I have an ASP.NET MVC app that connects to SharePoint 2010 via the Client OM. When I run ExecuteQuery()
, I get a HTTP 401 error from SharePoint.
I have the MVC app set to impersonate the logged in user.
The impersonate setting in web.config (of the MVC app):
<configuration>
<system.web>
<identity impersonate="true" />
</system.web>
</configuration>
The code:
Client Context ctx = new ClientContext("http://sharepoint.company.com/site");
ctx.Credentials = CredentialCache.DefaultNetworkCredentials;
Web web = ctx.Web;
ListCollection lists = web.Lists;
ctx.Load(web);
ctx.Load(lists);
ctx.ExecuteQuery();
The exception:
System.Net.WebException: The remote server returned an error: (401) Unauthorized. at System.Net.HttpWebRequest.GetResponse() at Microsoft.SharePoint.Client.SPWebRequestExecutor.Execute() at Microsoft.SharePoint.Client.ClientContext.EnsureFormDigest() at Microsoft.SharePoint.Client.ClientContext.ExecuteQuery() at MVCApp.Services.SharePointService.GetLibraries()
When I remove the impersonation setting from web.config, the Client OM uses the MVC app's app pool account to connect. When this happens, the connection is successful (after granting the app pool account permissions). Also, if I hard code a user credential instead of using DefaultNetworkCredentials
, the connection works as well.
The app is configured for Windows authentication, and Anonymous authentication is disable in IIS.
Things we have tried:
- ensure the app pool accounts are able to delegate permissions.
- verified kerberos configuration (we removed some duplicate SPNs)
- connect from a different server (we are hosting this app on the SharePoint App Server). Connecting from this server means we can't connect to ANY sharepoint instance. Connecting from another server allows us to connect to our DEV environment, but not this server (QA) or our production environment.
What can I do to get the Client OM to delegate the user permissions when connecting to SharePoint?
Update
Interestingly, I tried a simple WebRequest to SharePoint, with identical results, which tells me that the issue is not caused by the Client OM:
WebRequest request = WebRequest.Create("http://xxxxxxxxx");
request.Credentials = CredentialCache.DefaultNetworkCredentials;
using(WebResponse response = request.GetResponse())
using(StreamReader reader = new StreamReader(response.GetResponseStream()))
{
return Content(reader.ReadToEnd(), "text/html");
}