I am trying to access an web application through provider hosted App. In the webapplication, at clientContext.ExecuteQuery(); I am getting 'The remote server returned an error: (401) Unauthorized'. Following unxpected error is recorded in uls logs

SPApplicationAuthenticationModule: Failed to authenticate request, unknown error. Exception details: System.IdentityModel.Tokens.SecurityTokenException: The issuer claim of the user identity doesn't match the nameid (name identifier) claim of the delegated identity (actor identity). It is expected that these two claims match and hence this token is rejected. at Microsoft.SharePoint.IdentityModel.SPJsonWebSecurityBaseTokenHandler.ValidateActorIsSelfIssuer(SecurityToken token, ClaimsIdentityCollection result) at Microsoft.SharePoint.IdentityModel.SPJsonWebSecurityBaseTokenHandler.ValidateToken(SecurityToken token) at Microsoft.SharePoint.IdentityModel.SPJsonWebSecurityTokenHandler.ValidateToken(SecurityToken token) at Microsoft.SharePoint.IdentityModel.SPApplicationAuthenticationModule.TryExtractAndValidateToken(HttpContext httpContext, SPIncomingTokenContext& tokenContext) at Microsoft.SharePoint.IdentityModel.SPApplicationAuthenticationModule.ConstructIClaimsPrincipalAndSetThreadIdentity(HttpApplication httpApplication, HttpContext httpContext, SPFederationAuthenticationModule fam) at Microsoft.SharePoint.IdentityModel.SPApplicationAuthenticationModule.AuthenticateRequest(Object sender, EventArgs e)

Any help would be greatful.

  • I am using client secret. For TokenHelper.GetS2SAccessTokenWithWindowsIdentity, when passing 'null' I am getting this error. When passing Request.LogonUserIdentity, it is working fine. Not sure why it is not working under App prinicpal as I already having the client secret. Sep 16, 2013 at 12:57

1 Answer 1


I restarted my box & started the whole configuration again. This time it worked. Steps that are redone -

  1. Created new self signed certificate.
  2. Registered it with SharePoint using the following PS Commands $publicCertPath = "c:\certificates\SampleCert.cer" $issuerId = [System.Guid]::NewGuid().ToString() $issuerId $spurl ="http://hostname/sites/sitecoll" $spweb = Get-SPWeb $spurl $realm = Get-SPAuthenticationRealm -ServiceContext $spweb.Site $certificate = ***New-Object System.Security.Cryptography.X509Certificates.X509Certificate2($publicCertPath)*** New-SPTrustedRootAuthority -Name "SampleCert" -Certificate $certificate $fullIssuerIdentifier = $issuerId + '@' + $realm New-SPTrustedSecurityTokenIssuer -Name $issuerId -Certificate $certificate -RegisteredIssuerName $fullIssuerIdentifier -IsTrustBroker
  3. Used http://hostname/_layouts/15/appregnew.aspx to register the App with SharePoint
  4. Used the generated Appid as ClientId, AppSecret as ClientSecret and IssuerId from 2nd step.

I guess restarting the box has fixed my issue as I haven't done anthing different. View at Microsoft Docs: https://docs.microsoft.com/pt-br/sharepoint/dev/sp-add-ins/create-high-trust-sharepoint-add-ins

  • I am getting this too- even with <f5 > deploy will try your method. one thing can you please confirm whether the hostname/sites/sitecol is your app dev site collection. Nov 19, 2014 at 17:07
  • Its the SharePoint site collection where the app will be used to display the data. Not the app dev site collection Nov 21, 2014 at 6:05
  • oK, in my case I am VS2013 deploying to my (on prem) App toi remote web /app web. In the end the issue is related to the web app/ root sc of my app dev site not allowing REST calls, PP Nov 21, 2014 at 9:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.