Local debugging provider-hosted apps

Question

Environment:

• SharePoint Server 2013 farm installed on my dev machine, configured for using apps
• VS 2012 Update2 + Office Tools

When I start debugging any example (say, basic provider-hosted app for SharePoint) of provider-hosted app I receive 401 error.

From what I understand, VS opens IIS Express for the purpose of debugging

Is there any way of how to configure such a dev environment to debug provider-hosted apps locally? (I'm aware of the possibility to use SharePoint online instead of local farm to successfully debug provider-hosted apps)

Update: I understand that provider hosted app should use ACS or S2S authentication in production or test environment. And there are resources describing how to configure that. What I'd like to have is an ability to easily debug provider hosted apps locally in the environment described above (just hit F5) Is that achievable without configuring ACS or S2S authentication locally(the same way it's required in prod environment)?

Update 2: I think the answer to my question is - "configure S2S authentication properly". After all I've got it working. I would recomment the following article as the most compact, descriptive and helpful one. If you need your provider-hosted app debuggable locally, just follow the steps in the article.

Answer 1

Some things to make sure of:

1. Your dev server is properly registered with the domain controller

2. There is no user profile created for the user the app is acting on behalf of. Ensure that you have created a user profile for the user accessing the remote app.

3. Your app does not have permission to the resource you are trying to access. Ensure that the following Windows PowerShell cmdlet has been run (with appropriate values for $web and $appPrincipal) for the app Id you are using and the SharePoint web you are trying to get access to:

C# Copy Set-SPAppPrincipalPermission -Site $web -AppPrincipal $appPrincipal -Scope Site -Right FullControl

1. Your .NET web application is accepting anonymous requests. This means there is not a real user identity in the access token. Ensure that the root directory of your remote web app has anonymous access disabled in IIS. You can also check this by debugging your remote web application, and checking the value of Request.LogonUserIdentity in the default.aspx.cs file to ensure that it's not an anonymous user.

2. You app certificate was not added to the trusted certificate store.