I am coding an application using Phone Gap to connect to a Sharepoint in Office365.

I need to use the REST services in Sharepoint Office 365 to add items to a list, but before that I need to authenticat

This is the javascript code I use to authenticate:

        'url': 'https://login.microsoftonline.com/extSTS.srf',
        dataType: 'text',
        'data': '<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing" xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"><s:Header><a:Action s:mustUnderstand="1">http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue</a:Action><a:MessageID>urn:uuid:40c1407d-b2a4-4e05-8248-8a92b71102b6</a:MessageID><a:ReplyTo><a:Address>http://www.w3.org/2005/08/addressing/anonymous</a:Address></a:ReplyTo><a:To s:mustUnderstand="1">https://login.microsoftonline.com/extSTS.srf</a:To><o:Security s:mustUnderstand="1" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"><u:Timestamp u:Id="_0"><u:Created>2012-07-26T16:13:00.622Z</u:Created><u:Expires>2012-07-26T16:18:00.622Z</u:Expires></u:Timestamp><o:UsernameToken u:Id="uuid-69882db9-2d6b-45d3-b016-c2156cb6c01d-1"><o:Username>admin@somethingonline.onmicrosoft.com</o:Username><o:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">******</o:Password></o:UsernameToken></o:Security></s:Header><s:Body><t:RequestSecurityToken xmlns:t="http://schemas.xmlsoap.org/ws/2005/02/trust"><wsp:AppliesTo xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy"><a:EndpointReference><a:Address>https://somethingonline.sharepoint.com/_forms/default.aspx?wa=wsignin1.0</a:Address></a:EndpointReference></wsp:AppliesTo><t:KeyType>http://schemas.xmlsoap.org/ws/2005/05/identity/NoProofKey</t:KeyType><t:RequestType>http://schemas.xmlsoap.org/ws/2005/02/trust/Issue</t:RequestType><t:TokenType>urn:oasis:names:tc:SAML:1.0:assertion</t:TokenType></t:RequestSecurityToken></s:Body></s:Envelope>',
        headers: {
            Accept : "application/soap+xml; charset=utf-8"
        success: function(result, textStatus, jqXHR) {
            console.log('done in login ');
            console.log('result '+result);
            var xmlDoc = $.parseXML( result );
            var xml = $( xmlDoc )
            var binToken= xml.find( "wsse\\:BinarySecurityToken" ).text();
            console.log("Binary Token:"+binToken);

            //  alert(  localStorage.getItem('BinaryToken') );
        error:function (jqXHR, textStatus, errorThrown){
            console.log(errorThrown+'error login:' + jqXHR.responseText);
        complete:function(jqXHR, textStatus) {
            console.log('login completed ' + textStatus);

Which basically sends an <s:Envelope> requesting authentication.

This sends an XML with a <wsse:BinarySecurityToken> which we then use to actually authenticate:

function wsignin(token){
    // alert(  token );
    console.log('start wsignin' );
    console.log('wsignin token:'+token );
        'url': 'https://somethingonline.sharepoint.com/_forms/default.aspx?wa=wsignin1.0',
        dataType: 'text',
        headers: {
            Accept : "application/x-www-form-urlencoded"
        success: function(result, textStatus, jqXHR) {
            console.log('done wsignin ' + result);
            // alert( result  );
        error:function (jqXHR, textStatus, errorThrown){
            console.log('error wsignin:' + jqXHR.responseText);
        complete:function(jqXHR, textStatus) {
            console.log('complete wsignin ' + textStatus);

    console.log('end wsignin' );

All this works perfectly with Explorer 9 (using jQuery.support.cors = true;) but, the exact same code, with Phone Gap, instead of returning in the result the html of the main page inside https://somethingonline.sharepoint.com/ it returns the Office365 login page.

What can I do? What am I doing wrong? Is there some other way to authenticate?

Update: Reading on MSDN found this:

SharePoint Online Authentication Cookies

An important aspect of this process, and the one that makes it difficult but not impossible to use remote authentication for SharePoint Online in client-side applications, is that the FedAuth cookies are written with an HTTPOnly flag. This flag is designed to prevent cross-site scripting (XSS) attacks. In a cross-site scripting attack, a malicious user injects script onto a page that transmits or uses cookies that are available on the current page for some nefarious purpose. The HTTPOnly flag on the cookie prevents Internet Explorer from allowing access to the cookie from client-side script. The Microsoft .NET Framework observes the HTTPOnly flag also, making it impossible to directly retrieve the cookie from the .NET Framework object model.

Maybe this means... that integration with Sharepoint Online in Office365 ¿is plain impossible?

  • Did you get this to work? I'm looking into the same issue at the moment. – raly Sep 5 '12 at 10:59
  • No, it still does not work – Luxspes Sep 21 '12 at 18:38
  • Did you guys come up with a solution to this? I am in the same boat, lol. Cheers – Chunkyfeather Mar 19 '13 at 11:46
  • This does not really answer the question. If you have a different question, you can ask it by clicking Ask Question. You can also add a bounty to draw more attention to this question once you have enough reputation. – BlueSoul Mar 19 '13 at 13:54
  • @Chunkyfeather no, so far it does not work, so we had to abandon PhoneGap – Luxspes Mar 20 '13 at 16:55

Very interesting topic.

The integration with Office 365 and SharePoint Online is possible. See the detailed instructions and examples for .NET, .NET again, node.js, python.

I have tested it in javascript, in node.js and it works. There all you need to do is to install sharepoint node package. The logic is the same as in .NET or python or Java, the same as you do in your code:

  1. Send a SAML code to STS (Security Token Service) with username, password and endpoint.
  2. Send the token you've got to the login page. Capture the cookies rtFA and FedAuth
  3. Append these two cookies as request headers in every request to the sharepoint online site.

I tried your solution (which I modified a little bit). Requesting the token works and the wsignin works perfectly.

The only thing that doesn't work are the rtFA and FedAuth cookies. I can't get them in a XMLHttpRequest in the PhoneGap WebView (which is a kind of a mobile browser). So these cookies aren't sent automatically, and you can't get them in a webview with javascript. You have to create some additional server layer to handle authentication and data retrieving.

UPDATE: The only "Set-Cookie" I get in the XMLHttpResponse from wssignin page is MSPOK:

set-cookie: MSPOK=$uuid-3367547c-f7aa-4054-aa34-fdf0de2ae83d$uuid-445d329f-6466-42f4-b1c7-5f417fa528af$uuid-2a4bba00-1e7b-494d-af4d-19fb7c2646ff$uuid-1bfdab84-eacb-4908-88df-d7e7e927749e;domain=login.microsoftonline.com;path=/;version=1

| improve this answer | |
  • Thanks for the answer, but I know it works with .NET, IE9, and node.js (not tried phython, no need) but the thing is that it does not work with Phone-Gap. And my question is explicitly about doing it with Phone-Gap – Luxspes Sep 21 '12 at 18:40
  • I know. I said about node and python just to be complete. I tested this in PhoneGap and answered what I found. Hopefully we can find a solution. – Anatoly Mironov Sep 22 '12 at 5:59

I don't know if you resolved your problem yet, but I would try to set the UserAgent header inside your requests to a valid browser User Agent, for example:

Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)

It should help.

| improve this answer | |
  • Thanks for answering, but I do not see why it should... this problem is derived from the fact that Office365 uses FedAuth cookies that are written with an HTTPOnly flag, regardless of the User Agent (and PhoneGap seems unable to deal with those) – Luxspes Sep 21 '12 at 18:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.