1

0

I am struggling with this below case, your help can unblock me. Requirement: Execute SharePoint Rest API from a dot net core project which is secured by Azure AD.

Details: I have recently created a new Dot Net Web API project which will be consumed by a React application later on. (In Later stage access token will come coming from react application). I needed to protect this API project with Azure AD app so that every API call will be authenticated properly.

Steps I followed: Step:1: Registered an AD application and captured its information in App settings.json.(For API Permissions I have attached the screen shot)[![enter image description here][1]][1]

Step 2: For protecting this API project I have added below code in startup.cs file:

services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme).AddMicrosoftIdentityWebApi(Configuration); Step 3: Have this structure in App settings.json file:

{
  "AzureAd": {
    "Instance": https://login.microsoftonline.com/,
    "Domain": "mydomain.onmicrosoft.com",
    "ClientId": "client ID",
    "TenantId": "tenant Id",
    "Audience": "client id
    "AllowWebApiToBeAuthorizedByACL": true
  },
  "Logging": {
    "LogLevel": {
      "Default": "Information",
      "Microsoft": "Warning",
      "Microsoft.Hosting.Lifetime": "Information"
    }
  }
}

Step 4: Added Authorize attribute at controller level like this:

[Route("api/v1/[controller]")]
    [ApiController]
    [Authorize]

I am able to generate access token from postman and able to access this API.

Actual Issue: In API methods I need to use SharePoint REST APIs for GET and POST operations in SharePoint Site( this action is from backend API side)

I am getting 401 error when I use same access token coming from HttpContext.Request.Headers[“Authorization”];

This made me think to generate different token for SharePoint? I have tried multiple different ways but no success, not sure what is recommended approach in this case to be able to call SharePoint Rest APIs. Should I need one more AD app to access SharePoint? Please advise here.

Note: Dot Net core version: 3.1, SharePoint Online [1]: https://i.stack.imgur.com/nNk5A.png

3
  • What are you trying to do? Depending on that, you might need more permissions than just allsites. read and allsites.write. Also, there is a difference between application and delegated permissions. Can you try to add application permissions for sharepoint? Here's the thing: to get delegated access token you need to use different authorization url that is tied to sharepoint user than url used to get Application access.
    – jo1storm
    Sep 21, 2021 at 12:58
  • I am trying to use SharePoint Follow, Unfollow Rest API within in a dot net api project which is protected by Azure AD. I have also tried by giving AllSites.FullControll as well, but it still gives 401 error.
    – Neelam
    Sep 22, 2021 at 8:52
  • Ok, this looks very familiar. I had the similar error with the Graph api. You probably need to add Social. something or another permissions as well. Are you following this example or? docs.microsoft.com/en-us/sharepoint/dev/general-development/…
    – jo1storm
    Sep 22, 2021 at 9:00

1 Answer 1

0

Ok, I'll try to help you the best I can.

According to you comments, you are trying to make a certain Sharepoint user follow or unfollow a Sharepoint site/page/list/something. Unless that user is known and an administrator (member of administrator group who has at least read access permissions on whatever you are trying to follow) whose username and password you know (and can put in Azure credentials storage to be used by your API), you're going to have a bad time.

For that purpose you have made a Web Api Project. You have generated access token, client id and everything else needed. Those things are used for application access and you have them.

I assume there is no problem for you to gain application access to sharepoint API's. There is problem with in-built sharepoint APIs themselves.

There are different sharepoint APIs. Some of them are available for both application access and user access. Some of them are available for user access only. That user access is called delegated access because your application is pretending to be a user to use a user-only API. So user is delegating their permissions/identity to the application.

Anyway, tl;dr:

Follow/unfollow is user only api. You can only access it by getting access token by using username/password or by authorizing USER with sharepoint some other way. The principle to authorize to sharepoint is the same as with graph in this link:

https://docs.microsoft.com/en-us/graph/auth-v2-user

What is happening right now is that you are trying to access "authorized user-only" api with application token. One potential solution is to make "automated admin user" who will get the token, give it to application to use and will be used only for that exact purpose.

So the issue here is: your user has access to your custom api, your custom api has application access to sharepoint, your custom api doesn't have user access to sharepoint (thus error 401, unauthorized). Now, when that user is known and has all the needed permissions, things are easy. Just send credentials to sharepoint, get access token, do whatever you need to do. If you need to get credentials of every user using your custom API, authorize them and get access token, things get complicated fast.

I hope this clears things up and will help you solve your problem.

PS: For application to be able to interact with sharepoint, you will need to give API sharepoint application permissions. That will help with sharepoint application apis but not with "user only" apis.

PPS: If you want to see how sharepoint is using its own apis, inspect the element, go to network tab and try clicking follow/unfollow button on the page to see the calls happening.

2
  • 1
    Thank you to understand the issue, so should i need to add SharePoint Application level permissions in "API PErmission" section?
    – Neelam
    Sep 22, 2021 at 10:14
  • @Neelam You should, for your application to work or to interact with sharepoint at all, but I am not certain that will help with "follow/unfollow" api. As far as I know, it is user only api.
    – jo1storm
    Sep 22, 2021 at 10:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.