appdomain.com%2Fsites%2Fsite%2Fbranding%2FImages%2FSiteIcon.jpg&SPSiteLanguage=sv-SE&SPSiteCulture=sv-SE&SPRedirectMessage=EndpointAuthorityMatches&SPCorrelationId=7b04499f-e991-504a-5c02-7a78bc35c7ee&SPErrorCorrelationId=7b04499f-e991-504a-5c02-7a78bc35c7ee&SPErrorInfo=The Azure Access Control service is unavailable.

We have followed several guides:

https://docs.microsoft.com/en-us/sharepoint/dev/sp-add-ins/create-and-use-access-tokens-in-provider-hosted-high-trust-sharepoint-add-ins

https://docs.microsoft.com/en-us/sharepoint/dev/sp-add-ins/high-trust-configuration-scripts-for-sharepoint#addsprootauthorityps1

https://docs.microsoft.com/en-us/sharepoint/dev/sp-add-ins/package-and-publish-high-trust-sharepoint-add-ins

https://jeremythake.com/troubleshooting-sharepoint-2013-provider-hosted-apps-on-premises-d4b5f633f48d

https://nikpatel.net/2016/03/05/cheat-sheet-to-troubleshoot-sharepoint-provider-hosted-high-trust-add-ins-401-403-404-and-misc-errors/

Questions:

  1. Just double-checking that ClientSecret is not needed in the web.config file for high-trust apps? (This Microsoft page says “Note that there is no ClientSecret key in a high-trust SharePoint Add-in.”)
  2. Please help. :)

Thank you so much for any help!

0

Problem solved. Our app was in fact not configured to use OAuth (yet), so the SharePoint requests that failed turned out to be sent by the computer account.

Long version

We mistakenly checked ULS logs on the wrong server (APP instead of WFE) so the first time around we missed important ULS log events. After checking the ULS logs on the WFE server, where the remote app server is sending its requests, we found that the requests were being sent as the computer account.

From ULS:

w3wp.exe (0x18A8)   0x10AC  SharePoint Foundation   User Key    ayswq   Medium  Successfully got user key for user. UserNameSuffix: '0#.w|domain\machine$'.

Our SharePoint app was in fact (not yet) using OAuth impersonation, but using the system context for retrieving data from SharePoint. This meant that the IIS application pool account on our remote web was used, and the app pool was configured with the default account ApplicationPoolIdentity. (See Microsoft for more information.) The default account ApplicationPoolIdentity creates local unique virtual accounts for each app pool. But for network requests, the computer account is used instead.

Once we gave the computer account permissions in SharePoint, our app started working. This is not how our app will work when it's done, but the problem is finally solved for now. :)

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.