I am trying to access an web application through provider hosted App. In the webapplication, at clientContext.ExecuteQuery();
I am getting 'The remote server returned an error: (401) Unauthorized'.
Following unxpected error is recorded in uls logs
SPApplicationAuthenticationModule: Failed to authenticate request, unknown error. Exception details: System.IdentityModel.Tokens.SecurityTokenException: The issuer claim of the user identity doesn't match the nameid (name identifier) claim of the delegated identity (actor identity). It is expected that these two claims match and hence this token is rejected. at Microsoft.SharePoint.IdentityModel.SPJsonWebSecurityBaseTokenHandler.ValidateActorIsSelfIssuer(SecurityToken token, ClaimsIdentityCollection result) at Microsoft.SharePoint.IdentityModel.SPJsonWebSecurityBaseTokenHandler.ValidateToken(SecurityToken token) at Microsoft.SharePoint.IdentityModel.SPJsonWebSecurityTokenHandler.ValidateToken(SecurityToken token) at Microsoft.SharePoint.IdentityModel.SPApplicationAuthenticationModule.TryExtractAndValidateToken(HttpContext httpContext, SPIncomingTokenContext& tokenContext) at Microsoft.SharePoint.IdentityModel.SPApplicationAuthenticationModule.ConstructIClaimsPrincipalAndSetThreadIdentity(HttpApplication httpApplication, HttpContext httpContext, SPFederationAuthenticationModule fam) at Microsoft.SharePoint.IdentityModel.SPApplicationAuthenticationModule.AuthenticateRequest(Object sender, EventArgs e)
Any help would be greatful.
TokenHelper.GetS2SAccessTokenWithWindowsIdentity
, when passing 'null' I am getting this error. When passingRequest.LogonUserIdentity
, it is working fine. Not sure why it is not working under App prinicpal as I already having the client secret.