Workflow getting Access denied when calling the rest webservice from subsite

Question

i have following problem. I am using SP 2013 Online and i am trying to access some informations from the sub site, like http://[SPOnlineUrl]/SubSite/_api/web/title. But i will always get the annoying

 {"error":{"code":"-2147024891, System.UnauthorizedAccessException","message": {"lang":"en-US","value":"Access denied. You do not have permission to perform this action or access this resource."}}}

Access Denied json Response.

The Workflow is manually started as Site Workflow at http://[SPOnlineUrl]/

I am using elevated workflow app-permissions explained in this msdn article with FullControl at SiteCollection level.

So, long story short, is it generally NOT possible to read/write Sub Site informations via the the REST interface and the Call a Web Service action from a Sharepoint 2013 Workflow (even with elevated permissions)?

Thanks for your help.

Answer 1

It is possible provided you've followed the instructions in the MSDN article. Doesn't matter where the site is (above/below in the current hierarchy or in a different site collection all together). Usually this error is because the app hasn't been given access to the target site... I'd verify you've granted it access, per the article instructions.

Answer 2

As explained before, but I will summarize it in here, the user of the workflow can't make REST calls to other sites or subsites by default, you should give the sites and subsites the permission to the workflow to make those calls.

To be able to do it, first Allow your workflow to be used as an App by activating the feature Workflow can use app permissions on the site where the workflow is. Later you should go to the Site Settings > Site App Permissions. It is where you can copy it's id, the GUID between | and @ signs. And go to each subsite that will allow this app, that wrappes the workflow, to make REST calls. To go to that menu just go to the site: https://siteCol/subsite/_layouts/15/appinv.aspx

Later paste the GUID you just copied on the Application ID and click on find it. After that set up the permissions to:

<AppPermissionRequests>
       <AppPermissionRequest Scope="http://sharepoint/content/sitecollection" Right="FullControl" />
    </AppPermissionRequests>

Caution: Use this literal values, don't substitute sitecollection on that url above.

Now you can make your REST calls without any problem, by placing your actions inside the step called "App Step" as shown in the image https://i-msdn.sec.s-msft.com/dynimg/IC630049.png

Answer 3

Here is the full MSDN article that explains the "how", though I'm still getting unauthorized in my web api calls after having implemented it.

https://msdn.microsoft.com/en-us/library/office/jj822159.aspx

Answer 4

You needs to give permission to workflow app on your site collection or web please take look into following link. its working.

http://www.fabiangwilliams.com/2014/06/19/gotcha-on-sharepoint-designer-workflows-in-app-step/

Answer 5

A caveat to permissions for SharePoint 2013 workflows - users initiating SP 2013 workflows must have a user profile synced in the User Profile Administration Service in Central Admin. If users are given permissions to a site/list/library via the AD security group that are part of, the User Profile Service needs to be aware that Security group exists or the 401 error will occur when a user in that group initiates a SP2013 workflow. This will even happen when an App Step is utilised.

To map an AD security group in the User Profile Service, it needs to be selected in the Containers section of the 'Configure Synchronization Connections'edit page.

In the Configure Synchronization Settings page, 'Users and Groups' should be selected' in the Synchronization Entities section.

A full sync/incremental profile sync is then required.

These two blog posts were of huge assistance in me figuring this out -

http://www.sharepoint4developers.net/en-nz/post/sp2013-workflows-suspended-state.aspx

http://anujabhojani.blogspot.co.uk/2013/02/sharepoint-2013-workflow-gets-canceled.html